Preparing for the OSCP+ exam takes more than memorizing commands. You need to investigate unfamiliar systems, follow evidence, test methods in an authorized environment, and document your work so another technical reader can understand it. A good OSCP+ exam preparation plan develops these skills together.
The exam is often called a 24-hour exam, but the current OffSec exam guide specifies 23 hours and 45 minutes for the practical exam, followed by a separate 24-hour report submission window. The exam includes three standalone machines and a three-machine Active Directory set.
This guide outlines a practical OSCP+ study plan for IT professionals preparing through PEN-200 or independent study. It separates OffSec’s published requirements from suggested study activities, so you can adapt the schedule to your experience.
What the OSCP+ exam tests
The OSCP+ exam is a proctored, hands-on assessment in a private VPN lab. It tests whether you can identify vulnerabilities, exploit systems, escalate privileges, and document your findings. The current structure assigns 60 raw points across three standalone machines and 40 raw points to an Active Directory set of three machines.
The exam tests a connected workflow:
- Enumeration: Gather and verify information about targets and services.
- Exploitation: Use evidence to select and test possible attack paths.
- Privilege escalation: Investigate whether and how access can be increased.
- Active Directory: Track relationships and dependencies across systems.
- Reporting: Record your process and evidence in a clear, reproducible way.
OffSec requires a professional report describing the exploitation process, including steps, commands, and console output. The report must be detailed enough for a technically competent reader to reproduce your attacks. Incomplete documentation can reduce or eliminate credit for an objective.
OSCP+ PEN-200 preparation and prerequisites
PEN-200 is not required to register for the OSCP+ exam. OffSec recommends it, especially for candidates who are new to penetration testing. Its standalone exam option is for people who want to take the OSCP+ without access to the PEN-200 course; the product page states that course materials are not included with the standalone exam.
Before intensive lab work, review your foundation in TCP/IP, networking, Linux, Windows, and basic scripting. OffSec recommends a solid understanding of TCP/IP, networking, and Linux for PEN-200 learners, with scripting familiarity also useful. If you need to strengthen these basics, make time for that before relying on timed challenge labs.
Set an OSCP+ exam preparation timeline
The following eight-week schedule is an example, not an official OffSec requirement. Extend it if you need more time or have limited weekly study hours. OffSec’s preparation guidance recommends studying course modules, completing module and capstone labs, taking notes, and then moving into challenge labs and practice exams.
| Week | Focus | Suggested milestone |
|---|---|---|
| 1 | Networking, Linux, Windows, and scripting | Identify gaps and organize your notes |
| 2 | Enumeration and vulnerability analysis | Build a repeatable investigation process |
| 3 | Web and service exploitation concepts | Test methods in authorized labs |
| 4 | Linux privilege escalation | Complete relevant labs and document your reasoning |
| 5 | Windows privilege escalation | Investigate systems and record evidence |
| 6 | Active Directory | Practice across a multi-machine lab |
| 7 | Challenge labs and reporting | Solve targets with limited reliance on hints |
| 8 | Timed simulation and review | Assess pacing, breaks, and report quality |
Use the schedule to identify what to study next, not as a promise that eight weeks will be enough. Your OSCP+ exam preparation timeline depends on your current skills, lab results, and available study time.
For broader background, see our OSCP certification guide and OSCP+ vs. OSCP updates guide.
Make OSCP+ practice labs reflect the exam workflow
Start with learning-module exercises and topic labs to understand techniques. Then work through challenge labs where you must decide what to investigate and how to proceed. Practice without walkthroughs when possible; if you use one to learn a technique, revisit the target later and try to solve it independently.
For each target, note what you discovered, how you verified it, which paths you tested, and what the results showed. Also record how you obtained and verified proof. These OSCP+ practice labs should improve your reasoning and note-taking, not just your familiarity with individual tools.
OffSec advises candidates to practice multiple approaches, revisit difficult labs, and avoid depending on hints or walkthroughs. It also recommends simulating exam conditions and practicing report writing after lab machines.
OSCP+ enumeration practice and privilege escalation
Use a consistent process to record ports, services, application behavior, and other useful observations. Begin with a reasonable scan, then investigate confirmed services while longer scans run. Verify important findings rather than assuming every scan result is complete or accurate.
