How to Pass OSCP: Why Active Directory Decides Your Score

Last updated September 2026

OSCP has no multiple choice. You get just under 24 hours to break into a live lab network, then another 24 hours to write a professional penetration test report. If you can’t actually get a shell, you don’t pass. That’s the whole reason the OffSec Certified Professional (formerly Offensive Security Certified Professional) is still the best-known hands-on pentest cert.

One wrinkle since November 1, 2024: passing the exam earns you two certifications. OSCP never expires. OSCP+ expires after three years unless you maintain it (OffSec), through a CPE program with a $145 annual maintenance fee, a recertification exam or a qualifying higher-level exam. We didn’t find any announced change to the OSCP+ exam format for 2026 on OffSec’s site.

How you pass: points, flags and proof

From OffSec’s exam guide:

• Three standalone machines, 60 points: 20 points each, 10 for initial access (local.txt) and 10 for privilege escalation to root or Administrator (proof.txt).
• One Active Directory set, 40 points: three machines worth 10, 10 and 20 points. You start with a username and password, simulating an assumed breach.
• 70 points to pass. For example, the full AD set plus three local.txt flags, or 10 AD points plus all three standalone machines fully compromised.
• Proof has to be exact: each flag must be shown in an interactive shell on the target (web shells don’t count), in a screenshot that includes the target’s IP address, and submitted in the exam control panel.
• Documentation can cost you points: weak or incomplete reports can mean reduced or zero points, and once you submit, you can’t add missing screenshots.

Tool rules that catch people out

• Metasploit is limited to one target. You can use Metasploit modules or Meterpreter against a single machine of your choice. msfvenom and multi/handler are allowed everywhere.
• Banned: automatic exploitation tools (including sqlmap), mass vulnerability scanners (such as Nessus or OpenVAS), commercial tools such as Burp Pro, spoofing, and AI chatbots or LLMs of any kind.
• Allowed: Nmap and its scripts, Nikto, Burp Suite Community, DirBuster and similar tools.

Why attempts fail

Rarely for lack of exploits. The usual culprits:

• Thin enumeration. Missing a port or a service on the first pass, then burning hours on the wrong target.
• Neglecting Active Directory. The AD set is worth 40 points, and the three standalone machines top out at 60. You can’t reach 70 without at least some AD points.
• Screenshots and reports. Proof has to be exact, and once you submit you can’t add a missing screenshot. Weak documentation can cost points you already earned.
• Breaking a tool rule. Metasploit on a second target, or an automated tool on the banned list, is an easy way to lose a machine.
• Running out of energy. It’s a long day and a long night. Plan sleep and meals before you plan exploits.

Are you ready to attempt it?

• Aspiring and junior penetration testers who need proof they can do the work
• SOC analysts, sysadmins and developers moving into offensive security
• PenTest+ or CEH holders ready for a practical exam
• Red teamers and consultants whose clients ask for OSCP by name

OffSec says there are no formal prerequisites, but it strongly recommends a solid grasp of TCP/IP networking, reasonable Windows and Linux administration experience, and basic Bash or Python scripting (OffSec). Take that seriously. If you still look up basic Linux commands, spend a few months on fundamentals first; our Network+ guide and PenTest+ guide are cheaper places to build them.

OSCP+ exam details

Sources: OffSec’s OSCP+ Exam Guide, PEN-200 page, pricing page and CPE and annual maintenance handbook.

Paying for it

• Course + Cert Bundle: $1,749 one time for 90 days of PEN-200 and lab access plus one exam attempt (OffSec pricing).
• Learn One: $2,749 a year for one year of access to one 200- or 300-level course and labs, plus two exam attempts. OffSec lists discounts for existing OffSec certification holders and full-time students.
• Standalone exam: $1,699 for an OSCP+ exam attempt without training materials, per OffSec’s PEN-200 page.
• Keeping OSCP+: a $145 annual maintenance fee (AMF), or a $299-a-year Annual Membership Program (AMP) that includes AMF coverage plus labs and CPE content (OffSec). The base OSCP never expires and needs no fee.

For first-timers, the two attempts in Learn One are often the better value. OffSec itself notes that not everyone passes on the first try.

