Prove You Can Compromise Real Cloud Environments
The OGOTC exam is an advanced, hands-on certification designed to validate real-world offensive operations in Google Cloud Platform (GCP).
Candidates are placed inside a live cloud environment and must enumerate, exploit, and operate under realistic constraints. Success requires chaining vulnerabilities, abusing identity relationships, and navigating complex cloud architectures.
This exam measures real capability, not theory.
Real Cloud Operations. Real Constraints.
The OGOTC exam simulates environments found in real organizations.
Students must:
- Identify exposed services and attack surface
- Analyze IAM relationships and service account permissions
- Exploit misconfigurations across multiple services
- Chain weaknesses to gain deeper access
- Adapt when initial attack paths fail
This is not a guided challenge. It reflects how real cloud environments are compromised.
Exam Objectives
The OGOTC exam evaluates your ability to operate within a GCP environment under real-world conditions.
Students should be able to:
- Enumerate GCP projects and IAM relationships
- Abuse service accounts and default agents
- Exploit metadata and credential exposure
- Attack GKE and Kubernetes workloads
- Move laterally between projects
- Escalate privileges through role misuse
- Establish persistence within cloud resources
- Chain multiple weaknesses to reach deeper access
The ultimate goal is to fully compromise the environment and reach the final objective.
Exam Overview
- 48 hour hands-on technical assessment
- 1 final flag to be captured
- Additional 48 hours to submit a professional report
This is a pass or fail exam based on reaching the final objective.
Starting the Exam
Students have full control over when they begin the exam.
- The exam can be started at any time
- No scheduled start time is required
- The process is fully automated
Once started:
- The 48 hour timer begins immediately
- There are no pauses, resets, or extensions
- The exam cannot be restarted
Students should only begin when fully prepared.
The OGOTC exam is conducted in a live GCP environment designed to reflect real enterprise cloud deployments.
Includes:
- Multiple interconnected cloud components
- IAM roles, service accounts, and identity relationships
- Compute, storage, and containerized workloads
- Production-like access boundaries and constraints
Students must discover and understand the environment through enumeration.
Each student receives an isolated environment.
This exam is based on real-world vulnerabilities, misconfigurations, and attack paths observed during cloud security engagements.
Students are exposed to:
- Real IAM abuse scenarios
- Service account and identity exploitation
- Cross-service trust relationships
- Multi-step attack chains across cloud resources
There are no simplified paths. This reflects how GCP environments are actually attacked.
To pass the OGOTC exam, students must:
- Successfully navigate and understand the environment
- Chain vulnerabilities and misconfigurations
- Achieve full compromise of the environment
- Capture the final flag
- Submit a complete professional report
This is a single-objective, pass or fail exam.
Students must submit:
- The final flag
- A professional report within 48 hours after the technical portion
Your report must clearly document:
- Step-by-step exploitation methodology
- Cloud misconfigurations identified and abused
- IAM and service account exploitation paths
- Data access and privilege escalation steps
- Commands, scripts, or tooling used
- Evidence of successful compromise and impact
- Screenshots supporting key milestones
- A clear explanation of the full attack chain
Reports must be structured, clear, and technically accurate.
Allowed Tooling and Restrictions
- Students may use any tools, scripts, or frameworks
- GCP CLI, APIs, and automation are allowed
- Custom scripting is encouraged
- Internet access for research is allowed
- Collaboration or sharing solutions is prohibited
Success depends on understanding cloud relationships, not just tooling.
Environment Management
- Students may restart components if needed
- The exam timer will continue running at all times
- Full environment resets are not permitted unless a verified issue occurs
Students are responsible for managing time and recovery.
Exam Expectations
This exam is intentionally advanced.
Students should expect:
- Limited visibility into the environment
- Multiple dead ends and false paths
- Complex identity relationships
- Chained exploitation across services
- Scenarios requiring research and adaptation
This reflects real-world cloud security assessments.
After Submission
- Submissions are manually reviewed by experienced operators
- Reviews typically take 5 to 10 business days
- Students are notified via email once results are finalized
Environment Stability
- The environment is monitored by White Knight Labs
- If a verified platform issue occurs, it will be investigated
- A free retest will be provided if necessary
- No resets or extensions are granted for user error
Retakes
- Retakes are available immediately
- No cooldown period
- Each attempt requires a new exam purchase
Not an Entry-Level Exam
The OGOTC exam is not beginner friendly.
