OpenExamsFREE PRACTICE — ANY EXAM

OffSec Incident Responder (OSIR) — Requirements & Free Practice

US · License preparation

100 free questions · Answer explanations · No signup required

Loading selected examination banks…

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

OffSec Incident Responder (OSIR)

OffSec certification validating foundational incident response practices, awarded on passing its OSIR examination; the individual certification expires three years after passing.

Licensing authority: OffSec

Initial by examination
OffSec Incident Responder (OSIR)
Assessment
Both phases are parts of one English remotely proctored practical examination, with exercise answers and a professional report jointly scored; minimum 50 points is required.
Attempt validity
Bundle attempts expire 120 days after lab access ends; subscription attempts expire with the subscription. These individual entitlements are not the exam-version retirement date.
Prior qualifications
IR-200 itself has no formal prerequisites; TCP/IP networking, Windows/Linux familiarity and basic cybersecurity knowledge are recommendations rather than additional exam leaves.
Purchase confirmation
The public registration form requires the purchaser to confirm being over 18 and personally using the service.
Renewal boundary
Only initial_by_examination is investigated; certification maintenance and renewal examinations are outside this task.
Report
Submit within 24 hours after the exam, or fail automatically; preserve SIEM screenshots and queries, attacker timeline, disk-image/malware investigation steps, screenshots, tools and commands. Submit a PDF inside an unencrypted 7z archive, at most 100 MB, using required OSIR/OSID filenames. Report submission is final.
Training
Foundational Incident Response (IR-200) is the associated prerequisite course; new OSIR candidates enroll in corresponding training rather than purchasing a standalone initial exam. Course access must have commenced and the candidate must hold a valid OSIR attempt before scheduling.

OffSec Incident Responder (OSIR)

Provider
OffSec
Format
English, remotely proctored hands-on incident response exercise questions; correct answers and a professional report jointly determine partial or full credit. One examination with two phases and one result.
Time limit
8 hours for the exam, followed by 24 hours to submit the required report.
Passing score
Minimum 50 points; Phase 1 offers up to 40 points and Phase 2 up to 30 points.
Examination outline
  • Phase 1: Incident Detection and Identification (66.67%)
  • Phase 2: Disk Image Analysis and Malware Analysis (33.33%)
Examination sources