Step 304. Understanding the OSCP Exam and a Preparation Roadmap — The Rules of the 24-Hour Practical Battlefield
Level 4 — Professional | Difficulty ★★☆☆☆ | Estimated time: 3–4 hours
Prerequisites: you checked your strengths and weaknesses with data in Step 303 (Level 3 comprehensive evaluation). You have experience solving HTB Medium-tier machines on your own.
- What you need: a web browser (to read OffSec’s official pages), a calendar, and a document tool (personal wiki or Markdown editor).
- ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. The practice platforms covered today (Proving Grounds, Hack The Box) are legal learning environments officially opened by their operators.
- Information caution: the OSCP exam system (structure, scoring, price, regulations) changes frequently. The figures in this chapter organize the general structure as of writing — always confirm the latest information on OffSec’s official pages and the Exam Guide.
Through Level 3 you were trained as "a problem solver" in CTF and HTB. The OSCP is both the settlement of that training and a completely different kind of exam — not a puzzle of finding one flag, but a miniature of real work: penetrate multiple systems within a fixed time and prove the entire process in documents. Today you learn zero techniques. Instead, you precisely pin down what this exam looks like, what path leads from your current skill to a pass, and which Steps of this book prepare which parts. Climb a mountain without a map and even the strongest legs wander — today is the day you draw the map.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Explain the OSCP exam’s structure (time, machine composition, report regulations)
- Understand the scoring system and build a score strategy of "which combination makes 70 points"
- Ground the choice between taking PEN-200 and sitting the exam alone in your own skill data
- Draw a connection table of which Steps of this book prepare which parts of the exam
- Write a preparation plan with a target exam date and weekly practice volume
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | Web browser (OffSec official pages), calendar, personal wiki |
| Today’s materials | The OSCP Exam Guide (official document), your self-evaluation data from Step 303 |
| Concepts needed | Exam structure, scoring system and pass line, PEN-200, prohibited-tool regulations, the bonus-points system |
| Today’s deliverable | OSCP-prep-plan.md — exam structure summary + practice machine list + target exam date |
2-1. What the OSCP Is — Not a Certificate but a Rite of Passage
OSCP (Offensive Security Certified Professional) is a hands-on penetration-testing certification operated by OffSec (formerly Offensive Security). In the industry it passes as "the pentester’s rite of passage" — because it’s not multiple choice but an exam where you must actually breach machines to earn points.
Pin down the difference from CTF precisely.
| Category | CTF / HTB machines | OSCP exam |
|---|---|---|
| Goal | Find the flag (puzzle) | Penetration + evidence + report (work) |
| Scoring | The flag only | Includes documentation of the penetration process |
| Hints | Communities and walkthroughs exist | Independent work under a proctor |
| Time | Free | Practical ~24 hours + report 24 hours |
In other words, the OSCP is the product of "the skill to breach" and "the documents proving you breached." Skill of 100 with documents of 0 is 0 points.
2-2. Exam Structure — Two 24-Hours
The general structure as of writing (details may change, so re-confirm with the official guide before sitting).
[Day 1] Practical exam: about 23 hours 45 minutes
- 3 independent machines (20 pts each)
- 1 AD set (2 clients + 1 domain controller, 40 pts total)
- Pass line: 70 of 100 points
[Following] Report submission: within 24 hours after the practical ends
- Write the penetration report as a PDF and upload
- Reviewers require description "reproducible by following it"
- Evidence screenshot rules: local.txt/proof.txt + machine identification info
Remember three things. First, the AD set is 40 points — nearly half the score comes from the domain environment (intensive training in Step 308). Second, the report is part of the exam — it must be submitted within 24 hours after the practical ends, so "solve everything then write leisurely" is impossible (prepared for in Step 307). Third, the 3 independent machines each award partial credit for initial access and privilege escalation, so points accumulate even without full compromise.
2-3. Score Strategy — Combinations That Make 70
There are several combinations that make the 70-point pass line.
Combination A: AD set complete (40) + 2 independent machines complete (40) = 80 pts <- comfortable pass
Combination B: AD set complete (40) + 1 independent complete (20) + 1 independent initial access (10) = 70 pts
Combination C: 3 independent complete (60) + AD set partial (10-20) = 70-80 pts
The strategy this table states is clear — you can’t abandon either side, and partial credit decides the pass. Even if one independent machine stalls, firmly documenting just the initial-access evidence is 10 points, and that 10 becoming the difference between pass and fail happens often in practice. "Even a machine you couldn’t breach keeps its evidence" is the exam hall’s iron rule.
