How long does it take to prepare for OSCP+ from Morocco?
Short answer: plan for about 12 weeks of steady work if you already have solid Linux, networking and web foundations, and closer to 5 or 6 months if you are starting further back. There is no shortcut: OffSec's OSCP+ exam is 100% hands-on. You get 23 hours 45 minutes to compromise an Active Directory set and several standalone machines under remote proctoring, then 24 hours to submit a pentest report. You need 70 out of 100 points.
The good news is that everything happens online: the PEN-200 course, the labs and the exam. Preparing from Casablanca, Rabat, Marrakech or Agadir is perfectly workable, as long as you organise your time, your connection and your hardware. This guide offers a realistic plan for someone who works full time and can free up 12 to 15 hours a week.
What prerequisites do you need before starting PEN-200?
PEN-200 is not an introductory course. Many candidates lose weeks in the labs because of a gap they could have filled beforehand. Check honestly that you are comfortable with the following:
- Linux: command line navigation, permissions, processes, services, scheduled tasks, reading configuration files.
- Windows: users and groups, services, registry, basic PowerShell, Active Directory concepts (domain, domain controller, Kerberos).
- Networking: the TCP/IP model, common ports, DNS, HTTP, SMB, FTP, SSH, and reading a simple packet capture.
- Scripting: reading, editing and fixing a Python or Bash script, and adapting a public exploit instead of running it blindly.
- Web: how HTTP requests, cookies and forms work, and the classic flaws (SQL injection, file inclusion, file upload, command injection).
What does the PEN-200 course cover and how should you approach it?
PEN-200 (Penetration Testing with Kali Linux) is the official course behind OSCP+. It covers the full pentest chain: passive and active information gathering, vulnerability scanning, web application attacks, finding and adapting public exploits, password attacks, Windows and Linux privilege escalation, port forwarding and pivoting, Metasploit, then Active Directory enumeration and attacks. Each module ends with exercises, and challenge labs reproduce complete networks.
The most common mistake is to read the whole course first and only then open the labs. Alternate instead: one module, its exercises, then one or two machines that use what you just learned. The course then becomes your reference, and you will return to it often.
What does a 12-week OSCP+ preparation plan look like?
This plan assumes around 12 to 15 hours a week, for example two evenings plus half a day at the weekend. Adjust it to your level: if a phase feels easy, move on; if you get stuck, extend it rather than skipping a step.
- Weeks 1–2: refresh Linux, Windows and networking; set up Kali, your note-taking tool and a report template.
- Weeks 3–4: PEN-200 modules on information gathering, scanning and web attacks, with their exercises.
- Weeks 5–6: public exploits, password attacks, Linux and Windows privilege escalation; first lab machines.
- Weeks 7–8: pivoting, port forwarding, Metasploit, then Active Directory; aim for three or four machines a week.
- Weeks 9–10: full challenge labs under real conditions, timing each machine and writing clean notes.
- Week 11: a 24-hour mock exam on a set you have never seen, followed by a complete report.
- Week 12: work on weak spots, review your methodology sheets, rest and prepare exam logistics.
How should you work the labs: enumeration, notes and method?
In the labs as in the exam, most dead ends come from incomplete enumeration, not from missing techniques. Get into the habit of running the same routine on every target and keep it in a checklist you improve week after week.
Note-taking is your best ally. Use a structured tool (Obsidian, CherryTree, Joplin or similar) with one folder per machine: scan results, leads tried, credentials found, exact commands, screenshots. On exam day, these notes become the skeleton of your report.
- Full TCP port scan, then targeted service scans and a check of the most common UDP ports.
- Service-by-service enumeration: versions, SMB shares, web directories, users, readable files.
- Search for public exploits matching the versions found, and read the code before running anything.
- After initial access: systematic local enumeration for privilege escalation.
- Capture the proof (local.txt or proof.txt, with the command and IP address visible in the same screenshot).
