OSEP Certification Exam Guide: PEN-300, Preparation, and Exam Requirements

The OSEP certification exam guide below explains how OffSec’s PEN-300 course relates to the certification, what skills the exam expects candidates to apply, and how to prepare for the practical assessment and report. OSEP is an advanced, proctored penetration testing certification. The exam takes place in a simulated corporate network and tests how candidates work through multiple systems, preserve evidence, and document their actions. OffSec currently specifies 47 hours and 45 minutes for the practical exam, followed by 24 hours for report submission.

What is the OSEP certification?

OSEP stands for OffSec Experienced Penetration Tester. Candidates earn the certification by passing the practical exam associated with PEN-300: Evasion Techniques and Breaching Defenses. OffSec describes PEN-300 as advanced training for offensive security practitioners who want to test hardened environments and work with modern enterprise defenses. The course is hands-on and includes exercises and challenge labs.

The OSEP certification exam review should begin with the type of capability it assesses. This is not a multiple-choice test based only on definitions. Candidates work in a private VPN environment that simulates a corporate network containing multiple machines. The assessment involves gaining access, following attack paths through the network, and documenting the work. OffSec notes that some targets require several steps, while others may be exploitable remotely.

That format makes OSEP a demanding goal for people who are new to cybersecurity or penetration testing. Beginners can use this guide to understand the pathway, but should first build a strong foundation in networking, operating systems, scripting, enumeration, and practical security testing.

What does the PEN-300 exam guide cover?

PEN-300 is the course that prepares candidates for OSEP. OffSec describes topics including client-side attacks, custom tooling, privilege escalation, lateral movement, Active Directory, and techniques involving Windows and Linux environments. The course page lists more than 20 modules and seven Challenge Labs. These are intended to help learners apply techniques in larger, more realistic scenarios.

For effective OSEP PEN-300 preparation, focus on understanding how and when to apply a technique, not just memorizing tool commands. During practice, ask:

• What evidence supports this path?
• What assumptions am I making?
• What other options could I test if this approach fails?
• How will I record the result so another professional can follow it?

These questions help connect course material to the kind of judgment required in a practical assessment. Keep practice within systems and labs where you have authorization.

OSEP exam prerequisites and recommended skills

OffSec recommends that learners complete PEN-200 and pass OSCP+, or have equivalent knowledge and experience. Its course information also recommends familiarity with Kali Linux, Linux command-line work, target enumeration, Bash, Python, PowerShell, common vulnerabilities, local privilege escalation, and foundational Active Directory attacks. Familiarity with C# is a plus. OffSec states that PEN-200 is not a formal prerequisite, while still recommending that background because PEN-300 is advanced.

Use these recommendations as a readiness check. Before starting the course, consider whether you can:

• Enumerate systems methodically and explain why a finding matters.
• Work with Linux and Windows environments without relying on step-by-step instructions for every task.
• Write or adapt basic scripts in Bash, Python, or PowerShell.
• Explain a privilege escalation path and verify its impact.
• Describe basic Active Directory concepts and common attack paths.
• Keep clear technical notes and turn them into a reproducible report.

These are preparation indicators, not a separate official eligibility checklist. If you have gaps in several areas, strengthen them before beginning advanced study. A solid foundation can make the course more manageable and help you use lab time effectively.

OSEP exam format and requirements

The OSEP exam is proctored and conducted over a private VPN. OffSec’s exam guide specifies 47 hours and 45 minutes for the practical assessment, then an additional 24 hours to upload the required documentation. The practical environment simulates a corporate network with multiple machines and more than one possible attack path.

OffSec’s course page refers to a “48-hour” exam, while the exam guide gives the precise time of 47 hours and 45 minutes. Use the exam guide for exact timing and submission rules. Before exam day, review the current official instructions for permitted tools, proof submission, screenshots, file naming, archive format, upload steps, and other restrictions. The guide also prohibits the use of AI chatbots and third-party help during the exam.

OSEP exam preparation guide: build a practical study plan

An effective OSEP preparation plan moves from foundational review to course exercises, integrated practice, and report writing. Set your pace according to your experience; there is no single preparation timeline that suits every candidate.

