Skip to content
CertGPS

GIAC Penetration Tester

Proves you can plan and run an enterprise penetration test, from reconnaissance to Kerberos and Entra ID attacks, in an exam with CyberLive tasks

AdvancedGIAC

The exam

Exam cost
$999
Study time
4-6 months
Passing score
73%
Valid for
4 years

Before you book

  • None required by GIAC
  • Recommended by SANS for SEC560: networking, Windows and Linux command line, basic security concepts; Active Directory familiarity helps

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

GPEN Study Guide: Passwords, Active Directory, Entra ID and the Exam

GPEN, the GIAC Penetration Tester certification, shows you can run a process-driven penetration test against a Windows enterprise, from scoping and reconnaissance through Kerberos abuse to attacks on Microsoft Entra ID. The current exam, released July 12, 2025, is 82 questions in three hours with a 73% pass mark. Despite the broad name, none of its 16 objectives covers web application testing.

Who GPEN is for

GIAC lists penetration testers, ethical hackers, red and blue team members, and the people responsible for assessing networks and systems. It also names defenders, auditors and forensic specialists who want to understand offensive tactics. SANS rates the matching course, SEC560, as intermediate and expects you to be comfortable on the Windows and Linux command line, with networking and basic security concepts already in hand.

That makes GPEN a good fit for a tester in the first few years of internal network work, or for a security engineer whose employer wants someone in-house who can test Active Directory. If you've never touched a command line, start with GSEC. If your target is web applications, take GWAPT instead. If you'd rather be judged on a long practical, compare OSCP: OffSec's exam is a 24-hour proctored hands-on test, where GPEN is a three-hour open-book exam with hands-on sections.

GPEN at a glance

GPEN
VersionReleased July 12, 2025; your GIAC account confirms your attempt's version
Questions and time82 questions in 3 hours, including CyberLive tasks in live virtual machines
Passing score73%
Price$999 attempt; $899 retake; $479 extension; $399 per extra practice test
DeliveryProctored, online through ProctorU or at a Pearson VUE test center
MaterialsOpen book: printed books, notes and an index you made; no electronic material
PrerequisitesNone listed by GIAC
Time to sit it120 days from activation
Validity4 years; 36 CPEs and $499, or pass the current exam again

Where the 16 objectives put the weight

GIAC publishes no weights, but the list is lopsided. Passwords take four objectives on their own: types of password attack and when to use each, password formats and hashes, obtaining and attacking hashes, and further methods for cracking hashes and authenticating with them. Active Directory takes two more, Kerberos attacks and domain escalation and persistence, and another two cover Azure: Entra ID implementation and attacks, and Azure applications with federated and single sign-on attacks.

The remaining eight follow the shape of an engagement: planning and reporting, reconnaissance, scanning and host discovery, vulnerability scanning, exploitation fundamentals, escalation with exfiltration and pivoting, Metasploit at an intermediate level, and command and control (C2) frameworks. SANS maps SEC560's six sections onto exactly these, ending with a capture-the-flag day.

For preparation, that means two things. Credential attacks run through everything, from password spraying against Entra ID to Kerberoasting, so a gap there costs you in several objectives. And reporting appears only inside the planning objective, so don't expect the exam to grade a written report the way a practical exam would.

CyberLive is where weak hands-on skills show. GIAC places these tasks at the end of the exam, in real virtual machines, and its FAQ says a candidate who gets the majority of them wrong should not expect to pass. Leave yourself time for them.

Preparing for GPEN

SEC560, Enterprise Penetration Testing, by Jeff McJunkin and Jon Gorenflo, is six days live or 36 hours self-paced, with 30 labs. Its tools are named on the course page: Masscan and Nmap for scanning, Responder and Metasploit for initial access, Mimikatz and Hashcat for credentials, Sliver for C2, BloodHound and Impacket for Active Directory, plus Azure and Entra ID spraying. The US price is $8,780, both OnDemand and at most live US events. A GIAC attempt bought with the course is $999, which matches GIAC's own price, and SANS adds two practice tests.

Self-study is possible but thinner. The exam-specific book, the GPEN All-in-One Exam Guide by Raymond Nutting and William MacCormack, was published by McGraw Hill in October 2020 and predates the Entra ID and C2 objectives. Use it for methodology, scanning and Metasploit, and the GIAC objective list for everything else.

For practice, you need an Active Directory lab you can break. Game of Active Directory (GOAD), which SEC560 itself suggests for further practice, builds a vulnerable multi-domain lab from Orange Cyberdefense's GitHub project. Work through the chain in order: scan with Nmap, capture hashes with Responder, crack them with Hashcat, Kerberoast a service account, map paths in BloodHound, then pivot with Impacket and a C2 framework. For the Azure objectives, an Entra ID test tenant that you control lets you practise password spraying and inspect what sign-in logs record.

We'd split the time roughly in half between labs and books, with the indexing done as you read rather than at the end. GIAC's exam rules allow printed books, notes and an index, and nothing electronic, so an index entry should take you from a tool flag or hash prefix to the page that explains it. You can't return to answered questions, but you can skip 10 to 15 and come back to those. Take a practice test after your first pass to see which objectives need work, and the second once your index is finished.

Keeping GPEN and moving on

Renewal comes every four years: 36 CPEs plus a $499 fee, or a pass on the current exam. A failed attempt can be retaken for $899 after a 30-day wait.

Next certifications:

  • GWAPT to add the web application testing GPEN leaves out.
  • OSCP if clients or employers ask for a 24-hour practical result.
  • GIAC Experienced Penetration Tester (GX-PT), a fully hands-on Applied Knowledge exam, at $499 with an active GPEN instead of $1,299.

Our view

GPEN's strength is that its outline tracks how internal tests go today, with Kerberos, Entra ID and C2 in scope, and SEC560 teaches the same tools you'd use on those tests. Its weakness is the format. Three hours with an open book can't show stamina or reporting the way a 24-hour practical does. We'd take GPEN when an employer is paying for SEC560. Paying yourself, OffSec's OSCP+ exam alone costs $1,699 against GPEN's $999 attempt, but the larger GPEN cost is the $8,780 course SANS sells alongside it.

Sources