- Stuck for more than an hour? Switch targets or go back to enumeration.
How do you practise Active Directory for OSCP+?
The Active Directory set carries heavy weight in the final score: reaching 70 points without compromising it is difficult. It deserves dedicated preparation. Master domain enumeration (users, groups, sessions, shares, permissions), Kerberos attacks such as Kerberoasting and AS-REP Roasting, credential and hash reuse, and lateral movement between machines.
Train on the AD environments in the PEN-200 labs, then build your own small domain with two or three virtual machines if your computer allows it. Reproducing an attack in a lab you built forces you to understand why it works, which often makes the difference on the day. Also read OffSec's official exam guide: the AD set format and the rules evolve, and only the current version counts.
Taking the OSCP+ exam from Morocco: logistics, report and mindset
The exam is taken online under remote proctoring via webcam and screen sharing, with an ID check at the start. When booking your slot, check the displayed time zone carefully: Morocco normally runs on UTC+1 but switches back to UTC+0 during Ramadan. Choose a start time that lets you sleep well the night before.
The report matters as much as the exploitation: a compromised but poorly documented machine may earn no points. Write reproducible steps with the commands, screenshots and required proofs. If you prepared a template and kept notes during the exam, writing takes a few hours, not a full day.
Mentally, OSCP+ also tests your endurance. Plan breaks, eat, and sleep a few hours if needed. Not passing on the first attempt is common and nothing to be ashamed of: review your notes, identify what blocked you and come back with a plan.
- A stable internet connection, ideally wired fibre or ADSL, with a 4G/5G backup tested in advance.
- A working webcam, a valid official ID, and a quiet, well-lit room.
- A computer with enough memory for Kali, plus a UPS or charged battery in case of a power cut.
- A careful read of OffSec's exam rules, especially the restrictions on Metasploit and automated tools.
- A tested report template, and a rest day planned afterwards for writing.
Preparing for OSCP+ with GATech coaching
PEN-200 is designed for self-study, and many candidates run out of steam alone. GATech offers a 10-day programme (80 hours of guided coaching) from 29,900 MAD, with PEN-200 lab access and one OSCP+ exam attempt included, in the classroom or live online. If you need to strengthen your foundations first, CEH v13 or CompTIA PenTest+ are sensible intermediate steps.
Several offers help reduce the cost: 10% off for early registration, 15% for groups of at least three participants from the same company, 15% for students and recent graduates, or three interest-free instalments for individuals (discounts cannot be combined). Contact our advisers to assess your level and set up your 12-week plan.
Frequently asked questions
Can you take the OSCP+ exam from Morocco?
Yes. The OSCP+ exam is taken entirely online under remote proctoring via webcam and screen sharing. You need a stable internet connection, a webcam, a valid ID and a quiet place. Check the time zone when you book your slot.
How many hours a week do you need to prepare for OSCP+?
For a 12-week plan, count on about 12 to 15 hours a week if you already have good Linux, networking and web foundations. With weaker foundations, expect 5 to 6 months at the same pace.
Do you need CEH before preparing for OSCP+?
No, it is not mandatory. But if your offensive foundations are still light, CEH v13 or CompTIA PenTest+ help you learn pentest methodology and vocabulary before tackling the more demanding PEN-200 labs.
What score do you need to pass OSCP+?
You need 70 out of 100 points. Points are earned by compromising the Active Directory set and the standalone machines, provided each access is documented with the required proofs in the report, submitted within 24 hours of the hands-on exam.
How much does coached OSCP+ preparation cost in Morocco?
At GATech, OSCP+ preparation starts at 29,900 MAD. The price includes 10 days of coaching (80 hours), PEN-200 lab access and one exam attempt. Discounts are available (early bird, group, student), as well as payment in three instalments.
GATech teaching team
Cybersecurity trainers and consultants preparing professionals in Morocco for CEH, OSCP+, CISSP, CompTIA and ISO 27001.
Published