1. Check your foundations

Review your comfort with enumeration, scripting, Windows and Linux administration, Active Directory, and privilege escalation. Identify specific gaps and address them before moving deeper into advanced material. If you often follow instructions without understanding why a step works, pause to review the underlying concept.

2. Work through PEN-300 actively

Study the course material and complete its practical exercises. After each module, write a short summary in your own words. Record the goal of the exercise, the key decisions, what failed, and what evidence confirmed the result. This creates useful notes for revision and reduces dependence on copied command lists.

3. Repeat exercises and connect skills

After completing an exercise, revisit it later without following your original notes line by line. Then practice combining related skills in authorized labs. OSEP lab practice should help you recognize how an initial finding might connect to later actions, while keeping track of evidence and decision points.

4. Practice reporting from the beginning

Do not wait until the end of your studies to learn how to document an assessment. Write short reports for practice scenarios. Explain the objective, the steps taken, the evidence collected, and the outcome. A reader with appropriate technical knowledge should be able to understand and reproduce what you documented.

5. Test your readiness

Before scheduling the exam, attempt an integrated practice scenario under a time limit. Afterward, review your technical notes and report. Identify where you lost time, what assumptions slowed you down, and whether you captured evidence as you worked. Use that review to set the next study goal.

For a broader overview of the certification, course, and recommended background, read our OSEP certification guide. Use this exam-focused guide alongside it to plan your practice and reporting work.

OSEP exam strategy: manage time and evidence

A long practical assessment requires a steady process. Start by reading the instructions and organizing a workspace for notes, evidence, and report sections. As you investigate, keep track of hosts, services, relationships, hypotheses, and test results. Mark what is confirmed separately from what still needs validation.

Work in focused blocks. If a path stops producing useful evidence, review your notes and decide whether to test another idea. Save time for confirming objectives, checking proof requirements, and reviewing the report. OffSec advises candidates to account for ordinary interruptions, take breaks, eat, drink, sleep, and prepare for external issues such as power or internet problems.

Treat documentation as part of the exam, not a task to begin after the technical work is finished. Record evidence as you go and keep report sections organized. This makes it easier to confirm that the final submission is complete.

OSEP exam report requirements and checklist

OffSec requires a report describing the exploitation process for each target. It must include enough detail for a technically competent reader to reproduce the documented work. The exam guide specifies a PDF report archived in a .7z file. It also provides strict instructions for naming and uploading the archive, along with requirements for proof files and screenshots. Follow the current guide carefully: missing or insufficient documentation can reduce or eliminate credit for a target.

Use this checklist when practicing your reporting process:

• Record the target and objective.
• Document the steps, commands, code, and relevant output.
• Include required proof and screenshots in the format specified by OffSec.
• Explain changes made to modified or custom code, where applicable.
• Check that the report is clear and follows the required structure.
• Verify the filename, archive format, file size, and upload steps.
• Complete the final submission action and confirm the upload as instructed.

This is a study checklist, not a replacement for OffSec’s current exam instructions. Review those instructions again before your exam because submission rules are exact.

Frequently asked questions

How long is the OSEP exam?

The practical assessment lasts 47 hours and 45 minutes. Candidates then have 24 hours to upload their documentation. Check the current exam guide for the instructions that apply to your scheduled attempt.

Is PEN-200 required before PEN-300?

OffSec says PEN-200 is not a formal prerequisite, but recommends that learners complete it and pass OSCP+ or have equivalent knowledge and experience.

What does the OSEP exam test?

The exam tests practical penetration testing in a simulated corporate network. Candidates must work through targets and attack paths, provide required proof, and document their process.

How can I assess OSEP exam readiness?

Try a complete practice scenario and review both your work and your report. You should be able to explain your decisions, preserve evidence, and produce clear documentation. If you still need frequent step-by-step guidance for foundational tasks, continue practicing before scheduling.

Choose your next preparation step

Start with OffSec’s recommended skills and compare them with your current experience. Strengthen any gaps, work through PEN-300 exercises, and practice writing reproducible reports before scheduling. For the current course outline and official certification details, review OffSec’s PEN-300 course page.