Skip to content

PNPT — Coverage Map

This page is Step 2 of the repo's how to prepare a certification method: the contract between you and the exam. For the PNPT the contract is an engagement, not a question bank: TCM Security describes what the assessment covers on the official PNPT page, and the exam is graded on the report and the live debrief. This map lists everything this hub teaches, grouped by the hub's five engagement phases, so you can line it up against TCM's own description and see what is covered, what is thin, and what is missing.

The rows are the section headings that exist in this hub's five phase pages — nothing more. TCM's own item numbering or wording is not reproduced here (the hub does not carry it, and this page will not invent it), so the first column is yours to fill.

How to fill it in:

  1. Open the official PNPT page (https://certifications.tcm-sec.com/pnpt/ — linked from what is PNPT) and note every area TCM says the exam covers; if the bundled training courses publish a syllabus, use that too (whether they do is not specified in this hub's sources). Write each item as TCM words it.
  2. Walk that list item by item. For each one, find the matching row below and write TCM's item in the first column. One item may span several rows, and one row may cover several items — record all of them.
  3. Any item with no matching row goes in the gaps table at the end, marked "gap", with a note on where you will learn it. The hub's own engagement scope table lists AV / egress bypass as its own phase; here it sits inside Phase 4 — check whether TCM treats it separately.
  4. Then score every row 0–3 (the scale is in Step 3 of the method). For an engagement-style exam, Practised? means done in your AD lab, from your own notes, and written up as a finding — not read.

TCM publishes no domain weights for the PNPT (not specified in sources); the phases below are the hub's teaching order, which follows the engagement workflow (see how the phases map to the exam).

How to use

  • Before studying: fill the first column and the self-score column; the zeros and ones are your syllabus. Phases 3 and 4 are where a sysadmin's AD knowledge pays off — and where the defender's mirror in the attack → defense matrix is most useful for the debrief.
  • During the study loop: after each phase page, revisit its rows — raise the score, tick Practised? only after the lab, and use Notes for the finding you wrote up.
  • Before booking: the readiness gate in the hub README needs the full workflow (external foothold → domain compromise) end-to-end in the lab, a report drafted and the debrief rehearsed twice; every row here should be at 2 or 3 first.
  • Where a row has a ↳, it is a subsection of the row above it; score it separately only if TCM's list treats it as its own item.
  • Rows link straight to the section, so this page doubles as the hub's fastest index.

Coverage map

Phase 1 — OSINT & reconnaissance

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ What OSINT is P1 → section __ ☐
____ What an attacker gathers P1 → section __ ☐
____ The attacker's external view P1 → section __ ☐
____ Tools by purpose P1 → section __ ☐
____ Defense — reducing what attackers can see P1 → section __ ☐

Phase 2 — External penetration testing

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ What external testing assesses P2 → section __ ☐
____ Finding and assessing internet-facing services P2 → section __ ☐
____ Password attacks against external services (concept) P2 → section __ ☐
____ Gaining an initial foothold P2 → section __ ☐
____ Defense — hardening the perimeter P2 → section __ ☐

Phase 3 — Active Directory exploitation

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Why AD is the target P3 → section __ ☐
____ AD enumeration P3 → section __ ☐
____ Credential-attack concepts P3 → section __ ☐
____ Domain Controller compromise (concept) P3 → section __ ☐
____ Defense — how PAM, tiering, and detection stop the chain P3 → section __ ☐

Phase 4 — Lateral movement & pivoting

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Three kinds of movement P4 → section __ ☐
____ Pivoting and tunneling (concept) P4 → section __ ☐
____ AV and egress bypass — how detection works (not how to evade) P4 → section __ ☐
____ Defense — containing movement P4 → section __ ☐

Phase 5 — Reporting & the debrief

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Why reporting is graded P5 → section __ ☐
____ Report structure P5 → section __ ☐
____ ↳ Findings and CVSS P5 → subsection __ ☐
____ The live debrief P5 → section __ ☐
____ ↳ Preparing for it P5 → subsection __ ☐
____ Defense angle P5 → section __ ☐

Cross-cutting exam skills

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ The 5-day assessment Exam structure __ ☐
____ The 2-day report Exam structure __ ☐
____ The live 15-minute debrief Exam structure __ ☐
____ Tooling and retake policy Exam structure __ ☐

Gaps you found

One row per official objective that has no matching row above. Decide where you will learn it (another page in this repo, the exam body's own material, a lab) and add that source to your plan.

Official objective What is missing Where you will learn it

Sources