Passed GPEN

Yesterday, I passed the GPEN (GIAC Penetration Tester) certification exam, and I wanted to share my experience. If you follow me on social media, especially on Instagram, then you might have noticed that I have been on hiatus from taking certification. The last certification exam I took was the GMON (GIAC Continuous Monitoring).

Exam information

The exam has the following format:

• 1 proctored exam
• 82 questions (including CyberLive)
• 3 hours
• Minimum passing score of 73%
• Multiple-choice and single-answer
• You can skip questions (up to 15)
• You can take breaks (up to two)

SEC560 class

I attended SEC560 (Enterprise Penetration Testing) class during SANS Security West 2026, which took place from May 11-16, 2026, in a virtual format (Live Online). The class was taught by Jeff McJunkin, the co-author of the class. Unlike SEC511 and SEC503, this class ended on time every day, which was a welcome change.

Capture The Flag (CTF) event

As with a lot of SANS classes, the sixth day is reserved for the class’ Capture The Flag (CTF) event. It is where you utilize what you learned from the class and daily challenges. While some people will not call it a competition, so long as you get a prize at the end, I consider it as such. If your score is in the top 3 or 5, you will most likely get the class challenge coin. If your team earns the highest score, all members will get the coin.

Since I have been on hiatus from taking SANS classes, I noticed there have been some differences in the CTF. It looks like they are now separating the event into two categories: In-Person and Virtual. This gives students more chances to win a class coin. During the CTF event, there were 12 participants and I was the only Live Online student who participated. Since I was the only Live Online student that parcipated, I was guaranteed to get a coin. That is, if I reached an undisclosed score per Jeff McJunkin.

Our instructor decided to break up the class into three teams – two teams for In-Person and one team for Live Online. The In-Person teams were broken up into a 6-member team and a 5-member team, and since I was the only Live Online student, I was a team of one. Luckily, I finished first and got a coin.

Since there have been plenty of offensive security courses and certifications, the SEC560 and GPEN have lost their popularity. However, I do think there is value for this class and certification. I picked up a few things that I did not see from the Penetration Testing Professional class from INE.

Core NetWars

It looks like SANS has allowed Live Online students to register in NetWars events. There have been classes I have attended where SANS only allowed In-Person folks to register for the event. They did make an exception during the COVID pandemic period, and I was able to participate then. However, during my SEC511 class, Live Online students did not have an option to participate.

During SANS Security West 2026, there were only two NetWars events: Core and DFIR. While I registered for both, I only went into the Core. I also heard that DFIR was turning students away that use Apple Silicon. I believe it’s because the VM won’t work on them. While I have ESXi hosts where I can spin up the VMs, I focused on the Core NetWars event. I really wanted to get that coin, so I can add to my collection, which I did!

This was my second time participating in Core NetWars, and finally I got the coin this time around. As mentioned earlier, SANS has made a change and decided to split the event into two. It seems like they are being generous now on the coins. Though, I am not 100% certain that this is a permanent change or not. Either way, it is a welcome surprise to be able to get a coin since I placed 8th. In the past, they typically only gave top 5 individual players and top 1 team.

Preparation

The best way to prepare for the GPEN exam is to take SEC560 (Enterprise Penetration Testing) course. As mentioned earlier, I took the class from May 11-16, 2026. I started studying on the 18th, if I remember correctly.

Typically, I am slow at reading and working through the labs, so it’s a surprise that I finished in two months. The reason is not that I don’t understand the material; it is because I get distracted easily. If I remember correctly, I finished reading and creating my index on the 19th of July. There were nights and weekends where I didn’t touch the books or practice any labs.

As many would recommend, SEC560 and GPEN should be taken after SEC504 and GCIH. There are a lot of topics that are continuations from the latter. However, I was not intending to take this class and certification at all, but things have changed. I will eventually reveal the reason why I took this class. Stay tuned.

Practice Test

After all the preparation, I took my first practice test, and I scored terribly but passed, barely. I scored 73%, and that’s exactly the minimum passing score. As far as GIAC is concerned, this is the lowest practice test I scored.

What went wrong? Well, I attribute it to being rusty in taking certification exams. As mentioned, I have not taken one in three years. I lacked time management, and I was stubborn enough not to use the skip question button. If you are struggling answering the MCQs (Multiple Choice Questions), make sure to skip them. You can come back to these questions if you still have time at the end.

Because I spent way too much time on MCQs, I paid the price at the CyberLive questions. That section went downhill fast since I panicked and started hurrying, which caused me to make mistakes. I was only able to answer two or three CyberLive questions, and the rest I just guessed. I knew how to do the tasks, but the commands took a while.

The second practice test was taken just to build confidence and make sure that failing was not going to happen. Having a pretty good feeling about getting a higher score, the decision was made to take the practice test after a day of rest. Sure enough, the score was better, and all CyberLive questions were answered correctly.