Students should have experience with:
- Google Cloud Platform fundamentals
- IAM roles and service accounts
- Cloud security misconfigurations
- Offensive security techniques
Should You Take the OGOTC Exam
You should attempt this exam if:
- You understand GCP identity and access models
- You can analyze and chain cloud misconfigurations
- You are comfortable working in complex cloud environments
- You can document technical findings clearly
You should not attempt this exam if:
- You are new to cloud security
- You rely on single-step exploits
- You are not comfortable working across multiple services
Important Policies
- No extensions are granted once the exam has started
- The exam cannot be paused or restarted
- Exam vouchers are non-refundable
- All sales are final
Frequently Asked Questions (F.A.Q)
Is the OGOTC exam beginner friendly
- No. This is not an entry-level exam. OGOTC is designed for practitioners with experience in GCP, IAM concepts, and offensive security fundamentals.
Do I need to take the course before the exam
- No. You may purchase the exam-only option if you already have the required experience. However, the course is strongly recommended for most students.
When can I start the exam
- You can start the exam at any time.
- No scheduled start time is required
- The process is fully automated
- The timer begins immediately when the exam is launched
How long is the exam
- 48 hours for the technical assessment
- 48 additional hours to submit the report
What happens once I start the exam
- Once started:
- The timer begins immediately
- The exam cannot be paused or restarted
- No extensions are granted under any circumstances
- Students should only start when fully prepared.
What is required to pass
- To pass the exam, you must:
- Successfully navigate and understand the environment
- Chain vulnerabilities and misconfigurations
- Achieve full compromise
- Capture the final flag
- Submit a professional report
- This is a pass or fail exam.
What do I need to submit
- You must submit:
- The final flag
- A professional report documenting your full attack chain
What tools are allowed
- You may use any tools, scripts, or frameworks
- GCP CLI, APIs, and automation are allowed
- Custom scripting is encouraged
- Internet access for research is allowed
What cloud platform is used in the exam
- The exam is conducted in a live Google Cloud Platform environment.
- Students are expected to discover and understand the environment through enumeration.
What kind of environment should I expect
- Realistic GCP environment with multiple services
- IAM roles and service account relationships
- Interconnected resources and workloads
- Production-like constraints and permissions
- The environment is intentionally not fully disclosed.
Will I be given credentials or starting access
- Students will need to analyze the environment and determine their path forward.
- Understanding how to identify and leverage initial access is part of the assessment.
What does “full compromise” mean
- You must demonstrate meaningful control within the environment. This includes:
- Privilege escalation
- Access to restricted resources
- Lateral movement across services or projects
- Control over identities or workloads
- Simply identifying vulnerabilities is not sufficient.
How many flags are there
- There is one final flag.
- The objective is to fully compromise the environment and reach that final objective.
Can I reset or rebuild the environment
- You may restart components if needed
- The exam timer will continue running
- Full environment resets are not permitted unless a verified issue occurs
What if something breaks in the environment
- The environment is monitored by White Knight Labs
- If a verified platform issue occurs, it will be investigated
- A free retest will be provided if necessary
- No resets or extensions are granted for user error
Can I collaborate with others during the exam
- No. Collaboration, sharing solutions, or receiving outside assistance is strictly prohibited.
Can I retake the exam
- Yes.
- Retakes are available immediately
- No cooldown period
- Each attempt requires a new exam purchase
How long does it take to get results
- Reports are manually reviewed
- Reviews typically take 5 to 10 business days
- You will be notified via email once results are finalized
Are exam vouchers refundable
- No.
- Exam vouchers are non-refundable
- All sales are final
Is the exam environment shared
- No. Each student receives an isolated environment.
Do I need coding experience
- Basic scripting and command-line experience is expected. You should be comfortable using tools, modifying scripts, and working with cloud APIs.
What language is the exam conducted in
- The exam and all materials are provided in English.
Still Have Questions
If you have questions before attempting the exam, contact:
Ready to Attempt the OGOTC Exam
The OGOTC exam is designed for practitioners who want to prove they can operate in real GCP environments under real constraints.
There are no shortcuts. Only execution.
Train with Confidence
White Knight Labs trains professionals who operate in production environments, mature defensive stacks, and regulated organizations.
If your goal is real offensive capability, not just a certificate, our training is built for you.
Contact
Services & Company Inquiries:
Student Support
(Billing, Labs, Content, Vouchers, Tickets):
Copyright © 2026 White Knight Labs – All rights reserved