CPTS practice examsIn development
HTB Certified Penetration Testing Specialist
A practical penetration test rated harder than several better-known exams: exhaustive external and internal enumeration where a shallow scan is the usual cause of failure, the full web attack surface from injection to SSRF, credentials found in files and shares rather than cracked, and password spraying to avoid lockout; then systematic Linux and Windows privilege escalation, Active Directory from a first credential to the domain through BloodHound, Kerberoasting, ACL and delegation abuse, pivoting through segmented networks, and a graded commercial-grade report that a technically successful test can still fail on.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Enumeration, web attacks and initial access | Not published |
| Escalation, Active Directory, pivoting and reporting | Not published |
Two sample questions
1. Why perform a full port scan on each host?
- To avoid missing services on unusual ports — correct
- To speed the test when in use
- To skip enumeration as configured for this environment
- To close ports for this instance
Why: Full scans avoid missing services on non-standard ports.
2. What does checking sudo rights reveal on Linux?
- Commands a user may run as root — correct
- The kernel version in this setup
- The DNS server by default
- The web root in practice
Why: Sudo rights can allow privilege escalation.
The real CPTS exam
| Length | 10 days |
|---|---|
| Questions | Practical: a live network scored out of 100 points plus a graded report |
| Pass mark | At least 85 of 100 points and an acceptable commercial-grade penetration test report |
| Price | $210 USD for the exam voucher; the academy path is a separate subscription |
| Recommended before you sit it | Full completion of the penetration tester path in the HTB Academy. |
| Valid for | Does not expire |
Exam facts as published by Hack The Box; always check the vendor’s page before you book.
Study CPTS with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.