- Scoping, rules of engagement and a process-driven test
- Reporting what you found
GIAC Certification Training Course
GIAC Penetration Tester (GPEN) Certification Training Course
Prepare for the GIAC Penetration Tester (GPEN) exam with hands-on work across the full test, from scoping and recon to exploitation, Active Directory and Azure attacks, and the report.
Course focus: Pen test planning and scoping, recon, scanning, vulnerability scanning, Metasploit, exploitation and pivoting, password attacks, Kerberos and domain persistence, C2, and Azure and Entra ID attacks, aligned with GIAC's published GPEN objectives.
Course Overview
What the GPEN course covers and who it's for.
Accumentum's GPEN prep course is for penetration testers, red and blue team members, and defenders who want to know how an attacker works through a network. GIAC says GPEN validates the ability to properly conduct a penetration test using effective techniques and methodologies.
The course follows GIAC's published GPEN objectives. You'll cover test planning and scoping, reconnaissance, scanning and host discovery, vulnerability scanning, Metasploit, exploitation and pivoting, password attacks, Kerberos and domain escalation, command and control, and Azure and Entra ID attacks. GPEN includes CyberLive hands-on questions, so you'll be in a lab for most of it.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Course Objectives
Get ready for GPEN the way the exam actually tests.
01
Cover Every GPEN Objective
Work through each certification objective GIAC publishes for GPEN, in an order that builds on itself.
02
Practice Hands-On
GPEN includes CyberLive questions that run in real virtual machines, so labs are part of every module.
03
Build an Open-Book Index
GIAC exams are open book. We help you build and test the index you'll bring into the exam.
04
Know the Exam Before You Sit It
GPEN is 82 questions in 3 hours with a minimum passing score of 73%, per GIAC. We pace practice to match.
Who Should Attend
- Penetration testers and ethical hackers.
- Red team and blue team members.
- Security staff who assess networks and systems.
- PenTest+ or CEH holders who want a hands-on next step.
Prerequisites
- There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GPEN.
- You should know networking, Windows and Linux well and be comfortable at the command line. PenTest+, CEH or GCIH level knowledge helps.
Pathway Map
The GPEN course in 8 modules.
Each module maps to one or more of GIAC's published GPEN certification objectives.
Course Content
- Finding high level information about the target organization and network
- Port, OS and service version scans
- Reading the results
- Running vulnerability scans and analyzing the output
- Exploitation fundamentals
- Metasploit at an intermediate level
- Data exfiltration and pivoting to other hosts
- Command and control frameworks
- Password formats and hashes
- Guessing, obtaining and cracking hashes
- Advanced authentication attacks
- Windows privilege escalation
- Kerberos attacks
- Domain escalation and persistence
- Entra ID basics and common attacks
- Azure applications, federation and single sign-on attacks
Course Features
Built for the hands-on side of GPEN.
On-Demand Format
Self-paced video lessons you can start, pause and replay whenever it fits your schedule.
Hands-On Labs
Lab work in every module so the CyberLive portion of GPEN isn't the first time you've touched the tools.
Objective Mapping
Every lesson is tied to a published GPEN certification objective.
Exam Strategy
Time management, open-book indexing and practice under exam conditions.
Certification Exam
About the GIAC GPEN exam.
GPEN Exam Readiness
Every objective GIAC publishes for GPEN has a lesson and a lab in our course, so you know exactly what you've covered before you book.
Per GIAC, the GPEN exam is one proctored exam with 82 questions, a 3 hours time limit and a minimum passing score of 73%. It's web based and proctored online through ProctorU or onsite at Pearson VUE.
GIAC can update exam specs, so confirm the details for your attempt in your GIAC account. Full details are on GIAC's GPEN page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of GIAC. GIAC sets the exam rules, fees and scoring, so check giac.org before you register for your attempt.
Certification Objectives
The full GIAC GPEN objective list.
GIAC publishes 16 certification objectives for GPEN. Each one below uses GIAC's own wording, and our course maps a lesson or lab to every one of them.
Advanced Password Attacks
The candidate will be able to use additional methods to attack password hashes and authenticate.
Attacking Password Hashes
The candidate will be able to obtain and attack password hashes and other password representations.
Azure Applications and Attack Strategies
The candidate will demonstrate an understanding of Azure applications and the attacks against them including federated and single sign-on environments and Azure AD authentication protocols.
Azure Overview, Attacks, and AD Integration
The candidate will demonstrate an understanding of Entra ID implementation fundamentals, common Entra ID attacks, and Azure authentication techniques
Command and Control (C2)
The candidate will demonstrate an understanding of the design, application, and use of Command and Control (C2) and common C2 Frameworks.
Domain Escalation and Persistence Attacks
The candidate will demonstrate an understanding of common Windows privilege escalation attacks and Kerberos attack techniques that are used to consolidate and persist administrative access to Active Directory.
Escalation and Exploitation
The candidate will be able to demonstrate the fundamental concepts of exploitation, data exfiltration from compromised hosts and pivoting to exploit other hosts within a target network.
Exploitation Fundamentals
The candidate will be able to demonstrate the fundamental concepts associated with the exploitation phase of a pentest.
Kerberos Attacks
The candidate will demonstrate an understanding of attacks against Active Directory including Kerberos attacks.
