GIAC GPEN Guide: Exam, Requirements and Preparation

GIAC Penetration Tester (GPEN) is a costly, three-hour proctored exam that tests a full penetration testing process, and candidates who prepare only for the exploitation part tend to lose marks on planning, passwords and identity attacks. This guide sets out what GIAC publishes about GPEN: the exam format, the 16 certification objectives, delivery and open book rules, prices and the four-year renewal cycle. It adds a preparation plan, a view on when GPEN is worth the cost compared with other penetration testing credentials, and where it fits on an offensive security career path. It is written for testers, red and blue team members, and managers deciding whether to fund it. It describes the certification only, not testing techniques. Facts are as published on giac.org, checked October 2026; GIAC states that prices can change without notice, so confirm on the linked pages before you register.

Key takeaways

• One exam, 82 questions, 3 hours. GPEN is a single proctored exam with a minimum passing score of 73% for exam versions released on or after 12 July 2025.
• The scope is process plus identity. The 16 objectives run from test planning and reconnaissance through exploitation and pivoting, and include password attacks, Kerberos and Active Directory, and Azure and Entra ID.
• It includes hands-on testing. GIAC lists GPEN with CyberLive, which it describes as performance-based challenges in lab environments using virtual machines and real tools.
• The price is high. GIAC lists a certification attempt at $999, a retake at $899 and a practice exam at $399 (USD, excluding tax), usually on top of training.
• Renewal is every four years. Holders collect 36 CPE credits and pay a $499 renewal fee, or renew by exam.

Who the certification is for

GIAC classes GPEN as a practitioner certification. Its stated audience is security staff responsible for assessing networks and systems, penetration testers, ethical hackers, red team and blue team members, and defenders, auditors and forensic specialists who want to understand offensive tactics better.

• Good fit: internal or consultancy testers who run network and Active Directory engagements and want a credential that clients and procurement teams recognise; blue team staff moving towards purple team work; staff whose employer funds SANS training (GIAC's justification letter for GPEN refers to SANS SEC560).
• Good fit for employers: GIAC states it is accredited under ISO/IEC 17024 through ANAB, and the GPEN page carries DoD 8140, DORA and NIS2 alignment badges. Confirm any specific DoD 8140 work role mapping with the hiring organisation, as the page does not list roles.
• Weaker fit: complete beginners, who will get more from a foundation credential first; self-funded candidates, for whom the CompTIA PenTest+ Guide covers a similar process at lower cost; and testers who need to prove they can compromise a lab end to end over many hours, for whom the OSCP Certification Guide is the usual comparison.

For a wider comparison across vendors and levels, see the Cybersecurity Certifications Guide. For how penetration testing is commissioned and scoped in practice, see the Penetration Testing Guide.

Exam format and domains

Format

At 82 questions in 180 minutes you have a little over two minutes per question on average, but hands-on items take longer than knowledge questions. GIAC does not publish how many items are CyberLive, so plan your pace around the practice exam rather than a fixed rule.

The 16 certification objectives, grouped

GIAC lists 16 objectives without weightings, summarised as three areas: planning, scoping and reconnaissance; scanning, exploitation, post-exploitation and pivoting; and Azure and password attacks. The grouping below is ours; objective names are GIAC's.

Eight of the 16 objectives concern passwords, Active Directory or Azure and Entra ID. Candidates whose experience is mostly web application or external infrastructure testing should expect to spend much of their study time there.

Where identity fits: GPEN's syllabus is a reminder that most internal compromise paths run through credentials, Kerberos tickets and cloud application identities rather than software flaws. Testers who earn it should be able to explain those findings to identity teams in terms of service accounts, application registrations and privilege, not just hashes. See the Entra ID Applications and Consent Guide and the Kerberos Delegation Security Guide.

Prerequisites and experience

The GPEN page lists no formal prerequisite and no minimum experience. The objectives assume you can already work comfortably at this level:

• Networking: TCP/IP, common services and ports, and how to read scan output and decide what matters.
• Windows and Active Directory: domains, groups, authentication and how Kerberos and NTLM are used, and the basics of Entra ID and hybrid identity.
• Linux and scripting: command line fluency and enough scripting to read and adapt simple tools.
• Process: rules of engagement, scoping and reporting. Penetration Test Planning is an objective in its own right, and it is the one experienced technical testers most often skip.
• Training: not mandatory. GIAC links SANS enterprise penetration testing training, and most candidates who buy it use the course books as the base of their open book index. If you self-study, assemble printed references for every objective before you start.

Only test systems you are authorised to test. Build a private lab for practice rather than using production or third-party systems.

Preparation plan

Preparation for an open book GIAC exam has two outputs: skill and knowledge, and a fast, personal index into your printed materials. Hands-on items add a third: lab practice under time pressure.

