PNPT study guide
PNPT · Work through your exam, one topic at a time.
The Practical Network Penetration Tester (PNPT) is a hands-on certification from TCM Security that assesses a candidate's ability to perform an external and internal network penetration test at a professional level. Unlike multiple-choice exams, the PNPT requires you to conduct a realistic pentest over five full days, followed by two days to write a professional report. The PNPT study guide has 5 sections and about 1,546 words.
01Open-Source Intelligence (OSINT) Reconnaissance
The OSINT domain tests whether you can convert public data into an actionable, in-scope attack surface for the PNPT scenario. Expect to enumerate domains, subdomains, email format, employee usernames, exposed services, and leaked credentials, then correlate them into a target list and a credential-spraying candidate list.
300 words, about 2 min02Active Directory Exploitation: A/V and Egress Bypassing, Lateral and Vertical Movement, Domain Controller Compromise
This domain tests the full AD kill chain after an initial foothold: evading antivirus and egress controls, moving laterally and vertically, and compromising the Domain Controller. The exam cares less about a single tool and more about a defensible path from a low-privileged user to domain dominance.
352 words, about 2 min03External Network Penetration Testing
The external domain tests your ability to assess the internet-facing perimeter: discovery, scanning, service enumeration, web application testing, exploitation, and initial access. The exam expects a methodical outside-in approach that mirrors a real attacker without damaging production.
294 words, about 1 min04Internal Network Penetration Testing
The internal domain tests what you do after the external foothold: host enumeration, privilege escalation, credential harvesting, lateral movement, and Active Directory discovery from inside the network. The examiner wants a clean pivot from a compromised host to meaningful business impact.
304 words, about 2 min05Professional Reporting and Live Debrief
This domain tests whether you can turn technical work into a client-ready deliverable and defend it in a live debrief. The exam expects a clear report structure, accurate risk ratings, reproducible evidence, and remediation guidance that a mixed technical and executive audience can act on.
296 words, about 1 min