What is a GPEN certification? Exam format, passing score and cost
GPEN is the GIAC Penetration Tester certification. GIAC states the exam as one proctored sitting of 82 questions in three hours, with a minimum passing score of 73 per cent and hands-on CyberLive tasks performed in real machines.
- Questions
- 82, in one proctored examGIAC GPEN page, checked 24 September 2026
- Time limit
- 3 hoursGIAC GPEN page, checked 24 September 2026
- Minimum passing score
- 73%GIAC GPEN page, checked 24 September 2026
- Format
- Includes CyberLive — hands-on tasks in real machinesGIAC GPEN page, checked 24 September 2026
- GPEN certification cost
- Not published by GIACNeither the GPEN page nor GIAC’s get-certified page states a figure; the fee appears at registration, checked 24 September 2026
Know if you're ready for GIAC Penetration Tester GPEN — before you book.
Certsqill measures your GPEN readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your GIAC Penetration Tester GPEN Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every GIAC Penetration Tester GPEN mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these GPEN questions
What is GPEN?
GPEN is short for GIAC Penetration Tester. It is GIAC’s offensive-security certification, covering the full engagement: reconnaissance, exploitation, and — the part most certifications skip — writing the report that makes the findings useful.
If you arrived here looking for a device with the same spelling, this page is about the GIAC certification, which is a proctored exam.
Part of the exam is CyberLive. GIAC puts real code, real exploits and real machines in front of you, so some of the 82 questions are answered by performing the task rather than by choosing an option — which is the point on a penetration-testing credential.
Source: GIAC — Penetration Tester (GPEN). Checked 24 September 2026.
What is the GPEN exam format and passing score?
One proctored exam, 82 questions, three hours, and a minimum passing score of 73 per cent. GIAC prepares, administers and scores it as a standardised assessment.
That 73 per cent is a straight percentage rather than a scaled score, so unlike CISSP or the Microsoft exams, a practice result is directly comparable — with the caveat that no practice set can reproduce the CyberLive tasks.
Source: GIAC — Penetration Tester (GPEN). Checked 24 September 2026.
How much does GPEN cost?
GIAC does not publish a figure. We checked the GPEN certification page and GIAC’s get-certified pages on 24 September 2026, and neither carries one — the fee is given at registration rather than on the site.
GIAC prices an exam attempt differently depending on whether it is bought alongside SANS training or on its own, which is why third-party pages quoting a single number disagree with each other.
Source: GIAC — Get certified. Checked 24 September 2026.
GPEN practice questions and practice exams
Certsqill’s GPEN practice questions come with an explanation for every option. They do not reproduce the hands-on portion — nobody outside GIAC can — so treat any GPEN practice percentage as covering the written part only.
GPEN questions people ask
What does GPEN stand for?
GIAC Penetration Tester.
How many questions are on the GPEN exam?
82, in one proctored exam with a three-hour limit. Source: GIAC, checked 24 September 2026.
What is the GPEN passing score?
A minimum of 73 per cent. Source: GIAC, checked 24 September 2026.
How much does GPEN cost?
GIAC publishes no figure on its certification or get-certified pages; the fee is quoted at registration and differs depending on whether it is bought with SANS training, checked 24 September 2026.
Is GPEN hands-on?
Partly. GIAC includes CyberLive tasks performed in real machines alongside the written questions. Source: GIAC, checked 24 September 2026.
What the GIAC Penetration Tester (GPEN) certification covers
GIAC groups the GIAC Penetration Tester (GPEN) certification into three areas: comprehensive pen test planning, scoping and recon; in-depth scanning and exploitation, post-exploitation and pivoting; and Azure overview, integration and attacks together with in-depth password attacks.
The individual objectives make the emphasis clear. Password work appears several times, Active Directory and Kerberos attacks are named explicitly, and cloud is not an afterthought:
- Penetration Test Planning, Reconnaissance, Scanning and Host Discovery, Vulnerability Scanning
- Exploitation Fundamentals, Metasploit, Escalation and Exploitation, Command and Control (C2)
- Password Attacks, Password Formats and Hashes, Attacking Password Hashes, Advanced Password Attacks
- Kerberos Attacks, Domain Escalation and Persistence Attacks
- Azure Overview, Attacks, and AD Integration; Azure Applications and Attack Strategies
Source: GIAC — Penetration Tester (GPEN). Checked 9 October 2026.
Who GPEN is for, and is it worth it?
GIAC names penetration testers, ethical hackers and red team members — but also blue team members, defenders, auditors and forensic specialists who want to understand offensive tactics. That breadth matters when you ask whether GPEN is worth it: it is not only a credential for people who attack networks for a living.
GPEN is worth it if you want a certification that includes hands-on CyberLive tasks and covers Active Directory, Kerberos and Azure attacks as well as classic exploitation. Set that against the cost, which GIAC does not publish on the certification page, and against what your employer or clients ask for. GIAC publishes no salary data for GPEN holders, so we make no claim about pay.
Source: GIAC — Penetration Tester (GPEN). Checked 9 October 2026.
Attempt window, practice tests and renewal
Once your attempt is activated, GIAC gives you 120 days to complete it. Activate it once your preparation is far enough along to sit the exam within those 120 days.
GIAC sells a GPEN practice test separately; it is offered on the certification page, not included in the exam. For renewal, GIAC recommends the CPE route: collecting 36 credits over four years to keep the certification active.
Source: GIAC — Certification renewal. Checked 9 October 2026.
GPEN dumps and GIAC’s exam integrity policy
GIAC addresses dumps directly. Its Exam Integrity Policy lists “any use of or reference to ‘exam dump’ sites which contain actual or possible GIAC questions and/or answers” as a violation, along with memorising or recording exam questions and sharing or accepting knowledge of test content.
The sanctions GIAC lists include revoking previously issued GIAC certifications back to the date they were issued, bans from future GIAC certifications and legal action. On an exam with CyberLive tasks, a dump would not cover the hands-on part anyway.
Source: GIAC — Exam Integrity Policy. Checked 9 October 2026.
More GPEN questions
What topics does the GIAC Penetration Tester (GPEN) certification cover?
Pen test planning and recon, scanning and exploitation, post-exploitation and pivoting, password attacks, Kerberos and domain attacks, and Azure attacks. Source: GIAC, checked 9 October 2026.
Is GPEN worth it?
It suits both testers and defenders who want a hands-on offensive credential covering AD, Kerberos and Azure. GIAC publishes no price on the certification page and no salary data.
How long do I have to take the GPEN exam?
120 days from the date your attempt is activated. Source: GIAC, checked 9 October 2026.
Are GPEN dumps allowed?
No. GIAC’s Exam Integrity Policy names the use of exam dump sites as a violation, with sanctions up to revocation of all GIAC certifications and bans. Checked 9 October 2026.
