thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

GIAC · Cybersecurity · Professional

GIAC Penetration Tester (GPEN) exam guide

Exam GPEN

GIAC Penetration Tester (GPEN) proves you can plan and run network penetration tests, including password attacks, Kerberos and domain escalation, and Azure attack paths. Aligned with SANS SEC560, it pairs methodology with hands-on CyberLive tasks.

Questions82
Time limit180 minutes
Passing score73%
Exam feeSee official page
Valid for4 years
DeliveryRemote proctored (ProctorU) or Pearson VUE test center

Format: Proctored exam with multiple choice and CyberLive hands-on lab questions; open book. Fee note: GIAC shows the price at checkout; attempts bundled with SANS training cost less than standalone attempts. Includes practice tests.

Who it's for

Penetration testers, red team members and defenders who want structured offensive skills.

What the exam covers

Penetration Test Planning—
Reconnaissance—
Scanning and Host Discovery—
Vulnerability Scanning—
Exploitation Fundamentals—
Metasploit—
Password Attacks and Formats—
Kerberos Attacks—
Domain Escalation and Persistence Attacks—
Azure Overview, Attacks, and AD Integration—
Command and Control (C2)—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: Networking and Windows/Linux administration experience; SANS SEC560 is the aligned course.

Keeping it active

Valid four years: earn 36 CPEs in the cycle and pay GIAC's certification maintenance fee, or renew by retaking the current exam.

Skills & careers

Skills it validates

  • Scoping and rules of engagement
  • Host discovery and vulnerability scanning
  • Exploitation with Metasploit
  • Password hash attacks and cracking
  • Kerberos and Active Directory attacks
  • Azure and Entra ID attack paths
  • C2 frameworks and post-exploitation

Job roles

Penetration TesterRed Team OperatorSecurity ConsultantVulnerability Assessment AnalystOffensive Security Engineer

DoD 8140

Listed in the DoD 8140 qualification matrix for offensive and vulnerability assessment work roles. Confirm on the DoD CWQ site. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-3: Study SEC560 books or equivalent; focus on AD and Kerberos attacks.
  2. Week 4: Build your index and practise Azure attack labs.
  3. Week 5: Redo every lab end to end without notes.
  4. Week 6: Two timed practice tests, refine index, book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • GIAC exams are open book (printed notes only); build a tabbed index of your course books before the exam.
  • At 73% GPEN has one of the higher GIAC pass marks; aim for 80%+ on practice tests.
  • Kerberos (kerberoasting, golden/silver tickets) and password attacks are heavily represented.
  • CyberLive tasks expect you to run tools, not just recognise them.

Key terms for this exam

All 13 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much is GPEN?

Price is shown at GIAC checkout and is lower with SANS training.

GPEN vs OSCP+?

OSCP+ is a 24-hour practical; GPEN is a shorter mixed exam with methodology depth. Many testers hold both.

Is GPEN open book?

Yes.

Pass mark?

73%.

Renewal?

Every four years with 36 CPEs.

Official page: www.giac.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.