In the second practice test, I had better time management and utilized the skip feature so I was not wasting my time looking for the answer. Some of the questions from the first practice test reappeared or were very similar. The CyberLive questions were quite similar, but the first one had at least one question that required completing a few tasks to arrive at the answer.

Since I took two practice tests, which I have not done since GCIH, I do not have any practice test attempts to give away to the community. I had to make sure I was not going to fail the second practice test before I felt confident enough to pass the real exam.

Creating an index

Since this is my fifth GIAC exam, I think I have a pretty good idea of how to create an index for myself. Though, I am sure there are still things I can improve on since I can not seem to get 100% on the exam! 🙂

Having an index on the exam day is good to have. As you may know, it is not required, but it is helpful if you forget specific details and want to reference something quickly. I have read that some folks have passed GIAC exams without an index, so it is possible not to have one.

Minimalist index

As mentioned in my GCIH post, I use a minimalist approach with my index. While I discussed that I have three columns in my index, I used the same method I used with GCIA, which reduced it to two columns. Essentially, I combined the book and page number into one column. I used the period or dot symbol to separate the book and page numbers.

The terms included in an index will vary from one person to another. This is why I am a firm believer that you must create your own and not rely on someone else’s. If you think about it, another person’s index may not include terms they know by heart, which you may need during the exam. For example, while Jeff McJunkin included an index in the course handouts, I still created my own.

ProctorU experience

As mentioned in the GMON post, I had to download the Guardian Browser. I also had to make sure that I had LogMeInRescue. On the technical side, I did not encounter any issues during the exam, which is nice.

Taking an exam at home is very convenient. However, your experience will vary from one proctor to another. For example, I read on Reddit that some proctors would not allow an external monitor even though your laptop is on clamshell mode. Happy to report that I was allowed to take the exam with my MBP in clamshell mode, as it was on a vertical stand behind the monitor. I do not know if that made a difference.

Before the exam, the proctor had to take control of my machine to check a few things. One of the things he did was to turn off all Bluetooth connections. I had to tell him that I needed my keyboard and trackpad. He eventually turned both of them back on. It would have been awful to switch from my 34-inch monitor to the 16-inch built-in display for the exam.

Additionally, the proctor had to disable screenshot shortcuts and screen sharing on macOS. This is to ensure that exam integrity remains intact, in theory.

Since I tried to do cable management, my webcam could not reach everything it needed to see, so I was instructed to use my phone to record a video of the whole room, my desk, and under it. I had to play it back for him in front of the webcam.

During the exam, the proctor had to keep asking me to lower my webcam so he could see what I was looking at. Even though he had seen my desk, he had to make sure that I was not using anything that was not allowed. It was quite disruptive to be interrupted like that, but the convenience of taking the exam at home trumps going to a testing center.

Exam experience

For the most part, I thought the questions were fair. However, I did have a few questions that I did not remember reading and had difficulty answering. I had to guess on some of them and used the skip feature again to allow enough time for the CyberLive questions. I had around an hour left when I reached the CyberLive section, and I was beginning to freak out. I eventually calmed down when I started answering the CyberLive questions since they were very similar to my second practice test.

The MCQs seemed harder than the practice tests. The very first question, I had to look it up. In the two practice tests that I took, I was able to answer the majority of the questions without looking it up.

Tips

I still think that people read these types of posts to help them prepare for the exam. Without further delay, the following are my tips for passing the GPEN exam.

• Take a break after the class. Maybe a week or so. Up to you.
• Read the questions carefully. Reread it to make sure you fully understand the question.
• Do not be afraid of skipping questions.
• Even if you are sure about your answer, look it up anyway.
• Do not rely on someone else’s index. Create your index!
• Get enough sleep. Getting enough sleep will help you be alert and focused during the exam.
• If your goal is to get the highest score possible, take two practice tests.

Final thoughts

There are a bunch of topics that were a review for me. For example, Nmap, password cracking, Metasploit, etc. These were covered in other classes I have taken. I know that GIAC created the Applied Knowledge Certifications, but I feel like they could add more CyberLive questions. As someone who took the CCNP TSHOOT and eJPT exams, I really enjoyed the hands-on nature of both exams.

The SEC560 CTF section was great. I enjoyed it and learned a great deal from it. I would like to try it again, but may need to take a break. I still have access to OnDemand class, so in theory, I should be able to attempt it again.

I read a long time ago that SEC560’s labs required VPN connectivity, so if you wanted to practice the labs, you had to buy the OnDemand access. Fortunately, it was free when I signed up. They do not typically offer that for free, so that was a nice surprise. Though, I accidentally found that out when I was randomly signing up for the next SANS class. Otherwise, I would not have known about it.