There’s also a bonus-points system — a program under which submitting the official course (PEN-200) exercises and lab records adds points to the exam score has been operated. The conditions (what percentage of exercises, how many points) get revised often, so confirm on the official page before deciding on the course.
2-4. Whether to Take PEN-200 — Decide with Skill Data
PEN-200 is OffSec’s official course — sold as a package bundling textbook + practice labs + an exam voucher, and you can also sit the exam alone (availability and prices may change, so check the official page).
Having finished Level 3, your judgment criteria are not other people’s reviews but my data.
| My state | Judgment |
|---|---|
| HTB Medium solved reliably within 4 hours | Consider exam-only entry — independent-machine skill is already proven |
| AD chain experience only from Steps 261–263, 271 | Decide after intensive AD set training (Step 308) — if lab access is needed, the course is efficient |
| Slow at English document writing | Report training (Steps 305–307) is more urgent than the course |
| Need a structured curriculum and bonus points | Consider taking PEN-200 |
2-5. Prohibited-Tool Regulations — What You Can’t Use in the Exam Hall
The exam has tool restrictions. The direction known as of writing (confirm details in the Exam Guide):
- Limits on automated exploitation frameworks: Metasploit’s automated modules are restricted (detailed rules exist, such as once per machine). Manual exploitation ability is the core evaluation target.
- Commercial auto-exploitation tools banned: tools that automatically perform penetration through to compromise cannot be used.
- AI-based automated attack tools: an area treated as restricted in recent regulations — reading the regulation’s original text is mandatory.
- Scanners and enumeration tools are allowed: recon and enumeration tools like nmap, Nessus (basic scans), gobuster, and BloodHound are usable.
The lesson is one — build the habit of "solving without Metasploit" from everyday practice. Do manual exploitation for the first time in the exam hall and your time collapses.
3. Follow Along
Today’s deliverable is one copy of OSCP-prep-plan.md. Fill it in four steps.
3-1. Summarizing the Structure from the Exam Guide
Find and read the OSCP Exam Guide on OffSec’s official site, and organize the following items in your own words — the task is to verify directly, not copy this chapter’s figures.
## Exam structure (verified: ____-__-__, source: OffSec Exam Guide)
- Practical duration: ____
- Machine composition: ____ independent / ____ AD sets
- Scoring and pass line: ____
- Report deadline: ____
- Evidence rules (screenshot requirements): ____
- Prohibited/restricted tools: ____
- Bonus-points system: ____
- Retake regulations and cost: ____
Why record the verification date: when the system changes, this document must be updated — and without knowing how old the information is, you can’t judge when to update it.
3-2. Building a 30-Machine Practice List
Community-validated OSCP-like machine lists exist — TJ_Null’s OSCP-like list (for HTB machines), Proving Grounds Practice (OffSec’s own practice lab), etc. Pick 30 from these lists and classify by difficulty.
## Practice machine list (30 total)
### Easy (10) — 4-hour timebox
1. ____ (HTB/PG) — completed: ____
### Medium (15) — 6-hour timebox
1. ____ (HTB/PG) — completed: ____
### Hard / AD sets (5 machines/sets) — 8-hour timebox
1. ____ (HTB/PG/THM network lab) — completed: ____
Selection criteria: ① the latest exam profile (Windows+Linux balance, AD included), ② machines with accumulated community ratings of "helped OSCP prep," ③ exclude machines already solved. The completed-date cells are what turn the list from "a table you look at" into "a table you fill."
3-3. The Course-Decision Table
Apply section 2-4’s criteria to your data. Pull out Step 303’s evaluation document.
## Course decision
- HTB Medium average solve time: ____
- Independent AD chain experience: yes / no
- English report writing speed: ____ minutes per A4 page
- Budget: ____
- Decision: PEN-200 / exam-only — grounds: ____
"Because everyone else takes it" is not grounds. Grounds always come from my data.
3-4. The Schedule — Carving It into the Calendar
Finally, build a schedule with numbers in it.
