thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

OffSec · Cybersecurity · Professional

OffSec Certified Professional (OSCP+) exam guide

Exam PEN-200 / OSCP+

The OffSec Certified Professional (OSCP+) is the best-known hands-on penetration testing certification: a 24-hour proctored exam where you compromise live machines and an Active Directory set, then write a professional report. Since late 2024 the '+' designation expires after three years, while the base OSCP stays valid for life.

QuestionsSee official page
Time limit1440 minutes
Passing score70 of 100 points
Exam fee$1,749 USD
Valid for3 years
DeliveryOnline, proctored by OffSec over VPN

Format: 24-hour proctored practical: 3 standalone machines (initial access and privilege escalation) plus 1 Active Directory set of 3 machines; report submitted afterwards. Fee note: Course + Cert Bundle: 90 days of PEN-200 and 1 exam attempt. Learn One $2,749/year with 2 attempts; standalone exam $1,699.

Who it's for

Aspiring and junior penetration testers, red teamers and security engineers who can commit 2-4 months of hands-on lab practice.

What the exam covers

Information gathering and enumeration—
Web application attacks—
Client-side and public exploits—
Linux and Windows privilege escalation—
Password attacks—
Port forwarding and tunnelling—
Active Directory enumeration and attacks—
Report writing—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None formal.

Recommended: Solid Linux and Windows command line, TCP/IP networking, and basic Bash or Python scripting.

Keeping it active

The OSCP+ designation expires three years after issue; keep it by passing the OSCP+ recertification exam, passing a qualifying OffSec exam (OSEP, OSWA, OSED or OSEE) before expiry, or completing OffSec's CPE program. The base OSCP never expires.

Skills & careers

Skills it validates

  • Systematic enumeration of services
  • Exploiting public and modified exploits
  • Linux and Windows privilege escalation
  • Active Directory attack chains
  • Pivoting and tunnelling
  • Writing professional pen test reports

Job roles

Penetration TesterRed Team OperatorSecurity ConsultantOffensive Security EngineerVulnerability Researcher (Junior)SOC Analyst (Offensive Skills)

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Month 1: Work through PEN-200 modules and exercises; take notes in a searchable tool.
  2. Month 2: Complete the PEN-200 challenge labs, especially the AD sets.
  3. Month 3: Practise on extra retired machines and build a privilege escalation checklist.
  4. Month 3: Do a 24-hour mock (three boxes plus AD) and write a full report.
  5. Book the exam once you can root most lab machines without hints.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • The AD set is worth 40 points and is all-or-nothing per machine chain; many candidates start there.
  • Take breaks and sleep; the 24 hours are followed by 24 hours for the report.
  • Screenshot proof files with the IP address visible exactly as the exam guide requires, or you lose points.
  • Do not use prohibited tools such as automated exploitation frameworks beyond the allowed limits; read the exam guide.
  • Enumerate again whenever stuck; most failures come from missed services.

Key terms for this exam

All 16 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does OSCP+ cost?

$1,749 for the Course + Cert Bundle (90 days, one attempt), $2,749/year for Learn One (two attempts), or $1,699 for the exam alone.

Does OSCP expire?

The '+' expires after three years; the base OSCP does not.

How hard is OSCP+?

It is demanding; most candidates spend 2-4 months in the labs.

OSCP+ vs CEH?

OSCP+ is fully practical and preferred by pen testing employers; CEH is knowledge-based and common in compliance-driven roles.

What is the passing score?

70 of 100 points.

Official page: www.offsec.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.