CPTE study guide
CPTE · Work through your exam, one topic at a time.
The Certified Penetration Testing Engineer (CPTE®) is one of the certifications offered by Mile2 Cybersecurity Institute, a U.S.-based training and certification provider headquartered in Tampa, Florida. Mile2 describes itself as partnering with corporations, governments, and universities in more than 150 countries, and it positions its certifications - including the CPTE alongside the CISSO, CDFE, CAICSO, and C)CSO - as hands-on, job-ready credentials. An accredited variant, C)PTE-A: Certified Penetration Testing Engineer Accredited, appears in Mile2's ANAB Accredited Certifications listing. The source also announces a new "C)PTE 2026 Certified Penetration Testing Engineer," but gives no blueprint details for it. Topics on this exam: Penetration Testing, Disaster Recovery, Incident Handling, and Network Forensics. The CPTE study guide has 4 sections and about 1,343 words.
01Penetration Testing
The CPTE Penetration Testing domain tests whether you can plan and execute an authorized assessment, validate findings without causing avoidable harm, and report evidence that a client can act on. The exam favors scope discipline and methodology over tool trivia. Authorization comes first. A signed rules-of-engagement document defines targets, excluded hosts, testing window, source IPs, emergency contact, data-handling rules, and permission to pivot.
302 words, about 2 min02Disaster Recovery
The Disaster Recovery domain tests how you keep critical services and data available after a disruption. Expect questions on business impact analysis (BIA), recovery objectives, backup design, alternate-site strategies, plan roles, and exercise results. The BIA identifies critical processes, dependencies, and maximum tolerable downtime (MTD). DR derives recovery time objective (RTO), the target time to restore service, and recovery point objective (RPO), the maximum acceptable data loss measured in time.
360 words, about 2 min03Incident Handling
The Incident Handling domain tests your ability to move an incident from detection to closure using a documented lifecycle, sound containment decisions, and defensible evidence. Expect preparation, triage, containment, eradication, recovery, communication, and lessons learned. Preparation builds authority and capability before an event: policy, playbooks, contact trees, logging, forensic tooling, out-of-band communications, and pre-approved containment actions. Detection and analysis validate the alert, determine scope and timeline, identify affected accounts and data, and preserve volatile evidence before making changes when feasible.
327 words, about 2 min04Network Forensics
The Network Forensics domain tests reconstruction of network activity from packet captures, flow records, and device logs, with evidence handling that survives scrutiny. Expect capture placement, timestamps, protocol analysis, NAT and DHCP correlation, and reporting. Know your evidence sources: full packet capture (PCAP), NetFlow/IPFIX, firewall, proxy, DNS, DHCP, VPN, IDS, and authentication logs. Flows show who talked to whom and when; PCAP shows content and protocol detail.
354 words, about 2 min