PJPT
Practical Junior Penetration Tester (PJPT)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Practical Junior Penetration Tester (PJPT) is an entry-level, hands-on certification from TCM Security that assesses whether you can perform an internal network penetration test at an associate level. Unlike a capture-the-flag event, the exam contains no flags to capture and no multiple-choice questions: you are dropped into a realistic Active Directory environment and expected to act like a consultant. To pass, you must use Active Directory exploitation skills to move laterally and vertically through the network and ultimately compromise the exam Domain Controller, then submit a detailed, professionally written report. Candidates get two full days for the assessment and an additional two days to write the report. The exam is aimed at aspiring junior penetration testers, internal pentesters, and security consultants, and is the first step in the Enterprise Penetration Testing learning path leading to the PNPT. Previous penetration testing experience is not required, though basic knowledge of computers and networks is advised. Preparation centers on the Practical Ethical Hacking course, which is included with the voucher (12 months of access, 20+ hours) and covers reconnaissance, scanning and enumeration, exploitation basics, Active Directory, web application, and wireless attacks, plus legal documentation and report writing. All tools are permitted, including AI-enabled tools, provided you disclose their use in your report.
What you'll study
About PJPT preparation
What is the PJPT exam format?
It is a hands-on internal Active Directory penetration test, not a CTF. There are absolutely zero flags to capture and no multiple-choice questions. You must compromise the exam Domain Controller through lateral and vertical movement and then submit a detailed, professionally written report.
How long do I have to complete the exam and report?
The exam environment permits two full days to complete the assessment, and you have an additional two days to write and submit your professional report. You can finish the engagement objectives ahead of time and use the remaining time for documentation.
How difficult is the PJPT?
TCM Security states difficulty varies by candidate. Beginners should expect a challenge and are strongly advised to work through the included Practical Ethical Hacking course first. For a junior penetration tester, the exam is described as low to moderate difficulty.
What happens if I fail my first attempt?
Every exam voucher includes one free retake, because TCM Security states it does not want to profit on failure. Your voucher remains valid for 12 months from the purchase date, and training access also runs for 12 months from purchase.
Is the included training enough to pass?
Yes. TCM Security states the exam was built from the Practical Ethical Hacking course material and designed so students can pass with that training. It covers reconnaissance, scanning and enumeration, exploitation basics, Active Directory, web apps, wireless, and reporting.
Can I use any tools during the exam?
Yes. The exam is a penetration test and all tools are allowed, including AI-enabled tools. However, you must disclose in your report how you used those tools, so keep notes as you work through the environment.
Is the exam proctored or does it require monitoring software?
No. There is no proctor and no intrusive software to install on your machine. TCM Security does monitor network traffic in the exam environment and maintains detection mechanisms for cheating, so treat the engagement as a professional assessment.
Does the PJPT expire, and how much does it cost?
The certification does not expire. The exam costs $249 and includes 12 months of access to the Practical Ethical Hacking course at no additional cost. Military, veterans, students, teachers, and first responders can request a 20% discount with proof of status.
How should I prepare for the PJPT?
Work through the included Practical Ethical Hacking course in order, paying particular attention to Active Directory exploitation and report writing. Practice chaining enumeration into credential access and lateral movement in a lab, and rehearse writing clear findings, since the report is a required deliverable.
Who is eligible to take the PJPT?
Any individual from any country is eligible. Candidates under 18 must submit a Parental Consent Form before purchasing the voucher, and certifications are limited to students age 18 and older unless that consent is provided.