eJPT study guide
eJPT · Work through your exam, one topic at a time.
The INE Security Junior Penetration Tester (eJPT) is a hands-on, entry-level Red Team certification that INE Security describes as validating the knowledge, skills and abilities required to work as a junior penetration tester. It is built for people with little to no cybersecurity experience - systems administrators, IT project managers, information security officers, security engineers and analysts, developers, and staff at MSPs and MSSPs - and is positioned as the entry point to INE's Red Team certification path toward the eCPPT. The eJPT study guide has 4 sections and about 1,340 words.
01Host and Network Penetration Testing
Host and network testing follows a repeatable chain: passive and active reconnaissance, port and service scanning, enumeration of users/shares/services, exploitation, privilege escalation, lateral movement or pivoting, and post-exploitation cleanup. Know how Nmap states work (open, closed, filtered) and why a filtered result usually means a firewall dropped the probe rather than that no host exists.
351 words, about 2 min02Assessment Methodologies
Methodology questions test whether you understand the business and legal wrapper around technical work. Before any packet is sent, scope, rules of engagement, testing windows, authorized targets, and escalation contacts must be agreed in writing.
321 words, about 2 min03Host and Networking Auditing
Auditing compares a system's actual configuration against a defined baseline or standard, without necessarily exploiting it. Typical work includes reviewing local users and groups, password and lockout policy, file and share permissions, installed software and patch levels, running services, scheduled tasks, logging and retention settings, firewall rules, and network device configurations.
338 words, about 2 min04Web Application Penetration Testing
Web testing starts with understanding HTTP: methods, status codes, headers, cookies, and how state is maintained. Map the application manually and with a proxy such as Burp Suite or ZAP, then enumerate directories, parameters, hidden fields, API endpoints, and authentication flows.
330 words, about 2 min