200+ Free OSEP Practice Questions
Pass your OSEP OffSec Experienced Penetration Tester exam on the first try — instant access, no signup required.
Loading practice questions...
Key Facts: OSEP Exam
47h 45m
Technical Exam Window
OffSec
24 hrs
Report Deadline
OffSec
100 pts
Alternate Pass Path
OSEP FAQ
secret.txt
Objective Pass Path
OSEP FAQ
10 pts
Per local/proof Flag
OSEP FAQ
$1,749+
Current Entry Price
OffSec
As of March 10, 2026, OffSec lists PEN-300 / OSEP at a $1,749 starting price via the Course + Certification Exam Bundle and $2,749 via Learn One. The official OSEP exam gives candidates 47 hours and 45 minutes for the technical challenge plus 24 hours for the report, uses 10-point local.txt/proof.txt flags, keeps the total machine count secret, and can be passed either by achieving the control-panel objective via secret.txt or by earning at least 100 points. OffSec publishes the PEN-300 syllabus and exam format, but not a formal percentage-by-domain blueprint, so the practice-question weights below are syllabus-based rather than official exam percentages.
About the OSEP Exam
OSEP validates advanced enterprise penetration testing skill in hardened environments. The official OffSec exam is a proctored, open-book, hands-on corporate-network simulation that emphasizes client-side tradecraft, defense evasion, multi-hop lateral movement, and Active Directory abuse rather than multiple-choice recall.
Assessment
Performance-based corporate-network assessment with hidden machine count and 10-point flags
Time Limit
47 hours 45 minutes + 24 hours to submit the report
Passing Score
Objective completion or 100 points
Exam Fee
$1,749 starting price (OffSec)
OSEP Exam Content Outline
Client-Side Execution and Payload Development
Programming basics, Win32 API usage, Office tradecraft, Windows Script Host droppers, and process-injection concepts used to gain initial footholds.
Defense Evasion and Filter Bypass
Antivirus evasion, AMSI and Defender bypasses, AppLocker and Constrained Language Mode abuse, and techniques for slipping past DNS, proxy, and HTTPS inspection controls.
Post-Exploitation and Credential Access
Linux persistence and hijacking opportunities, kiosk breakouts, Windows credential material, tokens, Kerberos artifacts, and offline dump handling.
Lateral Movement and Infrastructure Abuse
Windows and Linux lateral movement paths, DevOps and Artifactory abuse, Kerberos on Linux, SSH tradecraft, and Microsoft SQL Server pivoting.
Active Directory and Multi-Forest Operations
AD object permission abuse, delegation attacks, forest trust abuse, and chaining footholds into domain or forest compromise.
Exam Workflow and Reporting
Scoring, secret.txt objectives, hidden machine-count implications, allowed resources, reporting requirements, and proctored-exam workflow.
How to Pass the OSEP Exam
What You Need to Know
- Passing score: Objective completion or 100 points
- Assessment: Performance-based corporate-network assessment with hidden machine count and 10-point flags
- Time limit: 47 hours 45 minutes + 24 hours to submit the report
- Exam fee: $1,749 starting price
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
OSEP Study Tips from Top Performers
Frequently Asked Questions
What is the OSEP exam format?
The official OSEP exam is a proctored, hands-on penetration test in OffSec's private VPN. OffSec states that you receive 47 hours and 45 minutes for the technical challenge and another 24 hours to submit your documentation, and the machine count is intentionally not disclosed to candidates.
How do you pass OSEP?
OffSec's OSEP FAQ says there are two passing paths. You either complete the control-panel objective proved by obtaining secret.txt, or you earn at least 100 points from local.txt and proof.txt flags, each worth 10 points.
How many machines are in the OSEP exam?
OffSec does not publish the total machine count. The FAQ explicitly says the exam simulates a black-box corporate penetration test and that the total number of machines is an exam secret that candidates must enumerate during the assessment.
Can I use notes or outside resources during OSEP?
Yes, OSEP is open-book. OffSec allows your own notes, online resources, and the OffSec Learning Platform, but prohibits AI chatbots and LLMs with direct prompt access during the live exam, and all activity must occur on the monitored host machine.
What changed for OSEP in 2026?
As of March 10, 2026, I did not find an official OffSec announcement of a new OSEP blueprint, scoring overhaul, or separate OSEP+ designation. The main current policy change in the broader OffSec ecosystem is the CPE and maintenance framework for expiring plus-style certifications such as OSCP+, and OSEP is listed as one qualifying higher-level exam for maintaining OSCP+, but OffSec's public OSEP materials still describe OSEP itself as the same PEN-300 certification.
How should I prepare for OSEP?
Prepare like a lab exam, not a trivia test. Focus heavily on the PEN-300 themes OffSec publishes: client-side execution, evasion, AppLocker and AMSI bypasses, credential access, lateral movement, SQL abuse, and Active Directory delegation or trust attacks, then practice documenting every step well enough that a grader could reproduce it.