Skip to content

Index

# 🟣 PNPT — Study Hub ### A source-grounded study hub for the **TCM Security PNPT** *Engagement workflow, real diagrams, and exam prep* — a **fully practical** network penetration test: OSINT → external → Active Directory → report → a **live debrief**. ![Provider](https://img.shields.io/badge/provider-TCM%20Security-red) ![Exam](https://img.shields.io/badge/exam-5--day%20%2B%20report%20%2B%20debrief-1f6feb) ![Style](https://img.shields.io/badge/style-no%20flags%20·%20no%20MCQ-blue) ![Diagrams](https://img.shields.io/badge/diagrams-Mermaid-ff3670) ![Use](https://img.shields.io/badge/use-educational%20%26%20authorized%20only-orange)

[!WARNING] Educational & authorized use only. Offensive techniques are explained conceptually for understanding, methodology, and defense — no weaponized step-by-step playbooks or exploit code. Use them only against systems you own or are explicitly authorized in writing to test. See the CEH hub's legal & ethics.

[!NOTE] Unofficial & no fabrication. Not affiliated with or endorsed by TCM Security. Exam specifics are from TCM's official PNPT page; volatile items (price, exact structure, voucher terms) should be re-checked there. Compiled 2026-06-21.

📋 At a glance

Item Detail
Provider TCM Security · vendor-neutral
Exam 5-day practical assessment + 2-day report + a live 15-minute debrief
Style Fully practical — no multiple choice, no capture-the-flag flags
Signature The live debrief: present & defend your methodology like a consultant
Included 1 attempt + 1 free retake, bundled training; non-expiring (verify on TCM)

Full details: exam structure.

📦 What's inside

Section Contents
Overview What is PNPT · Exam structure
Engagement phases The PNPT workflow, phase by phase
Exam prep Study plan — lab build, workflow practice, the debrief

The engagement phases

# Phase Page
1 OSINT & reconnaissance 01-osint-and-reconnaissance.md
2 External penetration testing 02-external-penetration-testing.md
3 Active Directory exploitation 03-active-directory-exploitation.md
4 Lateral movement & pivoting 04-lateral-movement-and-pivoting.md
5 Reporting & the debrief 05-reporting-and-the-debrief.md

🧭 Where it fits

The PNPT is the budget-friendly, engagement-style practical cert:

  • A realistic lead-in or alternative to OSCP; more report- and consultant-focused than the knowledge-based CEH.
  • Defender's mirror → its AD-compromise and lateral-movement focus is exactly what the attack → defense matrix and WALLIX / PAM hub exist to prevent and audit.

PNPT, PJPT and TCM Security are trademarks of TCM Security, used here for identification and educational purposes only.