1. Plan the window (before activation): the attempt must be completed within 120 days of activation. GIAC suggests booking the proctored appointment at least a month ahead; cancelling with less than 24 hours' notice, a no-show or an ID name mismatch at Pearson VUE costs a $175 seating fee.
2. Baseline (week 1): score yourself red, amber or green against all 16 objectives. Typical reds are Azure and Entra ID, password formats, and C2 concepts.
3. Build a lab (weeks 1 to 2): a small isolated Windows domain, a Linux host and a trial cloud tenant you own are enough to practise every objective legally.
4. Study by objective (weeks 2 to 8): work through course books or equivalent references group by group, repeating each lab until you can do it without notes. Write the planning and reporting material up as you would for a client.
5. Build the index (alongside study): record terms, tool options, ports, hash formats and concepts with book and page number, sorted alphabetically. Write it yourself.
6. First practice exam (week 9): GIAC's practice exams simulate the real engine and question style, never contain real exam questions, and draw on a limited bank. Sit it under real conditions with printed material only, and log slow lookups and slow lab items.
7. Close the gaps (weeks 10 to 11): restudy weak objectives and repeat lab tasks against the clock.
8. Second practice exam and sit (week 12): sit the second practice exam about a week before the real one. For remote delivery, check ProctorU's technical requirements early; for Pearson VUE, bring two original, current IDs that match your appointment name and arrive 15 minutes early.

If you fail: GIAC lists a retake at $899. The pages checked did not state a waiting period, so confirm the retake rules in your GIAC account. Treat the score report as a map of which objective groups to revisit.

Small vs large organisations: a small consultancy may find PenTest+ or a practical lab exam covers client expectations at a fraction of the cost of SANS training plus GPEN. Large organisations and consultancies bidding for government or regulated work often value GIAC's ISO/IEC 17024 accreditation and DoD 8140 alignment, and can spread SANS training costs across a team.

Measuring readiness

• Practice scores: both practice exams comfortably above 73%.
• Pace: the practice exam finished with at least 20 minutes to spare.
• Lab fluency: each lab task repeatable from your notes in a fixed time you set in advance.
• Lookup rate: fewer than one question in five needing the index.
• Coverage: all 16 objectives amber or green, including the four password and two Azure objectives.

Common failure patterns

• Skipping the process objectives: experienced testers neglect Penetration Test Planning and lose easy marks.
• Underestimating cloud identity: two objectives cover Azure and Entra ID, and on-premises testers often have no hands-on exposure.
• Treating the index as the plan: 82 questions in 3 hours leaves no time to look everything up, and hands-on items need practised speed.
• Burning skips early: answered questions cannot be revisited and skips are limited.
• Letting the window lapse: a 120-day window passes quickly; an extension costs $479.
• Proctoring problems: late arrival, a name mismatch or late cancellation each trigger the $175 fee.

Cost, renewal and continuing education

CPE categories and caps

All CPEs must be earned within the four years in which the certification is active. If it has already expired, GIAC asks holders to contact it about options. Training is priced separately by SANS and is usually the larger cost.

Where it fits on the career path

GPEN usually comes after a foundation credential and some hands-on time, and is often a tester's first specialist certification.

• Before it: a broad credential such as the GIAC GSEC Guide or the CompTIA PenTest+ Guide.
• Alongside it: the OSCP Certification Guide and the CEH Certification Guide are the usual comparisons in job adverts.
• After it: GIAC's pricing page lists GX-PT at a reduced attempt price ($499 rather than $1,299) for holders of an active GPEN; specialist routes are covered in the OSEP and OSWE Certification Guide and the Practical Red Team Certifications Guide.
• Roles: see the Penetration Tester Career Guide, the Red Teaming Guide and the Purple Teaming Guide.

GIAC does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates.

Practitioner checklist

• Confirm the current price, passing score and exam version in your GIAC account before activating.
• Book the proctored appointment at least a month ahead and inside the 120-day window.
• Map yourself against all 16 objectives and plan extra time for passwords, Active Directory and Entra ID.
• Build an isolated lab you own and practise only on authorised systems.
• Write your own index with book and page references while you study.
• Sit both practice exams under real conditions: printed materials only, timed, no review of answered questions.
• Check ID names, arrival time and cancellation rules for your delivery option.
• After passing, diarise the four-year expiry and log 36 CPEs within the category caps.

Standards and references

• GIAC: GIAC Penetration Tester (GPEN)
• GIAC: Certification Pricing
• GIAC: Proctored Exams
• GIAC: Renewal Knowledge Base
• GIAC: Certification Renewal

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Penetration Testing Guide · OSCP Certification Guide · CompTIA PenTest+ Guide · Penetration Tester Career Guide