PNPT practice examsIn development
Practical Network Penetration Tester
A realistic five-day engagement with a report and a live debrief: OSINT weighted heavily and often yielding reused credentials from breach data, an external footprint mapped and password spraying turning usernames into a foothold; then an Active Directory compromise through Responder poisoning, SMB relay, Kerberoasting and BloodHound path mapping, post-exploitation reusing every credential toward domain control, a report a client would accept, and a live debrief that proves the candidate can explain why each step worked and how to remediate it.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| OSINT, external testing and initial access | Not published |
| Active Directory, reporting and the debrief | Not published |
Two sample questions
1. Why is credential reuse the most impactful thing to remediate?
- It stops name resolution poisoning at source as it happens
- It prevents the krbtgt hash being extracted
- It removes all service principal names
- It breaks the lateral movement the chain relies on — correct
Why: Unique credentials stop one capture becoming many compromises.
2. What is a username format?
- A pattern — correct
- A password
- A hash
- A ticket
Why: A username format is the naming pattern the organisation uses for accounts.
The real PNPT exam
| Length | 5 days of testing, then 2 days to report, then a scheduled debrief |
|---|---|
| Questions | Practical: a full engagement, a written report, and a live debrief |
| Pass mark | Domain compromise, an acceptable professional report, and a passing debrief |
| Price | $399 USD including one retake; the associated courses are separate |
| Recommended before you sit it | None enforced. The TCM course path is recommended preparation. |
| Valid for | 3 years, then renewable through continuing activity |
Exam facts as published by TCM Security; always check the vendor’s page before you book.
Study PNPT with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.