Enumeration should continue as your access changes. A new account or shell can reveal information that was unavailable earlier. OffSec describes enumeration as cyclical: candidates should investigate again with newly gained privileges.
For OSCP+ privilege escalation practice, focus on investigating the system and validating whether a potential weakness applies to the target. Keep notes on what made a path relevant and what evidence confirmed the result. This helps you avoid repeating unproductive checks and makes your report easier to reproduce.
OSCP+ Active Directory lab practice
Practice complete Active Directory environments rather than studying techniques only in isolation. Track the systems, accounts, relationships, and access changes you discover. Ask what each finding suggests you should investigate next.
OffSec’s guidance emphasizes identifying dependencies between AD challenge machines and treating post-exploitation as part of the process. In practice, that means continuing to enumerate after gaining access and considering whether information from one system applies to others in the lab.
OSCP+ exam tips and time management
A timed lab helps you assess your process under pressure. For OSCP+ mock exam practice, choose an authorized environment, set a timer, take planned breaks, and record where you spend your time. Afterward, review what caused delays and which decisions helped you make progress.
OffSec suggests using roughly two to three hours as a starting limit for each standalone machine and about four hours for the Active Directory set. Its guidance also recommends moving on when time runs out, taking breaks, and returning with a fresh perspective. Treat these as planning suggestions; follow the objectives and instructions in your own exam control panel.
The exam is not only about solving targets. OffSec prohibits AI chatbots and third-party help during the exam, so review the current exam restrictions and prepare your notes and allowed resources in advance.
OSCP+ penetration test report preparation
Prepare your report structure before exam day and use it during practice labs. Record commands, outputs, screenshots, and key decisions as you work instead of relying on memory after a long exam. OffSec provides report templates and recommends keeping notes during the work, then completing the report while details are fresh.
For practical OSCP+ report writing tips, organize information by target, make each step easy to follow, and check that evidence supports each objective you claim. Before submitting, verify the current PDF, filename, archive, and upload instructions in the exam guide. Submission requirements can change, so use the guide for your exam date.
OSCP+ exam readiness checklist
Before scheduling your exam, use this OSCP+ exam readiness checklist to review your preparation:
- Foundations: You can work comfortably with networking, Linux, Windows, and basic scripting.
- Enumeration: You can record, verify, and reassess findings as your access changes.
- Standalone practice: You have investigated targets without relying on walkthroughs.
- Active Directory: You can track relationships and dependencies across a lab.
- Time management: You have completed timed practice and know when to move on.
- Reporting: You can produce a clear report from your notes and evidence.
- Logistics: You have reviewed proctoring requirements, equipment, connectivity, and your workspace.
An OSCP+ exam-day checklist should also include your planned breaks, food, hydration, and backup connectivity or power where practical. These are preparation suggestions, not guarantees of a passing result.
Frequently asked questions
How long should I prepare for the OSCP+ exam?
There is no single timeline for every candidate. Your preparation depends on your existing skills, weekly study hours, and progress in practice labs. Use timed simulations to find gaps and adjust your schedule.
Do I have to complete PEN-200?
No. OffSec says PEN-200 is not required to register for the OSCP+ exam, although it is recommended, particularly for candidates new to penetration testing. Is the OSCP+ exam exactly 24 hours?
The practical exam lasts 23 hours and 45 minutes. The report has a separate 24-hour submission window after the exam ends.
Is the passing score changing?
Yes. Exams starting on or after December 1, 2026, at 8:00 GMT use equated scaled scoring. Exams starting before that time use the existing fixed passing score of 70. OffSec states that this changes how results are determined, not the exam format or rules.
What should I do in the final week?
Review your notes, revisit difficult topics, complete a timed simulation, and rehearse your report workflow. Focus on applying familiar methods consistently rather than cramming unfamiliar tools.
Ready to Start Your OSCP+ Certification Journey?
Contact our team for OSCP+ certification online training, study resources, practice questions, and exam preparation support.
Contact UsChoose one authorized lab, schedule a timed session, and document the full process from enumeration to final report. Use the result to select your next study priority, and check OffSec’s OSCP+ page for current exam and enrollment details.