PJPT study guide
PJPT · Work through your exam, one topic at a time.
The Practical Junior Penetration Tester (PJPT) is an entry-level, hands-on certification from TCM Security that assesses whether you can perform an internal network penetration test at an associate level. Unlike a capture-the-flag event, the exam contains no flags to capture and no multiple-choice questions: you are dropped into a realistic Active Directory environment and expected to act like a consultant. The PJPT study guide has 7 sections and about 2,034 words.
01Reconnaissance and Information Gathering
Reconnaissance on the PJPT is judged by whether you can build a reliable picture of an Active Directory estate before touching an exploit. The exam expects passive collection first, then low-noise active queries, with every source and timestamp recorded.
336 words, about 2 min02Scanning and Enumeration
Scanning and enumeration is where you turn a list of IPs into attack paths. The exam tests service discovery, version detection, SMB/LDAP/Kerberos enumeration, and the discipline to separate open ports from exploitable weaknesses.
289 words, about 1 min03Exploitation Basics
Exploitation basics covers validating a weakness and gaining an initial foothold without destabilizing the target. The exam rewards controlled exploitation, correct payload configuration, and clear evidence that the vulnerability was real.
294 words, about 1 min04Active Directory Penetration Testing
Active Directory penetration testing is the core of PJPT. The exam tests enumeration of domain objects, credential attacks, lateral movement, and privilege escalation to Domain Admin, with an emphasis on attack paths you can explain and reproduce.
283 words, about 1 min05Web Application Penetration Testing
Web application penetration testing on PJPT is usually a path to credentials or a foothold rather than a standalone bug hunt. The exam tests methodical mapping of an application, authentication testing, input handling, and access control checks.
280 words, about 1 min06Wireless Attacks
Wireless attacks test whether you can capture and crack WPA/WPA2 material and explain the conditions that make an attack possible. The exam expects legal scope awareness because wireless testing can easily affect third-party networks.
268 words, about 1 min07Legal Documentation and Report Writing
Legal documentation and report writing tests whether you can turn technical work into a defensible deliverable. The exam expects authorization checks, scope discipline, evidence handling, and a report that both executives and technicians can act on.
284 words, about 1 min