You finished the first practice exam course. You identified your weak areas, you measured your baseline and you know where you need to push harder. Now it is time to go deeper.

This is the second volume of the GPEN Practice Exam series — five completely new full-length practice tests, 410 original questions, zero overlap with Volume 1. Every exam is built to the exact format, difficulty and scenario style of the real GIAC GPEN exam. Every question is scenario-based, tool-output-focused and written to the same complexity level as the actual test. And every single question comes with a detailed explanation of the correct answer and a full breakdown of why each wrong option is wrong.

Repetition across different question sets is how you truly master an exam domain. The first volume shows you where you stand. This volume is where you close the gaps, reinforce what you have learned and build the kind of confidence that comes from having answered 820 GPEN-level questions before you walk into the testing center.

All five exams cover all three official GPEN exam domains comprehensively. Domain 1 covers penetration testing methodology, legal frameworks, rules of engagement, passive and active reconnaissance, OSINT, DNS attacks, Nmap, NSE scripting and vulnerability scanning. Domain 2 covers exploitation, Metasploit, msfvenom, password attacks, LLMNR poisoning, NTLM relay, post-exploitation, Windows and Linux privilege escalation, credential harvesting with Mimikatz, pivoting and data exfiltration. Domain 3 covers Active Directory attacks including Kerberoasting, AS-REP roasting, BloodHound, Pass-the-Hash, Pass-the-Ticket, Golden and Silver Tickets, DCSync, ADCS certificate exploitation, Azure and Entra ID password spraying, token abuse, managed identity attacks, C2 frameworks, persistence and evasion.

If you are consistently scoring above 75% across both volumes you are ready to book your exam. If not, you now know exactly which domains to revisit before you do.