Free practice test
GPENFree GIAC Penetration Tester Certification (GPEN) practice test
10 original GPEN questions, playable right now. No account, no card, no email gate. Every answer opens the full explanation: the concept, why the right option is right, and why each wrong option is wrong, cited to the authoritative documentation behind it.
Sample question 1 of 10
A defense team maps out where password guessing can happen against its estate. Which distinction separates an online attempt from an offline one?
Sample question 2 of 10
A tester overwrites a function pointer to redirect execution in a Windows application protected by Control Flow Guard. What happens when the CFG check fails at run time?
Sample question 3 of 10
An application server authenticates Kerberos clients but has no challenge-response or server subkey scheme of its own. What does RFC 4120 require it to maintain against replayed authenticators?
Sample question 4 of 10
A UDP scan of a client host reports many ports as open or filtered. What does that classification tell the tester about those ports?
Sample question 5 of 10
A small organization just wants its users to sign in to Microsoft 365 and SaaS apps with the least extra infrastructure. Which authentication method is recommended as the default?
Sample question 6 of 10
A client judges its payroll database too critical for intrusive testing but wants the rest of the estate covered. How should the plan record that decision?
Sample question 7 of 10
A team picks a default Argon2 configuration for a new credential store and wants the first option RFC 9106 recommends for all environments. Which configuration is it?
Sample question 8 of 10
During tool setup an engineer wants the single utility that combines payload generation with encoding, the one that replaced the older msfpayload and msfencode. Which utility is that?
Sample question 9 of 10
An engineer compares classic and resource-based constrained delegation in a forest. With the resource-based form, who decides which front-end services may act for users on a back-end service?
Sample question 10 of 10
A scanner reports a finding on a client host with a CVSS base score of 8.9, and the client's ticketing workflow files each finding under a named severity band. Which band applies?
Full GPEN question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
What this test covers
These 10 questions are drawn across the published exam blueprint rather than from one chapter: this set touches Password Attacks and Hashes, Exploitation and Privilege Escalation, Domain Escalation, Kerberos, and Persistence, Reconnaissance, Scanning, and Vulnerability Discovery, Azure Attacks and AD Integration, Penetration Test Planning. Every question is original, written from the official objectives, and verified against a cited vendor page before it serves. None are recalled exam content, which is why the explanations can cite their sources.
A 10-question sample tells you where you stand, not whether you are ready. The full experience is numbered practice exams: 82 questions apportioned to the official domain weightings, sat under the real 180-minute clock and scored against the published cut score.
Other free GIAC practice tests
Keep reading
- GPEN practice questions
Free sample questions with the full explanation on every answer.
- GPEN exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GPEN passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GPEN?
An honest difficulty read from the format, the clock and the weights.
- What GPEN costs
The voucher price, the retake, and what renewal costs across the cycle.
- GPEN guide
Who it is for, study plans by experience level, and whether it is worth it.