Chiron Exams All exams Ask for access

All exams › TCM Security

PJPT practice examsIn development

Practical Junior Penetration Tester

TCM Security · beginner · 2 days of testing, then time to report

In developmentThis course is still being brought to our full standard. The questions and notes are usable, but they have not yet been checked line by line against the vendor’s own training.

A focused first practical exam on the internal Active Directory chain: Responder poisoning capturing NetNTLM hashes on a flat network as the model foothold, cracking or relaying where SMB signing is off, and domain enumeration where reading open shares reliably yields credentials; then Kerberoasting SPN accounts and AS-REP roasting accounts with pre-auth off, lateral movement on credential reuse through pass-the-hash and BloodHound path mapping, DCSync and a Golden Ticket marking full compromise, and a graded report with a clean documented path and per-finding remediation.

What you get

181practice questions
3full papers of 60
2course chapters · 12 minutes
100%answers explained

Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.

What the exam covers

The domains our question bank is built on. We have not yet transcribed this vendor’s own outline for this exam.

Foothold and the initial Active Directory attacksNot published
Domain compromise, lateral movement and reportingNot published

Two sample questions

Two of the 181, with the answer and the explanation.

1. What does mapping a path in BloodHound require first?

  1. Domain Admin privileges already fully achieved
  2. Directory data collected from the domain — correct
  3. The domain krbtgt account hash already extracted
  4. SMB signing already disabled on all of the hosts

Why: It analyses the collected relationships rather than attacking directly.

2. What tool captures poisoned hashes?

  1. Responder — correct
  2. BloodHound
  3. Mimikatz
  4. Nmap

Why: Responder captures the hashes from LLMNR/NBT-NS poisoning.

The real PJPT exam

Length2 days of testing, then time to report
QuestionsPractical: an internal Active Directory compromise plus a written report
Pass markDomain compromise and an acceptable professional report
Price$249 USD including one retake; the associated course is separate
Recommended before you sit itNone enforced. The TCM Active Directory course is recommended preparation.
Valid for3 years, then renewable through continuing activity

Exam facts as published by TCM Security; always check the vendor’s page before you book.

Study PJPT with Chiron

Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.