Step 304. Understanding the OSCP Exam and a Preparation Roadmap — The Rules of the 24-Hour Practical Battlefield

Level 4 — Professional | Difficulty ★★☆☆☆ | Estimated time: 3–4 hours

Prerequisites: you checked your strengths and weaknesses with data in Step 303 (Level 3 comprehensive evaluation). You have experience solving HTB Medium-tier machines on your own.

• What you need: a web browser (to read OffSec’s official pages), a calendar, and a document tool (personal wiki or Markdown editor).
• This lesson produces a plan. For later technical practice, use an isolated lab you control or targets, features and periods explicitly permitted by the operator. A platform name does not authorize access to every system or feature.
• Information caution: the OSCP exam system (structure, scoring, price, regulations) changes frequently. The figures in this chapter organize the general structure as of writing — always confirm the latest information on OffSec’s official pages and the Exam Guide.

Connect the strengths and gaps recorded in Level 3 to exam preparation. This lesson checks the exam structure, evidence and reporting rules, then uses your available time and learning observations to build a plan. Identify missing skills and link them to lessons and practice tasks.

Level 4 Roadmap — 7 Tracks, 45 Steps

Level 4 (Steps 304–348) consists of seven tracks. Read them in order, or start with the track you need. The first chapter of each track carries a track guide.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain the OSCP exam’s structure (time, machine composition, report regulations)
• Understand the scoring system and build a score strategy of “which combination makes 70 points”
• Ground the choice between taking PEN-200 and sitting the exam alone in your own skill data
• Draw a connection table of which Steps of this book prepare which parts of the exam
• Write a preparation plan with a target exam date and weekly practice volume

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. OSCP and OSCP+ — Practical Work and Documentation

OSCP is an OffSec practical penetration-testing certification. This lesson prepares for the current OSCP+ exam. The official page states that passing earns both OSCP and OSCP+: OSCP does not expire, while the OSCP+ designation is valid for three years from issuance. Check current maintenance options when planning an exam or renewal.

The following compares personal practice with this exam preparation. CTF time limits, reports and hint rules vary by event; do not generalize one format to all CTFs.

Prepare both the practical result and the documentation that demonstrates it. A result may receive no credit if the required evidence and reporting conditions are not met.

2-2. Exam Structure — 23 Hours 45 Minutes and a Submission Deadline

Summary checked against the official exam guide on September 27, 2026. The title’s “24-hour” wording is approximate; the practical lasts 23 hours 45 minutes. Read the full current guide before the exam.

[Practical] 23 hours 45 minutes
- 3 independent machines: 20 each (10 initial access + 10 escalation)
- 3 AD machines: 10 + 10 + 20 = 40; starting credentials provided
- Passing threshold: 70/100

[Report] Within 24 hours after the practical ends
- Submit the PDF inside an unencrypted .7z archive
- Check the official checklist for naming, size and final submission
- Submit proof contents in the control panel before the exam ends
- Capture proof contents from an interactive target shell, with the target IP

Remember three things. First, the AD set is 40 points — nearly half the score comes from the domain environment (intensive training in Step 308). Second, the report is part of the exam — it must be submitted within 24 hours after the practical ends, so “solve everything then write leisurely” is impossible (prepared for in Step 307). Third, the 3 independent machines each award partial credit for initial access and privilege escalation, so points accumulate even without full compromise.

2-3. Score Strategy — Combinations That Make 70

There are several combinations that make the 70-point pass line.

Scoring example A: AD 40 + independent 20 + independent 20 = 80
Scoring example B: AD 40 + independent 20 + another independent initial access 10 = 70
Scoring example C: AD 10 + independent 20 + independent 20 + independent 20 = 70

These examples practise score arithmetic; they do not declare a pass. Actual credit depends on target objectives, evidence, documentation and rule compliance. Preserve evidence of achieved initial access, then compare remaining objectives, time and progress when choosing the next task. Recording a failed command does not itself earn points.

