eJPT
INE Security Junior Penetration Tester (eJPT)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The INE Security Junior Penetration Tester (eJPT) is a hands-on, entry-level Red Team certification that INE Security describes as validating the knowledge, skills and abilities required to work as a junior penetration tester. It is built for people with little to no cybersecurity experience - systems administrators, IT project managers, information security officers, security engineers and analysts, developers, and staff at MSPs and MSSPs - and is positioned as the entry point to INE's Red Team certification path toward the eCPPT.
The exam is scenario-based rather than multiple-choice, and its objectives are weighted across four domains: Host and Network Penetration Testing (35%), Assessment Methodologies (25%), Host and Networking Auditing (25%), and Web Application Penetration Testing (15%). Objectives span host and service discovery, public-source company, email and technical reconnaissance, vulnerability identification, exploit modification and Metasploit exploitation, pivoting via route addition and port forwarding, brute-force and hash cracking, on-target file, account and network enumeration, file transfer, and web application recon, hidden directory discovery and brute-force login attacks.
Results are auto-graded and typically delivered within a few hours, with a score report breaking down performance by section. Preparation should be lab-based: INE sells prep bundles and subscriptions that include an exam voucher, and the practical objectives are only learnable by doing them on real targets.
What you'll study
About eJPT preparation
Is the eJPT a multiple-choice exam?
No. It is a hands-on, scenario-based certification that INE says simulates real-world engagements, assessing practical skills in assessment methodologies, host and network auditing, host and network penetration testing, and web application penetration testing. You are expected to actually enumerate, exploit and pivot rather than recall definitions.
How are results delivered and graded?
INE states that exam results are auto-graded and typically delivered within a few hours. The score report includes performance breakdowns across each section so you can see your strengths and the areas needing improvement. No human grader reviews it, unlike INE's hand-graded eCPPT.
What are the domain weights?
Host and Network Penetration Testing is 35%, Assessment Methodologies is 25%, Host and Networking Auditing is 25%, and Web Application Penetration Testing is 15%. The two 25% domains together outweigh the flag-ship exploitation domain, so information gathering and on-target enumeration deserve real lab time.
How long is my voucher valid, and what if I fail?
Regular vouchers expire 180 days after purchase. You must take the exam inside that window, and if you do not pass, complete the included free retake within 14 days. Both attempts must be submitted before the expiration date, which is always shown in your Certifications Dashboard.
How long does the certification last?
Three years from the date it is issued. After that you maintain the credential through INE's renewal options, so it is worth planning continuing education or a follow-on certification such as the eCPPT before your three years run out.
Is there a published passing score or exam duration?
INE's certification page does not publish a passing threshold or a fixed exam length; it only says to follow the exam instructions and complete the exam within the allotted time. Confirm the specifics shown in your certification dashboard and exam instructions once your voucher is issued.
Do I need an INE subscription as well as a voucher?
Yes. INE states that to take the eJPT you need both an INE subscription and an exam voucher. The INE Fundamentals annual plan and the eJPT + Prep bundle include a voucher, and existing Premium subscribers can buy the voucher separately or receive a free voucher on one INE Security certification exam.
In what order should I study the objectives?
Start with Assessment Methodologies - endpoint discovery, port and service identification, OS fingerprinting, and public-source company, email and technical reconnaissance - because every later phase depends on it. Then drill exploitation and pivoting, add on-target auditing, and finish with web recon and login attacks, which carry the smallest weight.
What most often derails candidates?
Thin enumeration and weak notes. Objectives explicitly include discovering endpoints, identifying services, gathering OSINT and compiling information from files on target, so rushing to exploitation before the target is fully mapped leaves sections unscored. Practise pivoting by route addition and port forwarding, and brute-force and hash cracking, until they are routine.
Where does the eJPT fit in INE's certification path?
INE presents it as the entry point to its Red Team certifications. Successful candidates are expected to continue with the Certified Professional Penetration Tester (eCPPT), which involves in-depth penetration testing of a simulated real-world scenario and is hand-graded by a security professional.