CPTE study plan
CPTE · Give each week a clear focus.
8 weeks · About 6 hours per week
Penetration Testing
Map the penetration testing methodology phases (scoping, reconnaissance, exploitation, post-exploitation, reporting) to a written checklist you will reuse in later weeks.
Set up an isolated lab (at least one attacker VM and two target VMs) and verify network segmentation so no traffic reaches production or the internet.
Practice passive and active reconnaissance against a lab target using DNS enumeration, service banner grabbing, and a port scan, and record every command with its output.
Write a one-page scoping and rules-of-engagement template covering authorization, target ranges, time windows, and emergency contacts.
Your checkpoint
A lab build log plus a completed rules-of-engagement template and reconnaissance command journal for one lab target.
Penetration Testing
Identify and safely exercise at least three common vulnerability classes (for example injection, broken access control, and misconfiguration) against lab targets.
Select and justify a scanning tool for each of the three vulnerability classes, documenting false-positive triage steps.
Draft remediation advice for each finding that names the root cause, not just the symptom.
Rank findings by likelihood and impact using a documented scoring rationale.
Your checkpoint
A findings register with at least five entries, each containing evidence, severity rationale, and a remediation recommendation.
Penetration Testing
Execute a controlled privilege-escalation exercise on a lab host and capture the exact commands and resulting privileges.
Document three post-exploitation activities (for example credential access, lateral movement, and persistence) and the defensive control that would detect each one.
Convert your week 2 findings register into a client-style report with an executive summary and a technical section.
Rehearse a 10-minute verbal debrief of the report to a non-technical stakeholder.
Your checkpoint
A complete penetration test report for the lab environment, including executive summary, technical findings, and remediation roadmap.
Disaster Recovery
Define recovery time objective and recovery point objective for three fictional business services and justify each number.
Compare full, incremental, and differential backup strategies and select one per service with a written rationale.
Build a backup and restore runbook for one lab service, including verification steps after restore.
Perform an actual restore of the lab service and measure elapsed time against the stated recovery time objective.
Your checkpoint
A backup strategy document plus a timed restore test record showing measured recovery time versus the recovery time objective.
Disaster Recovery
Draft a business impact analysis outline that identifies critical processes, dependencies, and maximum tolerable downtime.
Classify at least five disaster scenarios (for example ransomware, site loss, and cloud region outage) by likelihood and impact.
Write the decision criteria and communication chain for declaring a disaster and invoking the plan.
Identify single points of failure in the lab architecture and propose one mitigation for each.
Your checkpoint
A disaster recovery plan outline covering business impact analysis summary, scenario matrix, declaration criteria, and communication tree.
Incident Handling
Sequence the incident response lifecycle phases and list the entry and exit criteria for each phase.
Build an incident severity matrix with at least four severity levels and the escalation trigger for each.
Write containment, eradication, and recovery playbooks for one scenario such as a compromised endpoint.
Prepare an evidence-handling checklist covering chain of custody, hashing, and storage.
Your checkpoint
An incident response playbook for one scenario, including severity matrix, phase checkpoints, and evidence-handling checklist.
Incident Handling & Network Forensics
Run a tabletop exercise for a simulated incident and log every decision, gap, and owner.
Capture and preserve at least three evidence sources (for example host memory, disk image, and network capture) and verify integrity with hashes.
Analyze a packet capture to reconstruct one session and identify the protocol, endpoints, and payload characteristics.
Correlate host artifacts with network evidence to build a timeline of the simulated incident.
Your checkpoint
A tabletop after-action report plus an evidence log with hashes and a reconstructed incident timeline based on correlated host and network artifacts.
Network Forensics & Penetration Testing & Disaster Recovery & Incident Handling
Perform a forensic review of at least two log sources and document indicators of compromise with timestamps in a consistent time zone.
Write an expert-witness-style summary that states findings, methodology, and limitations without overstating certainty.
Complete a timed 60-question mixed-domain practice set and review every missed item to its source concept.
Consolidate weak areas into a one-page personal review sheet and schedule two follow-up review sessions.
Your checkpoint
A forensic findings summary with indicators of compromise and a scored practice-set review log listing every missed concept and its corrective reference.
Milestones
Week 2: You can demonstrate a repeatable reconnaissance-to-finding workflow in the lab and explain why each finding is a true positive.
Week 4: You have restored a service from backup within a measured time and can state your recovery time objective and recovery point objective choices with justification.
Week 6: You can walk through the incident response lifecycle for a scenario and show where evidence handling begins and ends.
Week 8: You have correlated host and network evidence into a defensible timeline and scored at least 80 percent on the mixed-domain practice set with every miss reviewed.