Prepare for GPEN by organizing your study around the published objective list and the decisions it names. Confirm the exam format and passing score that apply to your attempt in your GIAC account, build a one-page decision map per objective area, rehearse each map in an authorized isolated lab, and use GIAC's practice exams as a gauge rather than a prediction. Keep every hands-on exercise inside a lab you own or are explicitly authorized to test.
How the GPEN exam works
GPEN is a single proctored exam with 82 questions over 3 hours and a 73% minimum passing score, delivered in GIAC's hands-on CyberLive format.
GIAC describes CyberLive as hands-on assessment using virtual machines, real tools and code. The GPEN page identifies CyberLive as part of this certification. Prepare to demonstrate the practical skills as well as study the published objectives; do not assume every question has the same format.
The published format is one proctored exam of 82 questions in 3 hours, with a minimum passing score of 73%. GIAC states that this passing score applies to candidates who receive the exam version released on or after July 12, 2025, and directs you to the Certification Information section of your GIAC account to confirm the format and score for your specific attempt.
After your application is approved and your purchase is processed, the certification attempt activates in your GIAC account and you have 120 days from activation to complete it. All GIAC exams are web-based and proctored, with two options: remote proctoring through ProctorU or onsite proctoring through PearsonVUE.
What the objectives cover
GIAC groups the GPEN objectives into planning and reconnaissance, scanning and exploitation with post-exploitation and pivoting, and a third cluster covering Azure, Entra ID and password attacks.
The certification page lists four covered areas: comprehensive penetration test planning, scoping and reconnaissance; in-depth scanning and exploitation with post-exploitation and pivoting; Azure overview, integration and attacks; and in-depth password attacks. The detailed objective statements beneath these add more specific skills, which the rest of this guide turns into study decisions.
- Planning and reconnaissance: a process-oriented approach to testing and reporting, plus high-level information gathering about the target organization and network
- Scanning: choosing appropriate techniques for host discovery, port scans, operating system and service version scans, and vulnerability scanning with result analysis
- Exploitation and post-exploitation: exploitation fundamentals, data exfiltration from compromised hosts, pivoting to other hosts, and Command and Control frameworks
- Passwords: attack types, formats and hashes, defenses, circumstances for each variation, guessing attacks, and methods that attack password hashes and authenticate
- Directory environments: Windows privilege escalation and Kerberos attacks against Active Directory, plus Entra ID fundamentals, Azure authentication and attacks on Azure applications
- Tooling: using and configuring the Metasploit Framework at an intermediate level
Scoping decisions shape every technique
Treat planning and scoping as the first decision point of every GPEN topic: what is in bounds determines which reconnaissance, scanning, and attack techniques are legitimate for a given engagement.
The objectives pair pen test planning with a process-oriented approach, so practice converting scoping details into technique decisions. A scope that permits some techniques but forbids others changes what you may run against a target, and a scope limited to one subnet changes how you handle a pivot. When you study any attack technique, ask first: under what scope would I be allowed to use this?
For a paper scoping drill, suppose the written lab instructions authorize only 10.0.1.0/24 and require instructor approval before any additional network is tested. A diagram found within that lab references 10.0.2.0/24. Under those supplied rules, record the reference and obtain approval before testing the second range. Discovering its name has not enlarged the written scope.
Reconnaissance versus scanning: two information layers
Reconnaissance gathers high-level organizational information, such as contacts, IP ranges, document formats, and supported systems; scanning probes hosts directly. Keep the two layers separated in your notes and practice classifying outputs.
The objectives frame reconnaissance largely as information leakage: public contacts, address ranges, document formats, and supported platforms. Study it as a layering problem. An organizational layer, such as staff names and posted documents, feeds a technical layer of netblocks, domains and exposed services. For each open-source intelligence source you practice with, record which layer it feeds and whether using it contacts the target.
A useful drill is to gather artifacts yourself and assign each one to a phase. A certificate transparency log entry revealing an internal naming convention for staging servers is reconnaissance: no packet touched the host. A version scan against one of those hosts is active scanning and enumeration. The exercise below rehearses exactly that judgment.
Practice exercise
You are reviewing research notes for an engagement you are authorized to perform against example.com. Classify each artifact as reconnaissance or direct scanning, using the GPEN objective definitions: (1) a published conference biography listing the client's CTO and the company's firstname.lastname email pattern; (2) a certificate transparency log entry showing the hostname staging.example.com; (3) a TCP connection sweep across the in-scope address range to find responsive hosts; (4) a publicly downloadable annual report whose document metadata reveals the software used to produce it.
Show answer
(1) Reconnaissance. (2) Reconnaissance. (3) Direct scanning. (4) Reconnaissance.
Under the distinction used in this paper example, artifacts 1, 2 and 4 are supplied organizational information, while item 3 is a direct network-probing activity. GIAC lists organizational reconnaissance and network scanning as preparation objectives. These categories organize the exercise; they do not mean all reconnaissance is passive or that public information is always collected without contacting infrastructure.