Metasploit
The candidate will be able to use and configure the Metasploit Framework at an intermediate level.
Password Attacks
The candidate will understand types of password attacks, formats, defenses, and the circumstances under which to use each password attack variation. The candidate will be able to conduct password guessing attacks.
Password Formats and Hashes
The candidate will demonstrate an understanding of common password hashes and formats for storing password data.
Penetration Test Planning
The candidate will be able to demonstrate the fundamental concepts associated with pen-testing, and utilize a process-oriented approach to penetration testing and reporting.
Reconnaissance
The candidate will understand the fundamental concepts of reconnaissance and will understand how to obtain basic, high level information about the target organization and network, often considered information leakage, including but not limited to technical and
Scanning and Host Discovery
The candidate will be able to use the appropriate technique to scan a network for potential targets, and to conduct port, operating system and service version scans and analyze the results.
Vulnerability Scanning
The candidate will be able to conduct vulnerability scans and analyze the results.
Study Plan
A practical path to GIAC GPEN.
GIAC lists the GPEN objectives alphabetically, not in study order. We teach them in an order that builds, starting with the fundamentals and working up to the topics that lean on them, and every block ends with labs before you move on.
Treat each objective as a pass or fail check. If you can explain Kerberos Attacks to a teammate and do it in a lab, mark it done and move to the next one.
If you are new to GPEN topics, plan on steady weekly study over a couple of months. If you already do this work every day, you may move faster. Either way, the objective list is the checklist we hold you to.
Areas and Audience
Where GIAC GPEN fits.
Areas GIAC says this certification covers
- Comprehensive Pen Test Planning, Scoping, and Recon
- In-Depth Scanning and Exploitation, Post-Exploitation, and Pivoting
- Azure Overview, Integration, and Attacks, and In-Depth Password Attacks
Who GIAC says it is for
- Security personnel responsible for assessing network and systems
- Penetration testers
- Ethical hackers
- Red Team members
- Blue Team members
- Defenders, auditors, and forensic specialists who want to better understand offensive tactics
Exam Format
How the GIAC GPEN exam works.
The GIAC GPEN exam is one proctored exam with 82 questions and a 3 hours time limit. GIAC sets the minimum passing score at 73%.
Testing runs through ProctorU for remote attempts or Pearson VUE for a test center seat.
GPEN includes CyberLive hands-on questions, which GIAC describes as performance based challenges in realistic lab environments. That is why our course leans so hard on labs.
Plan your weeks around the objectives above. When you can explain each one in your own words and do it in a lab, you are ready to book.
Career Outlook
Where GIAC GPEN can take you.
GPEN fits penetration testers, red team members and the defenders who want to think like them. It shows you can plan a scoped test, exploit what you find, move through an environment and report it in a way a client can act on.
The U.S. Bureau of Labor Statistics reports that the median annual wage for information security analysts was $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. Treat it as a reference point and not a promise. Location, experience and the employer drive what any one person earns. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for GIAC GPEN training.
GIAC GPEN is Air Force COOL Approved. See how Air Force COOL works with us.
Paying on your own? GIAC GPEN prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page covers every other way to pay, and you can always talk with us before you enroll.
Frequently Asked Questions
Common questions about Accumentum's GPEN prep course.
GIAC Penetration Tester (GPEN) is a practitioner certification from GIAC. Per GIAC, the exam is 82 questions, 3 hours, with a minimum passing score of 73%, and it's proctored online through ProctorU or at a Pearson VUE center.
Ask us when you request a quote. GIAC sells certification attempts and practice tests directly, and we'll walk you through what you need to buy from GIAC and when.
GIAC GPEN is Air Force COOL Approved. Contact us about funding options.
There are no Accumentum enrollment prerequisites and GIAC doesn't require any to sit GPEN. You should know networking, Windows and Linux well and be comfortable at the command line. PenTest+, CEH or GCIH level knowledge helps.
Yes. GPEN includes CyberLive hands-on questions, so every module has labs with the same kinds of tools you'll use on the job.
On-demand and self-paced. You get video lessons, hands-on labs and practice questions, and you work through them on your own schedule.
Use the registration page linked below, or email info@accumentum.net and an advisor will follow up with access details and next steps.
GIAC sets the minimum passing score for GPEN at 73%.
The exam has 82 questions and a 3 hours time limit.
GIAC publishes 16 certification objectives for GPEN, and our course covers all of them.
GIAC names these audiences for GPEN:
- Security personnel responsible for assessing network and systems
- Penetration testers
- Ethical hackers
- Red Team members
- Blue Team members
- Defenders, auditors, and forensic specialists who want to better understand offensive tactics
Yes. GIAC offers remote proctoring through ProctorU, and you can also test in person at a Pearson VUE center.
Yes. GIAC sells official practice tests. GIAC notes the practice question bank is limited, so the same question can show up on more than one test.
Yes. GIAC GPEN prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee. 9, 12 and 18 month terms add 5%, 10% and 15%.
Enrollment
Enroll in GPEN training with Accumentum.
Enroll in Accumentum's GPEN prep course to get ready for the GIAC Penetration Tester (GPEN) exam with on-demand lessons and hands-on labs.
For access details and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on GPEN?
Start on your own schedule and work toward the test date you pick.