GIAC (SANS)GIAC Penetration Tester (GPEN)
The GIAC Penetration Tester (GPEN) certification validates your ability to conduct professional penetration tests using effective techniques and methodologies. It is designed for security professionals who assess networks and systems, including penetration testers, ethical hackers, and red team members. Earning GPEN proves you can perform detailed reconnaissance, execute exploits, and deliver rigorous, actionable reporting.
642 practice questions · Updated 2026-07-30
5Domains
16Objectives
145Concepts
642Questions
GPEN Curriculum
Every domain, objective, and concept the GPEN exam measures.
- Define penetration test scope
- Identify penetration test types
- Establish rules of engagement
- Plan test phases
- Select testing tools and techniques
- Define success criteria
- Prepare reporting structure
- Reconnaissance Fundamentals
- Passive vs. Active Reconnaissance
- Open-Source Intelligence (OSINT)
- DNS Enumeration
- Network Scanning
- Service and Version Detection
- Operating System Fingerprinting
- Banner Grabbing
- Traceroute and Network Mapping
- Search Engine and Metadata Harvesting
- Social Engineering Reconnaissance
- Reconnaissance Documentation
- Host Discovery Techniques
- Port Scanning Fundamentals
- Service Version Detection
- Operating System Fingerprinting
- Scanning Tools and Usage
- Stealth and Evasion Techniques
- Interpreting Scan Results
- Vulnerability Scanning Fundamentals
- Vulnerability Scanning Tools
- Scanning Techniques and Types
- Scan Configuration and Execution
- Vulnerability Identification and Analysis
- Reporting and Remediation
- Exploitation Fundamentals Overview
- Vulnerability Assessment vs. Exploitation
- Exploitation Lifecycle
- Common Exploitation Techniques
- Exploitation Tools and Frameworks
- Payloads and Shells
- Exploitation Ethics and Legal Boundaries
- Privilege Escalation Fundamentals
- Windows Privilege Escalation Techniques
- Linux Privilege Escalation Techniques
- Exploitation Frameworks and Tools
- Post-Exploitation Methodology
- Persistence Mechanisms
- Lateral Movement Techniques
- Anti-Forensics and Evasion
- Metasploit Architecture
- Metasploit Module Types
- Metasploit Payloads
- Metasploit Exploit Execution
- Meterpreter Basics
- Post-Exploitation with Metasploit
- Metasploit Auxiliary Modules
- Metasploit Database Integration
- Metasploit Scripting and Automation
- Metasploit Evasion Techniques
- C2 Frameworks
- C2 Communication Protocols
- C2 Payload Generation
- C2 Infrastructure Setup
- C2 Obfuscation and Evasion
- C2 Post-Exploitation Modules
- C2 Operational Security
- Common Password Formats
- Hash Functions and Properties
- Common Hash Algorithms
- Salting and Its Purpose
- Hash Identification Techniques
- Password Cracking Concepts
- Password Attack Fundamentals
- Dictionary and Wordlist Attacks
- Brute-Force Attacks
- Hybrid Attacks
- Rule-Based Attacks
- Rainbow Table Attacks
- Password Spraying
- Credential Stuffing
- Pass-the-Hash Attacks
- Pass-the-Ticket Attacks
- Cracking Tools and Techniques
- Mitigation and Defense
- Hash Identification
- Offline Hash Cracking
- Online Password Attacks
- Pass-the-Hash
- Pass-the-Ticket
- Token Impersonation
- Cracking Defenses
- Advanced Password Attack Techniques
- Password Cracking Tools
- Password Hash Analysis
- Rule-Based Attacks
- Mask Attacks
- Rainbow Table Attacks
- Password Spraying
- Credential Stuffing
- Pass-the-Hash Attacks
- Pass-the-Ticket Attacks
- Kerberoasting
- AS-REP Roasting
- Cracking Password Hashes from Memory
- Password Cracking Optimization
- Mitigation and Countermeasures
- Kerberos Authentication Flow
- Kerberos Ticket Structure
- Kerberoasting
- AS-REP Roasting
- Kerberos Delegation Attacks
- Golden Ticket Attack
- Silver Ticket Attack
- Pass-the-Ticket Attack
- Kerberos Brute-Force and Password Spraying
- Kerberos Encryption Types and Downgrade Attacks
- Kerberos Ticket Cracking
- Kerberos Attack Mitigations
- Domain Escalation Fundamentals
- Kerberoasting
- AS-REP Roasting
- Pass-the-Hash and Pass-the-Ticket
- Golden Ticket Attacks
- Silver Ticket Attacks
- Skeleton Key Attacks
- DCSync Attacks
- ACL-Based Persistence
- Group Policy Object (GPO) Persistence
- SID History Injection
- Domain Trust Exploitation
- Azure Architecture Overview
- Azure AD Fundamentals
- Azure AD Authentication Mechanisms
- Azure AD Attack Surface
- Azure Resource Manager (ARM) Attacks
- Azure AD Integration with On-Prem AD
- Azure AD Privilege Escalation Techniques
- Azure AD Lateral Movement
- Azure AD Persistence Mechanisms
- Azure AD Detection and Mitigation
- Azure Application Architecture
- Authentication and Authorization in Azure Apps
- Common Azure App Vulnerabilities
- Attack Vectors on Azure Apps
- Exploiting Azure App Misconfigurations
- Post-Exploitation in Azure Apps
- Defensive Measures for Azure Apps
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GPEN, so none is invented.