The current OSCP+ exam does not award bonus points. We checked the official OffSec OSCP+ FAQ on September 27, 2026. Historical advice about earning extra exam points through PEN-200 exercises or lab records does not apply to the current exam. Choose training for the practice environment and learning support you need; earn the required score through exam performance.

2-4. Whether to Take PEN-200 — Decide with Skill Data

PEN-200 is OffSec’s official course. The official product page lists training/lab/exam bundles and a standalone exam option (checked September 27, 2026). Compare current inclusions, access periods, and prices before buying.

Having finished Level 3, your judgment criteria are not other people’s reviews but my data.

2-5. Check Prohibited and Restricted Tools

Checked September 27, 2026 against the OffSec exam guide and official FAQ. These corrections are a summary; reread all restrictions before your exam.

• Metasploit and Meterpreter: select one machine; repeated use there is permitted. Do not test several machines first, switch after failure, or use them for pivoting. Consult the guide for multi/handler and msfvenom exceptions.
• Prohibited tools: mass vulnerability scanners such as Nessus, automatic exploitation tools, and commercial tools/services are prohibited. An allowed example such as Nmap does not override restrictions on particular features.
• AI chatbots: prohibited during both the exam and report preparation.

In your practice log, record the tool, the feature used, and the rule you checked. Distinguish tools used for learning from tools permitted in the exam.

3. Follow Along

Today’s deliverable is one preparation plan. Download the English worksheet, Korean worksheet or complete ZIP and complete the following five sections. This is a lesson worksheet, not an exam-report template. Mark unknown values “unverified” and record the official source and next verification action.

3-1. Summarizing the Structure from the Exam Guide

Find and read the OSCP Exam Guide on OffSec’s official site, and organize the following items in your own words — the task is to verify directly, not copy this chapter’s figures.

## Exam structure (verified: ____-__-__, source: OffSec Exam Guide)
- Practical duration: ____
- Machine composition: ____ independent / ____ AD sets
- Scoring and pass line: ____
- Report deadline: ____
- Evidence rules (screenshot requirements): ____
- Prohibited/restricted tools: ____
- Bonus points: none (official FAQ checked 2026-09-27; reconfirm before the exam)
- Retake regulations and cost: ____

Why record the verification date: when the system changes, this document must be updated — and without knowing how old the information is, you can’t judge when to update it.

3-2. Building a 30-Item Practice List

Select practice to address specific skill gaps. Community lists are candidate sources: check their date, current availability, cost and authorized scope. Even on a practice platform such as Proving Grounds, confirm that each selected target and feature is within the offered scope. Thirty entries below are a planning example; label each item’s type so an AD set and a single machine are not counted as identical units.

## Practice entries (30 as an adjustable example)
### Introductory 10 / intermediate 15 / difficult or AD 5
1. Name / type (machine, AD set, reporting): ____
   Authorized scope / access conditions: ____
   Skill gap and basis for difficulty: ____
   Planned time: ____ / actual time: ____ / help used: ____
   Completion date / observations / evidence location: ____ / next action: ____

Choose using your skill gaps, Windows/Linux/AD coverage and access conditions. Treat community ratings as references. A solved task can still belong in the plan when the aim is independent reproduction or better documentation; distinguish new work from repeat practice. Record each item’s completion date and observations.

3-3. The Course-Decision Table

Apply section 2-4’s criteria to your data. Pull out Step 303’s evaluation document.

## Course decision
- Two observations distinguishing independent work and hints: ____ / ____
- Gaps observed in AD work and report reproducibility: ____
- Unverified skills and tasks to check them: ____
- Materials, lab access and feedback needed: ____
- Costs, access periods and limits: ____
- Decision or reason to defer, with next action: ____

“Because everyone else takes it” is not grounds. Grounds always come from my data.

3-4. The Schedule — Carving It into the Calendar

Finally, build a schedule with numbers in it.

