CAP-PL ENS study plan
CAP-PL ENS · Give each week a clear focus.
8 weeks · About 7 hours per week
Pentesting Exams
Map the full Domain 1 exam blueprint into a one-page checklist of every objective you must be able to demonstrate
Set up an isolated lab (target VMs, attacker VM, snapshot baseline) and verify network isolation before any scanning
Execute host discovery and service enumeration against two lab targets and record raw command output with timestamps
Write a findings note for each open port that states the service, version, and one plausible attack path
Your checkpoint
A lab build log plus an enumeration report covering two targets with at least 10 documented services and attack-path notes
Pentesting Exams
Exploit at least three distinct vulnerability classes in the lab and capture proof-of-access for each
Perform privilege escalation on both a Linux and a Windows target and document the exact escalation vector
Practise credentialed vs uncredentialed scanning and explain in writing how results diverge
Draft remediation language for every finding you produced so far
Your checkpoint
A penetration test report draft with three exploited findings, each containing evidence, impact, and a remediation recommendation
Pentesting Exams
Conduct a web application assessment covering authentication, session handling, and input validation weaknesses
Test at least two password attack scenarios and record lockout behaviour and detection signals
Simulate lateral movement across the lab from one compromised host to a second
Clean up artefacts, revert snapshots, and confirm the lab returns to baseline
Your checkpoint
A web and credential attack log with screenshots of evidence, plus a completed cleanup checklist signed off against the baseline snapshot
Pentesting Exams & Pentesting and Advisory
Complete a timed full-scope practice engagement end to end within a fixed time budget
Convert raw notes into an executive summary of no more than one page
Identify every Domain 1 objective you still cannot perform without notes and rank them by risk
Write three client-facing questions you would ask before scoping a real engagement
Your checkpoint
A complete mock engagement package: executive summary, technical findings, and a ranked list of remaining Domain 1 gaps
Pentesting and Advisory
Draft a rules-of-engagement and scoping document for a fictional client with explicit in-scope and out-of-scope assets
Build a risk register that rates each finding by likelihood and business impact
Rewrite two technical findings for a non-technical executive audience
Define escalation criteria for when testing must pause and the client must be contacted
Your checkpoint
A scoping and rules-of-engagement pack plus a risk register covering at least eight findings
Pentesting and Advisory
Produce a prioritized remediation roadmap that sequences fixes by risk and effort
Write a retest plan with pass/fail criteria for each high-severity finding
Draft a breach or incident notification summary appropriate for a client's legal and compliance stakeholders
Assess two findings against common regulatory or contractual obligations and cite the specific requirement
Your checkpoint
A remediation roadmap and retest plan with explicit acceptance criteria for every high-severity item
Pentesting and Advisory & Pentesting Exams
Deliver a 15-minute verbal briefing of a mock report and handle three likely client objections
Review your Domain 1 gap list and close the two highest-risk items with hands-on repetition
Peer-review a sample report and mark every place where evidence does not support the stated impact
Confirm your reporting template covers scope, methodology, findings, impact, and remediation
Your checkpoint
A recorded or written briefing outline plus a revised report template that passes your own evidence check
Pentesting Exams & Pentesting and Advisory
Run two full timed practice exams and log every missed objective with the reason for the miss
Re-drill every logged miss until you can explain the correct approach without reference material
Rehearse the advisory workflow once more from scoping through retest in under four hours
Finalize a one-page pre-exam checklist of commands, report sections, and time allocations
Your checkpoint
A scored practice-exam log showing improvement across both attempts and a finalized one-page exam-day checklist
Milestones
Week 2: You can exploit and document at least three vulnerability classes unaided, and every finding already has remediation text attached
Week 4: You have completed one timed end-to-end mock engagement and produced both an executive summary and a technical findings section
Week 6: You can convert any finding into a risk rating, a remediation step, and a retest criterion without referring to a template
Week 8: Both timed practice exams are complete, every missed objective is logged and re-drilled, and no Domain 1 or Domain 2 objective remains on your gap list