## Preparation schedule
- Weekly practice volume: ____ machines/week (days: ____)
- Report drafts: 30 minutes right after each machine
- Mock exams: week ____ of ____, week ____ of ____ (two 24-hour-format runs)
- Target exam date: ______ (year/month)
- Interim check: every Sunday — record progress vs. plan on the list
A recommended rule of thumb: once you solve HTB Medium reliably within 4 hours, booking the exam is a good signal. Conversely, if even Easy takes more than 6 hours, the courage to postpone the schedule saves money.
3-5. Connecting to This Book — You Have Already Come This Far
Organized, here’s which parts of the exam this book’s journey so far has prepared.
| This book’s sections | The corresponding OSCP exam part |
|---|---|
| Steps 96–117 (recon/scanning basics) | Every machine’s first 30 minutes — enumeration ability |
| Steps 118–127 (the full MS2 attack) | The independent machine’s standard cycle — penetrate→escalate→evidence |
| Steps 123–124 (john/hashcat) | Credential cracking — the hidden gateway of every point |
| Step 128 (the MS2 report) | The exam report’s skeleton |
| Steps 261–263, 271 (AD basics/machines) | The basic stamina for the AD set’s 40 points |
| Steps 269, 272 (asset management/playbook) | Information management inside exam time |
| Steps 304–308 (this unit) | The exam-prep system — plan, report training, enumeration training, templates, AD sets |
| Steps 309–313 (the following unit) | Mock exams and the sitting itself |
Do you see it — you are not "starting fresh" on the OSCP but at the stage of assembling what you’ve already built into the exam format.
4. Missions & Exercises
Mission — Complete One Copy of the OSCP Prep Plan
- Fill 3-1’s items by verifying them yourself in the official Exam Guide (verification date included)
- Classify a 30-machine practice list by difficulty (Easy 10 / Medium 15 / Hard·AD 5)
- Decide on the course grounded in your data, and write the grounds as sentences
- Actually enter into the calendar a schedule with weekly practice volume, 2 mock exams, and a target exam date
- Write the "verification date" and "re-verification date (2 months before the exam)" at the top of the plan
Exercises
Exercise 1. From the perspective of "scoring method," explain what fundamentally differs between the OSCP and CTF.
Exercise 2. On an independent machine where you achieve only initial access and fail privilege escalation, what must you absolutely do as score strategy?
Exercise 3. Using the risks of both over-preparation and under-preparation, explain why your criteria must be "my data," not "other people’s preparation periods."
Exercise 4. Why is it emphasized that the exam guide be verified as "the official document," not "the book’s figures"?
5. Model Answers & Completion Criteria
Mission Model Answer
A completed plan has this structure.
# OSCP Prep Plan
Verified: 2026-__-__ / re-verify: 2 months before the exam
## 1. Exam structure summary <- 3-1. values verified directly in the official guide
## 2. Practice machine list (30) <- 3-2. Easy/Medium/Hard·AD classification + completed-date cells
## 3. Course decision & grounds <- 3-3. based on my data
## 4. Preparation schedule <- 3-4. weekly practice volume, 2 mock exams, target exam date
## 5. Connection table to this book <- 3-5. inventory of what I already have
How to verify: ① does each structure-summary item contain "a value verified in the official guide" — copied straight from the book, it’s unfinished. ② Does the machine list have difficulty balance (Easy→Hard)? ③ Does the course decision cite at least 2 of your own data points (solve times, AD experience, etc.)? ④ Is the schedule actually entered in the calendar — a schedule that exists only in a document is not a schedule. ⑤ Is the target exam date written as a year and month, not "someday"?
Exercise Answers
Answer 1. CTF scores only the "artifact" of a flag, but the OSCP scores even the documentation of the penetration process. Obtain the flag without evidence screenshots or reproducible description and the points are not recognized — so the OSCP is simultaneously a technical exam and a documentation exam. This is why "one report per machine" training is needed from practice onward (Step 305).
Answer 2. Perfectly document the evidence up to the point of failure. Initial access carries partial credit, and those 10 points often decide the 70-point pass line. So don’t discard the machine as a "full-compromise failure" — move the initial access’s commands and evidence screens into the report, then make the judgment to move to the next machine.
Answer 3. Following someone else’s period collapses you in two directions. Over-preparation is a person already prepared delaying the exam "because a famous pass story took 6 months," burning opportunity cost; under-preparation is sitting the exam while below standard and losing the fee and your confidence. Only my data — measurable indicators like reliable HTB Medium solve time — avoids both failures at once.
