Certification guide
GPENGIAC Penetration Tester Certification (GPEN): the honest guide
Everything GIAC publishes about GPEN, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from GPEN’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
Practise GPEN questions in the meantimeWhat the exam actually asks you to do
A CyberLive exam. Some of the questions put you into a live machine with the real tools and score what you do there. GIAC does not publish how many of the 82 are hands-on, so neither do we.
Item formats
- Multiple choice
- Hands-on lab
The highlighted formats are the ones you cannot answer from memory alone. GIAC, GPEN certification details ↗
Domain breakdown
Password Attacks and Hashes is the heaviest domain at 22 percent, followed by Exploitation and Privilege Escalation at 20 percent.
GIAC publishes the GPEN Exam Certification Objectives and Outcome Statements as a list of sixteen objectives with no percentages attached. The six groupings above and the percentages assigned to them are ours. We built them by grouping GIAC's published objective titles into related clusters and spreading 100 points across those clusters. They are a study aid for planning review time, not an official GIAC weighting, and GIAC does not endorse them.
- Penetration Test Planning10%
- Reconnaissance, Scanning, and Vulnerability Discovery18%
- Exploitation and Privilege Escalation20%
- Password Attacks and Hashes22%
- Domain Escalation, Kerberos, and Persistence18%
- Azure Attacks and AD Integration12%
Where to focus: GIAC lists sixteen objectives with no weighting, but four of them concern passwords, formats, and hashes and four more concern Active Directory, Kerberos, and Azure or Entra ID, so split review time along that spread instead of assuming even coverage. GIAC also states the CyberLive portion is currently delivered at the end of the exam, so practice working inside a lab environment and switching back to the question interface while a clock is running.
What comes after passing
GPEN is valid for 4 years. GIAC states that its certifications require renewal every four years and that registration is enabled at the 2-year mark prior to the certification expiration date. GIAC publishes two renewal methods: collect 36 CPE credits over four years, or renew by retaking the exam. GIAC states the certification maintenance fee is a non-refundable $499 payment, due once every four years at the time of registration.
Costs across the full renewal cycle are on the GPEN cost page.
Frequently asked questions
How much does the GPEN exam cost?
GIAC's pricing page lists the GPEN certification attempt at $999. The same row lists an exam retake at $899, an attempt extension at $479, a certification renewal at $499, and a practice exam at $399. GIAC also notes a $175 reseating fee for missed proctored exam appointments.
Is the GPEN exam hands-on?
GIAC lists GPEN under CyberLive, which it describes as a hands-on exam format that replaces traditional multiple-choice testing with performance-based challenges in realistic lab environments. GIAC does not publish how many of the 82 questions are CyberLive items, and its CyberLive FAQ says the share of the final score varies by examination. GIAC does say the CyberLive portion is currently delivered at the end of the exam and that exam timing accounts for the time it takes.
Does GPEN have prerequisites?
GIAC does not publish a prerequisite on the GPEN certification page. Under How To Prepare it lists training available in a variety of modalities including live training and OnDemand, practical work experience, and college level courses or self-paced study through other programs or materials.
How long does GPEN stay valid, and how is it renewed?
GIAC states that its certifications require renewal every four years, and answers its own question 'How many years is my certification active for?' with 'Four Years'. Renewal is either 36 CPE credits collected over four years or retaking the exam, plus a non-refundable $499 maintenance fee due once every four years at the time of registration.
Keep reading
GPEN practice questions
Free sample questions with the full explanation on every answer.
Free GPEN practice test
Ten real questions, playable now. No account, no card.
GPEN passing score
The exact cut score, what kind of number it is, and the retake terms.
How hard is GPEN?
An honest difficulty read from the format, the clock and the weights.
Practise GPEN for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free GPEN questions