100+ Free PNPT Practice Questions

The PNPT gives candidates 5 full days to perform an external and internal network penetration test against a simulated organization. There are zero flags to capture and zero multiple-choice questions. After completing the engagement, candidates have 2 additional days to write a professional penetration test report. Finally, candidates schedule a live 15-minute verbal debrief with senior TCM Security assessors to present their findings. All tools are permitted including Metasploit, custom scripts, and AI-assisted tools (which must be disclosed in the report).

The PNPT covers the full internal Active Directory attack chain: LLMNR/NBT-NS poisoning with Responder to capture NTLMv2 hashes, SMB relay attacks with ntlmrelayx.py, Pass-the-Hash with crackmapexec and evil-winrm, Kerberoasting (GetUserSPNs.py / hashcat -m 13100), AS-REP Roasting (GetNPUsers.py / hashcat -m 18200), Golden Ticket and Silver Ticket attacks using mimikatz, DCSync with secretsdump.py, token impersonation, and BloodHound/PowerView enumeration for attack path discovery.

The PNPT ($499) is more affordable than OSCP ($1,699+) and focuses heavily on Active Directory attacks and OSINT, while OSCP emphasizes standalone machine exploitation, buffer overflows (legacy), and restricts tool use (one Metasploit use per exam). PNPT allows all tools including Metasploit. OSCP is more widely recognized by enterprise employers, while PNPT is gaining strong reputation in the penetration testing community as a practical, realistic assessment. Many candidates use PNPT as an intermediate step before OSCP.

TCM Security's Practical Ethical Hacking (PEH) by Heath Adams (TheCyberMentor) is the primary recommended preparation — it covers the complete external and internal pentest methodology end-to-end. TCM's OSINT Fundamentals course covers the external reconnaissance phase. The $499 PNPT package includes 12 months of TCM Academy access covering 45+ hours of training. Supplemental practice on TryHackMe and Hack The Box Active Directory rooms is highly beneficial.

Key tools include: Responder and ntlmrelayx.py for LLMNR/SMB relay attacks; Impacket suite (secretsdump.py, GetUserSPNs.py, GetNPUsers.py, psexec.py, wmiexec.py) for AD attacks; mimikatz for credential dumping and ticket attacks; BloodHound/bloodhound-python and PowerView for AD enumeration; crackmapexec and evil-winrm for lateral movement; Chisel/proxychains for pivoting; nmap for scanning; and standard offensive Linux tools. Kali Linux is the recommended operating system.

No — this is a theoretical multiple-choice knowledge exam. The real PNPT is a 5-day hands-on practical penetration test where you must actually exploit a simulated network and write a professional report. Use this practice exam to test your understanding of PNPT concepts, tools, and attack techniques. To pass the actual PNPT, you must practice hands-on exploitation in lab environments like TCM Academy, TryHackMe, and Hack The Box.