Keeping the “+”: OSCP+ renewal

OSCP+ is valid for three years. To keep the “+”, OffSec offers three routes (CPE handbook):

• CPE: earn 120 CPE credits during the three-year cycle and keep annual coverage through AMF or AMP every year of the cycle.
• Recertification exam: available to OSCP and OSCP+ holders starting up to six months before your OSCP+ expires. One attempt is valid for 120 days from purchase (OffSec).
• A qualifying higher-level exam: passing OSWA, OSEP, OSWE, OSED, OSMR, OSEE or OSAI+ also renews OSCP+.

OffSec says annual coverage applies to the retake and higher-level routes too “where applicable under the program rules,” and missed years must be covered if you renew later (OffSec AMF FAQ). If you let OSCP+ lapse, you still hold OSCP for life.

Sixteen weeks to exam day

Figure 10 to 15 hours a week, starting from comfort on Linux and Windows. OffSec publishes its own 12-week and 24-week PEN-200 learning plans if you want a slower or faster pace.

• Weeks 1 to 3: foundations. Work through the early PEN-200 modules: information gathering, vulnerability scanning, web attacks (XSS, SQL injection, directory traversal, file uploads) and client-side attacks. Take notes you can search on exam day.
• Weeks 4 to 6: exploitation and privilege escalation. Public exploits, fixing exploits, password attacks, and Windows and Linux privilege escalation. Build your own checklists for each.
• Weeks 7 to 9: pivoting and Active Directory. Port forwarding and tunneling, then AD enumeration, authentication attacks and lateral movement. The AD set is 40% of the exam, so don’t rush this.
• Weeks 10 to 13: challenge labs. PEN-200 includes 9 challenge labs, and OffSec says three are designed to closely replicate the exam environment. Do those under exam-like conditions.
• Weeks 14 to 15: extra practice. More standalone boxes and AD practice. Practice writing a full report for every machine you root.
• Week 16: mock exam and rest. Run a full 24-hour simulation with a report, fix your weak spots, then rest before the real thing. Plan sleep and meal breaks for exam day.

What OSCP means to a hiring team

To a hiring team, OSCP answers the question a multiple-choice cert can’t: can this person compromise real machines and write it up? That’s why it’s widely treated as the practical proof for penetration testing roles. OffSec lists roles such as penetration tester, SOC analyst, security consultant, incident responder and vulnerability analyst for OSCP holders (OffSec).

BLS doesn’t publish a separate penetration tester category in its Occupational Outlook Handbook. Its closest profile, information security analysts, shows a May 2025 median pay of $129,180 and 21% projected growth from 2025 to 2035 (BLS).

OSCP vs PenTest+, CEH and SecurityX

• OSCP vs PenTest+: PenTest+ is a multiple-choice and performance-based exam that covers the whole engagement process, and it costs far less. OSCP is 24 hours of real hacking. Many people take PenTest+ first for the structure, then OSCP when they can root lab machines on their own.
• OSCP vs CEH: CEH proves broad knowledge and is often written into government requirements. OSCP proves practical skill. Plenty of working testers hold both. The full CEH vs PenTest+ vs OSCP breakdown compares cost, format and renewal.
• OSCP vs SecurityX: SecurityX is CompTIA’s advanced certification for security architects and engineers. It’s defensive and architectural; OSCP is offensive.
• Before OSCP: If you haven’t done Security+ or equivalent study, the fundamentals will help, and if you’re planning a career move into security, see How to Transition to a Cybersecurity Career at Any Age.

Want the full offensive sequence? See the certification roadmap.

Build a methodology, practice it until it’s boring, and take notes you can search when you’re exhausted halfway through exam night.

New CVEs drop every day. Know which ones attackers are actually using. Today’s real-world exploits become tomorrow’s lab machines. The CyberExperts Daily Brief tracks them in five minutes, weekday mornings. Get tomorrow’s brief.

Common OSCP questions

Sources

• OffSec, PEN-200 and the OSCP+ certification: offsec.com
• OffSec, Pricing: offsec.com
• OffSec Support, OSCP+ Exam Guide: help.offsec.com
• OffSec Support, CPE Program and Annual Maintenance Handbook: help.offsec.com
• OffSec Support, Annual Maintenance Fee (AMF) FAQ: help.offsec.com
• OffSec Support, Recertification Exam FAQ: help.offsec.com
• OffSec blog, Everything you need to know about the OSCP+ (September 2024): offsec.com
• BLS, Information security analysts: bls.gov

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.