Answer 4. Because the exam system gets revised whenever the operator decides, and the figures in books, blogs, and pass stories belong to when they were written. Prepare on stale information — not knowing a changed scoring scheme or prohibited-tool rule, say — and on exam day the strategy itself can become void. "The habit of recording the verification date" is thus the baseline of information management.
Completion Criteria Checklist
- [ ] I can explain the exam structure (duration, composition, scoring, report regulations) to someone else
- [ ] I can state 2+ score combinations that make 70 points
- [ ] I fixed the exam structure summary by verifying it myself in the official guide
- [ ] The 30-machine practice list is complete by difficulty
- [ ] I decided on the course grounded in my data
- [ ] Target exam date and weekly practice volume are entered in the calendar
- [ ] Mission: I completed one copy of
OSCP-prep-plan.md
6. Common Pitfalls & Fixes
Wall 1. The information is mixed — every review says something different
Symptom: each blog pass story states different scoring and regulations.
Cause: the system has actually changed multiple times, and each review carries the regulations of when its author sat.
Fix: use community information only for experience-type info like "practice machine recommendations," and confirm institutional information — exam regulations, scoring, prohibited tools — only in the official Exam Guide. Recording the fixation date in your plan is the firewall against this confusion.
Wall 2. Success and failure stories shake me into constantly changing the schedule
Symptom: "passed in 3 months" makes you impatient; "failed three times" deflates you.
Cause: your criteria sit on other people’s data.
Fix: fix the plan’s only modification trigger as my measurements — something like "HTB Medium average solve time under 4 hours for 3 consecutive weeks." Other people’s stories are not information but weather.
Wall 3. The list grows huge and I never start
Symptom: the practice machine list passed 100 and not one machine has been started.
Cause: the phenomenon where the act of preparing gets mistaken for studying itself.
Fix: cut the list at 30 — that’s why 3-2’s number is fixed. And deploy Easy machine #1 the same day you save the plan. A plan’s completion condition is the first machine’s start.
Wall 4. English anxiety keeps postponing the decision
Symptom: the mere fact that the Exam Guide and report are in English pushes the exam further away.
Cause: you’re overestimating the English requirement — what the exam needs is not literary English but technical document English.
Fix: report sentences can be templated (covered in Step 307). Twenty skeleton sentences like "The target was vulnerable to ___ because ___" write a whole report. English is a problem solved by practice, and that practice accumulates automatically from Step 305.
Wall 5. Trusting the bonus points, I cut practical practice
Symptom: the calculation "with bonus points, 60 is enough" lowers practice intensity.
Cause: an expectation that hasn’t verified the bonus system’s conditions and survival.
Fix: the bonus-points system is an operating policy that can change or be abolished. Sit the exam when you can make 70 assuming 0 bonus points — that is the principle, and treat bonus points only as safety margin on top.
7. Summary
Today’s Concepts
| Concept | One-line explanation |
|---|---|
| OSCP | A pentest certification evaluated by hands-on penetration + report submission — the product of skill × documents |
| Exam structure | Practical ~24 hours (independent machines + AD set) → report within 24 hours |
| Scoring system | 100-point max, 70 to pass — the AD set is ~40 points; partial credit decides the pass |
| PEN-200 | The official course (textbook + labs + voucher) — the take/skip decision uses my data |
| Prohibited-tool regulations | Automated exploitation restricted — train manual exploitation from everyday practice |
| The verification-date habit | Record the confirmation date on institutional info; re-verify with the official guide before sitting |
Today’s Commands & Tools
| Tool | What it does |
|---|---|
| OffSec official site / Exam Guide | The only primary source for institutional information |
| TJ_Null’s OSCP-like list | A validated HTB-based practice machine list |
| Proving Grounds Practice | OffSec’s own practice lab — the same environment as the exam |
OSCP-prep-plan.md |
Today’s deliverable — structure summary + list + schedule |
| Calendar | The schedule’s final store — a schedule inside a document is not a schedule |
The Core Instinct
OSCP preparation is half technique and half information management — knowing precisely what gets evaluated, how far I’ve come, and when I’ll go in. The plan you made today is not a document you write once and finish; it’s a living document whose completed-dates fill as you solve machines. And one last thing to remember — this exam is not "an exam that selects geniuses" but "an exam that people with a preparation system pass." Today you made that system’s first page.
Once every box is checked, Step 304 is complete.