How I passed GPEN

After passing my GCIH exam I’ve decided to pursue GPEN (OnDemand version) because of what was being covered in the course, how much everyone else recommended it to me, and its value on my resume and LinkedIn profile.

About me

I work as a Penetration Tester, mainly focusing on Cloud, Web, API, and recently, Large Language Model (LLM) testing. I am fairly new to the game, so I am always trying to learn as much as I can, so I can survive this AI wave(jkjk, being good, oh no wait, being great at what I do, so I can find a job in a week with less than 10 application submissions). While I already hold couple of cloud, networking, and web certifications, I believe anyone can pass this exam if they really follow the course materials and do their part.

How Many Hours a Week ?

I spent 1 hour each day on the course, mainly trying to cover 1 section a day and spend necessary time on the labs(mostly took 30 minutes)

Overall Thoughts on the Course & the Exam

It was very interesting and enjoyable course, especially the labs and CTF challenges. Having a GCIH background definitely helps grasp the content and pass the exam, as there’s significant overlap between the two, particularly in the course material. The exam, however, can be slightly challenging compared to GCIH, but it is still very achievable if you fully understand the course.

What to Do to Pass the Exam

1. Take good notes, and by that what I mean is Indexing your Books
2. Do the labs and understand them. Repeat them if needed until you feel comfortable with the concepts
3. Do the CTF challenge (this was my favorite part of the whole course, they are so much fun and very relatable to real life scenarios)
4. Do the Practice Tests

Exam time

Areas Covered in the Exam

• Advanced Password Attacks
• Attacking Password Hashes
• Azure Applications and Attack Strategies
• Azure Overview, Attacks, and AD Integration
• Domain Escalation and Persistence Attacks
• Escalation and Exploitation
• Exploitation Fundamentals
• Hands-On Exploitation and Escalation
• Hands-On Password Attacks
• Hands-On Penetration Testing Methodology
• Hands-On Web Application Testing and Exploitation
• Kerberos Attacks
• Metasploit
• Moving Files with Exploits
• Password Attacks
• Password Formats and Hashes
• Penetration Test Planning
• Penetration Testing with PowerShell and the Windows Command Line
• Reconnaissance
• Scanning and Host Discovery
• Vulnerability Scanning

Exam Format

• 75 Multiple Choice Questions
• 7 CyberLive virtual machine questions
• 180 minutes (3-hour) time limit

My Experience

I did not do well on practice tests because I tried to take notes during them(both times!), but I was still confident in my knowledge and decided to take the exam anyway – and I passed!