GXPN Passing Score 2026: Exactly What You Need to Pass

The Number: 67% on a 60-Question Exam

The GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) exam has a minimum passing score of 67%. That figure comes from GIAC's published exam information, and the notice applies to exam versions released on or after September 26, 2016. If you are testing in 2026, you are almost certainly sitting a version covered by that standard. One caveat is worth keeping in mind: GIAC states that the objectives, format, and passing score shown for your assigned attempt at the GIAC attempts page take precedence over any third-party summary, including this one. Always confirm against your own attempt record before you finalize your plan.

The exam itself is a single proctored, web-based sitting with 60 total questions and a 3-hour time limit. That time limit covers the entire exam, CyberLive tasks included. There is no separate clock for the hands-on portion, which matters a great deal for how you budget your effort. If you are still deciding whether this credential fits your career, our analysis of whether the GXPN certification is worth it walks through the return on investment in detail.

What 67% Means in Practical Terms

Candidates naturally want to translate 67% into a count of questions. Here is the honest answer: GIAC does not publish how it weights individual questions, and the CyberLive tasks are performance-based items that may not carry the same value as a single multiple-choice question. So any claim that you "need exactly N correct answers" would be speculation. What you can say with confidence is that you need to earn at least 67% of the available score, and that you should plan to clear it with room to spare rather than aiming for the line.

It is also worth separating two ideas that often get blurred. The passing score is the threshold you must reach. The difficulty of reaching it depends on the content, which is exploit-development heavy and unforgiving of shaky fundamentals. For a candid look at that side of the equation, see how hard the GXPN exam really is.

Format and Scoring Context: MCQs Plus CyberLive

The GXPN exam includes both multiple-choice questions and performance-based CyberLive tasks. GIAC's detailed explanation of its practitioner exams describes multiple-choice items followed by CyberLive, so expect to move from knowledge-recall and analysis questions into hands-on work in a live environment. The exam engine provides an on-screen calculator and a scratch notepad, which is genuinely useful when you are working through offsets, addresses, and byte arithmetic.

How the format shapes your scoring strategy

Because the 3-hour clock is shared across everything, the practical question is how to avoid starving the hands-on tasks. A sensible approach is to move through the multiple-choice items at a steady, disciplined pace, flag nothing you cannot revisit (remember, answers are final once submitted), and reserve generous time for CyberLive. The point is not to rush the multiple-choice section but to avoid lingering over a single item that you are unlikely to resolve by thinking harder.

Fourteen Domains, No Published Weights

GIAC lists 14 objective headings for GXPN, reproduced here in the published order. Critically, GIAC does not publish official percentage weights for these headings in the objective list. That means you cannot reliably concentrate your effort on a "high-value" domain and ignore the rest. Any site that quotes a neat percentage breakdown for GXPN is either guessing or describing a different credential that happens to share the acronym.

1. Bypassing Linux Exploit Mitigations
2. Bypassing Windows Memory Protections
3. Endpoint Control Evasions and Escalation
4. Establishing Network Access
5. Infrastructure Manipulation and Exploitation
6. Linux Execution, Memory, and Shellcode Foundations
7. Practical Cryptography
8. Practical Scripting for Offensive Operations
9. Product Security Testing and Fuzzing Foundations
10. Return Oriented Stack-Based Exploits
11. Source Code Based Fuzzing Techniques
12. Traffic Interception and Manipulation
13. Windows Execution and Memory Foundations
14. Windows Overflows and Execution Control

For a heading-by-heading breakdown of what each area involves, read our complete guide to all 14 GXPN content areas.

Passing Score Is Not a Pass Rate

This is the most common point of confusion. A 67% passing score tells you how well you must perform. It tells you nothing about what proportion of candidates succeed. GIAC does not publish an official GXPN pass-rate statistic that we could verify, so you should be skeptical of any specific percentage quoted online. We explore what can and cannot be said in GXPN pass rate: what the data shows.

The reasonable inference is qualitative: the exam targets experienced practitioners, the content is technically demanding, and the hands-on component rewards candidates who have actually practiced exploitation rather than just read about it. That does not translate into a number, and we will not invent one.

Open-Book Rules That Protect Your Score

GXPN is open book, but only within strict limits. You may use hardcopy books, notes, and an index. You may not use internet access, personal electronic references, or any materials that resemble practice or exam questions and answers. That last restriction is easy to violate by accident if you copy practice-question content into your notes, so keep your reference materials strictly to concept explanations, command references, and your own worked procedures.

Because internet access is prohibited and the CyberLive environment is self-contained, your offline reference quality directly affects your outcome. For a compact refresher on the facts you should be able to recall instantly, our one-page GXPN cheat sheet is a useful companion to your own index.

Fees, Retakes, and the 120-Day Window

Understanding the cost structure helps you decide how much preparation to invest before you sit the exam. GIAC's published figures are below. Prices exclude applicable sales tax, and SANS training tuition is separate from all of them.

Your attempt must be completed within 120 days from activation. That window is your real deadline, so work backward from it when you plan. The exam is delivered through Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility, so check which options apply to you. For scheduling details, see our guide to GXPN exam dates, testing windows, and deadlines, and for the full financial picture, our GXPN certification cost breakdown.

There are no formal certification prerequisites for GXPN, and training is optional though recommended. Note that the associated SANS SEC660 course has its own expectations: familiarity with penetration testing, Linux and Windows, and networking, plus recommended programming experience. Those are course prerequisites, separate from GIAC certification eligibility. Our GXPN requirements guide clarifies the distinction.

Building a Score-Targeted Plan Around GXPN Domains

Since there are no published weights, the smartest allocation of study time follows dependency, not percentage. Master the foundations first, because the exploitation headings assume them. The SEC660 course is organized into six sections, five subject sections plus a Capture the Flag capstone, and it is a useful scaffold, though the course sections are unweighted preparation curriculum and do not define exhaustive exam coverage. The capstone is a training exercise, not an exam component. SANS also documented a July 2026 course update covering AI-assisted workflows and refreshed Windows and Linux exploitation labs; that identifies a course revision, not a change to the GXPN exam version.

The reasoning behind this order is simple: scripting and the two foundation headings pay dividends in every later week, while the mitigation-bypass headings are far easier once you understand the execution-control techniques they defeat. For a fuller preparation roadmap, see our GXPN study guide for passing on the first attempt, and when you want realistic timed repetition, use the GXPN practice tests to find weak headings before exam day.

After You Pass: Validity and Renewal

Passing earns a certification valid for four years. To renew, you can earn 36 approved CPE credits during the active four-year period or take a renewal exam, plus the standard USD $499 renewal fee. Planning for renewal early keeps the credential an asset rather than a lapsing expense.

The credential tends to matter most for roles that involve vulnerability research, exploit development, and advanced offensive testing. If you are weighing where it can take you, our overview of GXPN jobs and the GXPN salary guide cover the career side, and you can practice for the exam itself at our main practice test site.

Frequently Asked Questions