## Preparation schedule
- Weekly available hours: ____
- Practice / documentation / review hours: ____ / ____ / ____
- Sum of the three: ____ / what to reduce if over capacity: ____
- Rest / contingency time: ____
- Mock check 1 / 2 dates and official timing / rules to apply: ____
- Target exam date or decision review date: ____
- Location in a calendar / document you will actually use: ____
- Weekly check date and adjustments after missed work: ____

The 30-item list and timeboxes in this lesson are planning examples, not OffSec eligibility requirements or predictors of passing. Assess AD work, evidence and reporting, and compliance with tool restrictions before setting your schedule and budget.

3-5. Connecting to This Book — You Have Already Come This Far

Organized, here’s which parts of the exam this book’s journey so far has prepared.

Do you see it — you are not “starting fresh” on the OSCP but at the stage of assembling what you’ve already built into the exam format.

4. Missions & Exercises

Mission — Complete One Copy of the OSCP Prep Plan

1. Fill 3-1’s items by verifying them yourself in the official Exam Guide (verification date included)
2. Classify practice entries by type and difficulty (for example, introductory 10 / intermediate 15 / difficult or AD 5). Explain any change in count
3. Write a decision or reason to defer, grounded in your observations and support needs
4. Fit practice, documentation, review and mock checks within your available time; record a target exam or review date in a calendar or document you will use
5. Write the check date and next verification date at the top, and schedule a final check of official rules immediately before the exam

Exercises

Exercise 1. What outputs should you keep for personal practice and for this exam preparation? Explain why one scoring rule cannot be applied to every CTF.

Exercise 2. On an independent machine where you achieve only initial access and fail privilege escalation, what must you absolutely do as score strategy?

Exercise 3. Using the risks of both over-preparation and under-preparation, explain why your criteria must be “my data,” not “other people’s preparation periods.”

Exercise 4. Why is it emphasized that the exam guide be verified as “the official document,” not “the book’s figures”?

# OSCP Prep Plan
Checked: ____ / Next verification: ____ / Pre-exam check: ____

## 1. Exam summary — official sources, dates and unknowns
## 2. Practice entries — types, gaps, help, dates and observations
## 3. Learning / course decision — observations and support needs
## 4. Schedule — available hours and sum, mock checks, target or review date
## 5. Course connections / self-review — lessons, first action, remaining checks

6. Common Pitfalls & Fixes

Wall 1. The information is mixed — every review says something different

Symptom: each blog pass story states different scoring and regulations.
Cause: the system has actually changed multiple times, and each review carries the regulations of when its author sat.
Fix: use community information only for experience-type info like “practice machine recommendations,” and confirm institutional information — exam regulations, scoring, prohibited tools — only in the official Exam Guide. Recording the fixation date in your plan is the firewall against this confusion.

Wall 2. Success and failure stories shake me into constantly changing the schedule

Symptom: pass/fail stories keep changing your schedule. Compare your observations and skill gaps first, and also account for available time, health, cost and official rule changes. “Under four hours for three weeks” is only a possible personal target, not an official readiness standard or the only reason to revise a plan.

Wall 3. The list grows huge and I never start

Symptom: the list grows without execution records. Start with work you can actually do this week; choose later items using observed gaps. Thirty entries are this lesson’s planning example. If you change the count, record why and recalculate the schedule and hours.

Wall 4. English anxiety keeps postponing the decision

Symptom: English report writing is slow. Sentence patterns can help you start, but twenty fixed sentences do not complete a report. Using authorized practice material, write commands, observations, causes and reproduction steps, then check whether another reader can follow them. Later lessons practise writing and reviewing reports.

Wall 5. Adding discontinued bonus points to the current score

Symptom: historical bonus-point advice leads you to target too few exam points.
Cause: an old exam report has been confused with the current OSCP+ rules.
Fix: no bonus points are available. Plan to earn the passing score of 70 through exam performance, and check the official exam guide and FAQ again immediately before your exam.

7. Summary

Today’s Concepts

Today’s Commands & Tools

The Core Instinct

A preparation plan connects technical practice with evidence and information management. After each item, record help used, observations, unresolved problems and the next action. Completing this lesson means producing an evidence-based plan; it does not certify exam readiness or guarantee a pass.

Once every box is checked, Step 304 is complete.