Matching scans to goals and reading output honestly
The objectives require using the appropriate technique for host discovery, port scanning, and service and OS identification. Map each goal to a scan type, then practice interpreting results as qualified findings.
Build the mapping as a table you reproduce from memory. Each row is a goal, not a tool. When a scenario says a client wants a list of running services with versions, you should be able to name the goal, the scan approach, and the caveat before touching any command. This mirrors the objective language about analyzing scan results rather than merely producing them.
Honest interpretation is the second half of the skill. Practice writing scan conclusions as qualified findings: state what an output supports and what it merely suggests. In an isolated lab, run a scan and then write down three statements the output supports and three it does not. That contrast trains the analytical habit the objectives describe, and it carries into reporting, where an overclaimed finding misleads the client.
| Published scan objective | Preparation task |
|---|---|
| Host and port discovery | Explain the goal and review the outputs in the corresponding authorized lab. |
| Operating system and service identification | Use the tool documentation to check how it represents results and uncertainty. |
| Vulnerability scanning | Review the course procedure for analyzing results and supporting each reported finding. |
Exploitation, post-exploitation, and the pivot decision
The GPEN objectives include exploitation, post-exploitation and pivoting. Keep each objective visible in your lab preparation.
Choose an authorized course lab with explicit instructions for the objective you are studying. Record the intended result, your observed result and the evidence you would include in a report. For a pivoting objective, use the lab material that explains the network arrangement and permitted actions.
The objectives establish these as tested skills; they do not prescribe one universal sequence of exploitation, privilege escalation and pivoting for every network. Verify the procedure in the lab instructions rather than treating an outline heading as a complete technical method.
Password attacks: matching the variation to the circumstance
Review the password-attack formats, defenses and circumstances named in the GPEN objectives.
The objectives distinguish password guessing from attacks involving password hashes and authentication. Use the corresponding course explanations to connect each method to its inputs, applicable environment and defenses.
In your notes, keep the source of a technical claim beside the claim. A useful entry names the objective, the relevant course section or tool documentation, and one complete example you have checked in an authorized lab. The objective list does not establish a blanket rule to skip cracking whenever a credential representation is available.
Two identity planes: Active Directory and Entra ID
GPEN separates on-premises Active Directory and Kerberos attacks from Azure and Entra ID attacks. Study them as distinct planes with their own objectives rather than one merged topic.
On the domain side, the objectives cover common Windows privilege escalation attacks, Kerberos attack techniques, and attacks used to consolidate and persist administrative access to Active Directory. Learn the underlying ticket concepts well enough to explain what each technique abuses, and observe ticket issuance in a small lab domain you control. Name each technique alongside the Kerberos mechanism it targets rather than memorizing a disconnected list.
On the cloud side, the objectives cover Entra ID implementation fundamentals, common Entra ID attacks, federated and single sign-on environments, Azure authentication protocols, and attacks against Azure applications. For each area, ask where authentication actually happens in a given configuration, because federated and single sign-on setups are listed separately from a purely cloud-managed directory. When you read any Entra attack description, note which plane it touches and what credential form it consumes; conflating the two planes leads to applying on-premises assumptions to cloud scenarios and vice versa.
A preparation sequence you can adapt
Work from the published objectives outward: build a decision map per area, rehearse it in an isolated lab, and use GIAC's practice exams as a gauge of your preparation, not a prediction of your score.
A sequence that fits how the objectives are worded: first, copy the objective list from GIAC's GPEN page and build a one-page decision map per area, covering scan selection, password variation, pivoting, and the two identity planes. Second, run a small scenario per map in an authorized, isolated lab and record every decision with its justification. GIAC describes the exam's CyberLive format as using virtual machines and real tools, so hands-on practice belongs in labs you own or are explicitly authorized to test.
GIAC states that practice exams simulate the real exam and can serve as a gauge of whether your preparation methods are sufficient, but that the practice question bank is limited, so repeats are expected, and that practice exams never include actual exam questions. Treat a practice score as a milestone in your study, not a forecast of your result.
- Map check: every objective area has a one-page decision map you can reproduce without notes
- Lab check: each drill ran in an isolated environment you are authorized to use, with decisions written down and justified
- Interpretation check: you can state what a scan output supports and what it does not
- Administrative check: you confirmed the format, passing score, delivery, and rules for your attempt in your GIAC account
Next steps and official documents
Register through GIAC, confirm your attempt details in your account, and use GIAC's own preparation resources and practice tests before your 120-day attempt window runs down.
Your practical next steps: review the official GIAC GPEN certification page for the current objectives, activate or purchase your certification attempt, note the 120-day completion window from activation, and choose between ProctorU remote proctoring and PearsonVUE onsite proctoring. GIAC also lists training in live and OnDemand formats, notes that practical work experience and college-level or self-paced study can support mastery, and sells GPEN practice tests.
For extra practice questions and broader study planning, try the free GPEN practice set or browse the other study guides on this site. Both complement, but never replace, the official objectives page.
Sources
Exam facts checked against GIAC's official page on 15 September 2026: