FirstTry

Certification guide

GPEN

GIAC Penetration Tester Certification (GPEN): the honest guide

GPEN is GIAC's network penetration testing exam. One proctored sitting, 82 questions, three hours, and a minimum passing score of 73 percent for exam versions released on or after 12 July 2025. Delivery is web based and proctored either remotely through ProctorU or on site at a Pearson VUE center, and an attempt has to be used within 120 days of the day GIAC activates it.

Two things make it unlike most security exams. It is open book for printed material, so the index you build while studying is a legitimate exam tool and no digital reference is allowed. And it is a CyberLive exam: some questions drop you into a live virtual machine with the real tools and score what you do there rather than what you can describe. GIAC does not publish how many of the 82 items are hands-on.

GIAC publishes sixteen objectives for GPEN and no weighting for any of them, so nothing on that list can be safely written off. Four of the sixteen are about passwords, formats and hashes, and four more are about Active Directory, Kerberos, Entra ID and Azure, which is the closest thing to a weighting the vendor's own list gives you. The groupings and percentages on our objectives page are ours, not GIAC's, and are labeled that way.

Who GPEN is for

A good fit if

  • You run network penetration tests or red team engagements and want a credential whose exam involves doing the work rather than writing about it.
  • Active Directory is where your engagements live. Kerberos attacks, domain escalation and persistence, password formats and hashes take up a large share of the published objectives.
  • Your testing has followed the organization into Entra ID and Azure, and you want the exam that examines those attacks beside the on-premises ones rather than in a separate cloud certification.
  • You are a security engineer or systems administrator who has picked up internal offensive testing and needs external proof for work you already do.
  • You are taking the affiliated SANS training and want the credential the course is built around.

Probably not, if

  • You have never run an exploit against a system you were allowed to touch. The CyberLive items put you in front of the tools with a clock running, and there is no partial credit for knowing what Metasploit does without having driven it.
  • You want a first security certification. The attempt alone is $999 and the objectives start where an introductory course stops.
  • Your work is web application testing, or cloud only. This exam's center of gravity is networks, hosts and Active Directory, and GIAC certifies those other specialties separately.
  • You need a credential this month to clear a hiring filter. A 120 day attempt window, a 30 day wait after any failure and an index that takes weeks to build are the wrong shape for that.

Is GPEN worth it?

For a working penetration tester, the case rests on the exam format rather than on the acronym. A CyberLive certification says somebody watched you use the tools under time, which is a different claim from a multiple choice pass, and it is the reason the credential holds its value whether or not you sat the course.

It is worth less as a first credential or on a resume for a role that never touches offensive work. The attempt is $999, renewal is a four year cycle with 36 CPE credits and a fee, and none of that pays back unless the skills get used on engagements.

Self funding the attempt is a defensible decision for a tester who already has the experience. Self funding the training is a different question entirely, and the honest comparison there is against what the same money buys in lab hardware, cloud time, conferences and a year of deliberate practice.

What the exam actually asks you to do

A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 82 are hands-on, so neither do we.

Item formats

  • Multiple choice
  • Hands-on lab

The highlighted formats are the ones you cannot answer from memory alone. GIAC, GPEN certification details ↗

Domain breakdown

Password Attacks and Hashes is the heaviest domain at 22 percent, followed by Exploitation and Privilege Escalation at 20 percent.

GIAC publishes the GPEN Exam Certification Objectives and Outcome Statements as a list of sixteen objectives with no percentages attached. The six groupings above and the percentages assigned to them are ours. We built them by grouping GIAC's published objective titles into related clusters and spreading 100 points across those clusters. They are a study aid for planning review time, not an official GIAC weighting, and GIAC does not endorse them.

  • Penetration Test Planning10%
  • Reconnaissance, Scanning, and Vulnerability Discovery18%
  • Exploitation and Privilege Escalation20%
  • Password Attacks and Hashes22%
  • Domain Escalation, Kerberos, and Persistence18%
  • Azure Attacks and AD Integration12%

Where to focus: GIAC lists sixteen objectives with no weighting, but four of them concern passwords, formats, and hashes and four more concern Active Directory, Kerberos, and Azure or Entra ID, so split review time along that spread instead of assuming even coverage. GIAC also states the CyberLive portion is currently delivered at the end of the exam, so practice working inside a lab environment and switching back to the question interface while a clock is running.

GIAC: GIAC certification objectives ↗

Study plans by experience level

Working penetration tester

6 to 8 weeksat 6 to 8 hours

  1. 1Read GIAC's sixteen objectives and, for each one, write down the tool you would reach for and the command you would run. Anything you cannot answer from memory is the study list, and the list is usually shorter than it feels.
  2. 2Build the index from week one: one line per tool, flag, hash format and attack path, with the page it lives on in your printed references. Print it in the final week and do not plan around searching a PDF you will not be allowed to open.
  3. 3Spend two weeks on passwords: formats and hashes, where each one is stored, guessing against services, cracking offline, and the cases where relaying beats cracking. Four of the sixteen objectives sit here.
  4. 4Spend two weeks on Active Directory and Azure: Kerberos attacks, privilege escalation on Windows, persistence, command and control frameworks, then Entra ID fundamentals, federated and single sign-on environments and the attacks against them.
  5. 5Finish with a week rehearsing the mechanics under time. Scan, exploit, escalate and pivot in your own lab with a clock, then sit a practice test with the printed index beside you and fix every gap the index failed to answer.

