CPTE: Penetration Testing

Penetration Testing

The CPTE Penetration Testing domain tests whether you can plan and execute an authorized assessment, validate findings without causing avoidable harm, and report evidence that a client can act on. The exam favors scope discipline and methodology over tool trivia.

Core rules

• Authorization comes first. A signed rules-of-engagement document defines targets, excluded hosts, testing window, source IPs, emergency contact, data-handling rules, and permission to pivot. Without it, the activity is unauthorized access.
• Follow a repeatable lifecycle: scoping, passive reconnaissance, active scanning, enumeration, vulnerability validation, controlled exploitation, limited post-exploitation, cleanup, reporting, and retest.
• Prove impact with the least intrusive action. A single benign command or screenshot is usually enough; do not dump production data or launch denial-of-service tests unless explicitly scoped.
• Keep an activity log with timestamps, commands, source addresses, outputs, and hashes of evidence. Findings need reproduction steps and a risk rationale.

Worked example

You are authorized to test 10.20.0.0/24 from a specified VPN address. During SMB enumeration you recover a local administrator hash that also works on a file server in 10.30.0.0/24, which is out of scope. Correct reasoning: stop before authenticating to the out-of-scope host, record the observation, notify the emergency contact, and request a written scope change. Using the hash would be unauthorized access even if it proves a real risk.

Traps

Calling a vulnerability scan a penetration test; testing excluded hosts because they are reachable; using destructive exploits to be certain; pivoting before approval; omitting cleanup; and reporting a tool severity without business context or evidence.