PNPT case studies
PNPT · Put your knowledge to work in context.
The Practical Network Penetration Tester (PNPT) is a hands-on certification from TCM Security that assesses a candidate's ability to perform an external and internal network penetration test at a professional level. Unlike multiple-choice exams, the PNPT requires you to conduct a realistic pentest over five full days, followed by two days to write a professional report. The PNPT case studies are 5 cases and about 3,466 words.
1OSINT Scoping for a Pre-Engagement Red Team
Northwind Logistics, a 1,200-employee freight company, has asked for a five-day OSINT-only assessment before a red team engagement. Scope: three primary domains (northwindlogistics.com, nwl-freight.com, northwind-coldchain.com), 14 subsidiary brands, and public GitHub/LinkedIn presence.
750 words, about 4 min2Choosing an AD Path Under EDR and a Change Freeze
Meridian Health, a 2,500-user hospital group, has a single Active Directory forest with five domain controllers and CrowdStrike EDR on all servers and workstations. You have a foothold as low-privilege domain user 'helpdesk1' on a workstation.
806 words, about 4 min3Outdated VPN Appliance and a Crash Risk
Cobalt Finance, a 900-employee fintech, has commissioned an external penetration test of three public /24 ranges containing 42 live hosts. Scope includes the customer-facing API and an SSL VPN portal used by 800 remote workers.
631 words, about 3 min4Segmented VLAN and a Poisoning Dead End
Aster Manufacturing has 1,000 hosts across six internal VLANs. The engagement covers VLAN 10 (corporate), VLAN 20 (office), VLAN 30 (engineering), and VLAN 40 (file servers); VLAN 50 is the OT network and is explicitly excluded.
646 words, about 3 min5Debrief Pushback on a Critical AD Finding
You are leading the final debrief for Summit Retail after a two-week internal and external penetration test. The report contains two critical findings: an Active Directory ACL misconfiguration that lets a low-privilege user reach Domain Admin through a service account with constrained delegation, and a public S3 bucket containing 12,000 objects whose sample records include customer name, email, and order ID.
633 words, about 3 min