Security engineer or administrator moving into offensive testing

12 to 16 weeksat 8 to 10 hours

  1. 1Build the lab first: a Linux attack box, two or three Windows machines joined to a domain you control, and a test Entra ID tenant. Every objective on GIAC's list can be rehearsed against that, and none of them can be rehearsed against production.
  2. 2Learn the process before the tools. Penetration test planning and scoping is the first objective for a reason, and a candidate who cannot describe rules of engagement, scope and reporting loses questions that require no technical skill at all.
  3. 3Work recon, scanning and vulnerability discovery until the output stops being a wall of text: what a port scan actually tells you, how service and operating system detection can be wrong, and how to read a vulnerability scan critically.
  4. 4Move to exploitation and Metasploit, then to escalation and pivoting, and make yourself do each one manually at least once before letting the framework do it. The hands-on items reward knowing what the tool is doing.
  5. 5Spend the longest block on passwords and Active Directory, in that order, since the second builds on the first. Capture hashes in your own lab, crack them, relay them, then move to Kerberos and domain persistence.
  6. 6Give the last three weeks to the index, timed practice and the Azure objectives, which are the ones administrators most often leave until they have run out of time.

Sitting the affiliated SANS training with the attempt bundled

8 to 10 weeks after the courseat 5 to 8 hours

  1. 1Book the exam date before the course ends. The attempt runs on a 120 day clock from activation, and the attempt that lapses is always the one with no date in the calendar.
  2. 2Index the course books in the first fortnight while the material is fresh, by topic, tool and command, with book and page numbers. GIAC's preparation page calls the index an essential part of studying, and one built from memory in the last week is slower to use.
  3. 3Repeat every lab without the workbook and time yourself. The CyberLive questions are lab tasks with a clock, and the gap between following a walkthrough and working from a blank prompt is the whole difficulty.
  4. 4Use a practice test at the halfway point to find weak objectives rather than to predict a score, then use the last one as a timed dress rehearsal in the final week.
  5. 5Revisit planning, scoping and reporting last. It is the part of the material that feels like reading rather than doing, and the exam asks about it in scenario form.

Common mistakes

Treating open book as a reason to study less
Three hours for 82 questions is about two minutes each, and the CyberLive items take longer than that, which means the rest have to take less. A candidate who has to look up how a tool works rather than where a fact is written runs out of clock. The book confirms what you know; it does not replace knowing it.
Bringing the wrong kind of reference
GIAC allows printed books, notes and study guides, and no digital items at all. A tablet of annotated PDFs stays outside the room. Build the index on paper and rehearse with it on paper, because a reference you have never used under time is not a reference.
Studying tools instead of formats
Four of the sixteen objectives are about password attacks, formats and hashes. Knowing which tool cracks which hash is not the same as knowing what an NTLM hash, a net-NTLMv2 response and a Kerberos ticket each are, where each is stored, and which attack each one enables. The exam asks the second question.
Leaving the Azure objectives until last
Two of the sixteen objectives cover Entra ID fundamentals, common attacks, Azure authentication and federated or single sign-on environments. Testers whose engagements are on-premises tend to defer them, then meet them for the first time in the exam. Build a test tenant early and attack it.
Letting the 120 day window run out
The attempt expires 120 days after activation. An extension costs money, a missed appointment costs a seating fee, and starting again costs the full attempt price. Put the exam date in the calendar on the day GIAC activates the attempt, not on the day you feel ready.
Expecting a practice test to teach you something
GIAC says its practice bank is limited, that the same question can appear on more than one practice test, and that practice exams never include actual exam questions. They are a rehearsal of pacing and of the engine. Buy one late rather than three early.

What comes after passing

Set the four year renewal date in a calendar on the day you pass. The routes are 36 CPE credits plus the renewal fee, or retaking the exam, and credits are far easier to log as you earn them than to find in the last six months of the cycle.

Write up an engagement beside the credential. GPEN attests to the mechanics; what it cannot show is scoping, client communication and a report somebody could act on, which is the half of the job that gets people hired.

GIAC's own next steps from here are the exploit development and advanced penetration testing certification for depth, the web application testing one if that is where your engagements go, and the cloud penetration testing one if they follow the estate into Azure and AWS.

Costs across the full renewal cycle are on the GPEN cost page.

Frequently asked questions

How much does the GPEN exam cost?

GIAC's pricing table lists the GPEN certification attempt at $999 and an exam retake at $899, with prices excluding applicable sales tax. The same row lists an attempt extension, a certification renewal and a practice exam separately, and GIAC charges a seating fee for a missed proctored appointment.

Is the GPEN exam open book?

Yes, for printed material only. GIAC states that its exams are open book and that all printed books, notes and study guides are allowed, with no digital items. Its preparation page treats building your own index as an essential part of studying rather than as an optional extra.

What happens if I fail GPEN?

A 30 day wait applies before you can sit again, and a retake can be bought within 30 days of your exam deadline, which extends the deadline by 60 days including that wait. A waiver can shorten the 30 days but a 14 day minimum cannot be waived, and after three failed attempts GIAC requires a year before a new attempt unless it accepts a documented waiver.

How long is GPEN valid, and how do I renew it?

Four years. GIAC's renewal steps are to choose between collecting 36 CPE credits and retaking the exam, log and justify the credits in the GIAC portal, and pay the renewal fee, after which the certification is active for four more years.

Do I need SANS training to sit GPEN?

No. GIAC publishes no prerequisite on the GPEN certification page, and under How To Prepare it lists training in a variety of modalities, practical work experience, and college level courses or self-paced study through other programs or materials as the ways candidates prepare.

Keep reading

Every guide and cost breakdown, by vendor

Practice GPEN for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free GPEN questions