GPEN
GPEN is GIAC's hands-on penetration-testing certification, aligned to the SANS SEC560 curriculum and respected across offensive-security and red-team hiring. Unlike a multiple-choice quiz, it drops you into live virtual machines and asks you to actually run the tools — so it carries real weight on a résumé, maps to DoD 8140 cyber workforce roles, and gates many pentest and clearance-adjacent jobs. One missed attempt costs a four-figure fee and weeks of momentum. This page breaks down exactly what GPEN tests, how it's delivered, and how to get it done right the first time.
Pay Only After You Pass
No upfront fee — you settle only after your verified passing result. We advertise guaranteed results — 100% pass guaranteed or money back.
How the GPEN exam is built — at a glance
82
A mix of standard knowledge questions and hands-on CyberLive tasks. Question counts can vary slightly by exam version, but the current published spec is 82 questions.
73%
The cut score for versions released on or after July 12, 2025. Result is pass/fail — there is no scaled score or percentile reported to employers.
3h
Three hours of seat time. The live-lab tasks eat into the clock fast, so pacing and a well-built reference index matter as much as raw knowledge.
A portion of GPEN is delivered as CyberLive — performance-based questions inside a real virtual machine with real tooling. You scan, exploit, crack, and pivot against live targets and submit the concrete result the task asks for. There is no way to bluff a CyberLive item; you either get the box to give up the answer or you don't.
GPEN is proctored and open-book, yet only printed and handwritten references are allowed — no digital files, no internet, no second device. Strong candidates build a tabbed, indexed binder of their SANS SEC560 course books so they can locate a command or technique in seconds rather than reading from scratch.
The full penetration-test lifecycle — GIAC does not publish per-domain weights, so these are clean skill areas, not percentages
Scoping a penetration test, rules of engagement, and open-source intelligence gathering. Profiling a target's footprint before a single packet is sent.
Host discovery, port and service scanning, and vulnerability scanning. Turning raw scan output into a prioritised list of viable attack paths.
Exploitation fundamentals and driving the Metasploit Framework — selecting payloads, landing initial access, and validating the foothold.
Password attacks, attacking and cracking password hashes, and Kerberos attacks such as kerberoasting — recovering and reusing credentials.
Domain escalation and persistence, privilege escalation and exploitation, and establishing command-and-control over compromised hosts.
Azure overview, attack strategies, and Azure AD integration — attacking cloud applications and identity, a fast-growing slice of modern engagements.
GIAC publishes the objective areas above but does not weight them with fixed percentages, so we don't show invented weight bars. In practice the live CyberLive labs cluster around scanning, exploitation, password attacks, and post-exploitation — the steps where you must demonstrate the skill, not just recall it.
Two proctoring routes — and what to expect on exam day
You take the exam from a private room at home, monitored by a live remote proctor through ProctorU. You'll complete a system check, a webcam room scan, and an ID verification before the exam unlocks. A clear desk and stable connection are essential — the CyberLive labs run in-browser against remote VMs.
You sit the exam in a monitored Pearson VUE test center. Staff verify your government photo ID, store your belongings, and watch the room. The content and the 73% cut score are identical to the remote route — the only difference is where you sit and who proctors.
A valid, unexpired government photo ID with a name matching your GIAC account. The proctor captures a photo before the exam unlocks.
Open-book means hard-copy course books, your index, and handwritten notes. No laptops, phones, ebooks, or any digital resource at the desk.
Stay on-camera and in frame the whole time. The CyberLive VMs run remotely, so a dropped connection can cost you live minutes — close everything else first.
GPEN is built for hands-on offensive-security professionals
No formal prerequisite — but the hands-on bar is real
Difficulty: GPEN is moderately hard. The knowledge questions reward a good index, but the CyberLive labs are unforgiving — you have to land a working exploit or crack inside a live VM, on the clock. Candidates who only memorise concepts and never touch the tooling tend to run out of time. That live-lab pressure is exactly the pain point our help is built to remove.
GPEN is a four-figure, hands-on exam where the CyberLive labs leave no room to bluff. Exam Assist pairs you with a vetted penetration-testing specialist and works on a pay-after-you-pass model — so the risk sits with us, not you. No upfront fee, guaranteed results: Exam Assist handles the sitting end to end, and you settle only after the verified result.
Tell us your proctoring route (ProctorU or Pearson VUE), your test date, and your background. Takes a couple of minutes over WhatsApp, Telegram, or Discord.
We review your timeline and the CyberLive demands and tell you plainly whether it's realistic — before any money is discussed. If it isn't a fit, we say so.
Exam Assist handles the sitting end to end. You're matched with a pentest specialist who maps the work around the live-lab tasks, the open-book index, and the proctored environment — discreetly and confidentially.
You only pay once your passing result is confirmed on your official GIAC record. No verified result, nothing owed.
Tell us your exam date and proctoring route — get an honest, no-pressure feasibility answer first.
Straight answers about the GIAC GPEN exam
Get matched, or compare sibling cybersecurity certifications
Share your exam date and proctoring route to get matched with a vetted pentest specialist. No upfront fee — settle only after a verified pass.
Start the conversation OSCPOffSec's 24-hour hands-on pentest exam — the closest sibling to GPEN's live-lab style, weighed toward full exploitation chains.
View exam GWAPTThe GIAC sibling focused on web app attacks — same open-book, CyberLive format as GPEN, narrowed to the application layer.
View exam GCIHThe defensive counterpart — detecting and responding to the same attack techniques GPEN teaches you to run. A common pairing.
View examGet expert GPEN help with no upfront fee — you settle only after your verified passing result. Honest feasibility answer first, results-first arrangement always.