Question 1

What is the PNPT exam format?

Accepted Answer

The PNPT gives candidates 5 full days to perform an external and internal network penetration test against a simulated organization. There are zero flags to capture and zero multiple-choice questions. After completing the engagement, candidates have 2 additional days to write a professional penetration test report. Finally, candidates schedule a live 15-minute verbal debrief with senior TCM Security assessors to present their findings. All tools are permitted including Metasploit, custom scripts, and AI-assisted tools (which must be disclosed in the report).

Question 2

What Active Directory attacks are covered in the PNPT?

Accepted Answer

The PNPT covers the full internal Active Directory attack chain: LLMNR/NBT-NS poisoning with Responder to capture NTLMv2 hashes, SMB relay attacks with ntlmrelayx.py, Pass-the-Hash with crackmapexec and evil-winrm, Kerberoasting (GetUserSPNs.py / hashcat -m 13100), AS-REP Roasting (GetNPUsers.py / hashcat -m 18200), Golden Ticket and Silver Ticket attacks using mimikatz, DCSync with secretsdump.py, token impersonation, and BloodHound/PowerView enumeration for attack path discovery.

Question 3

How does the PNPT compare to OSCP?

Accepted Answer

The PNPT ($499) is more affordable than OSCP ($1,699+) and focuses heavily on Active Directory attacks and OSINT, while OSCP emphasizes standalone machine exploitation, buffer overflows (legacy), and restricts tool use (one Metasploit use per exam). PNPT allows all tools including Metasploit. OSCP is more widely recognized by enterprise employers, while PNPT is gaining strong reputation in the penetration testing community as a practical, realistic assessment. Many candidates use PNPT as an intermediate step before OSCP.

Question 4

What courses should I take to prepare for the PNPT?

Accepted Answer

TCM Security's Practical Ethical Hacking (PEH) by Heath Adams (TheCyberMentor) is the primary recommended preparation — it covers the complete external and internal pentest methodology end-to-end. TCM's OSINT Fundamentals course covers the external reconnaissance phase. The $499 PNPT package includes 12 months of TCM Academy access covering 45+ hours of training. Supplemental practice on TryHackMe and Hack The Box Active Directory rooms is highly beneficial.

Question 5

What tools are required for the PNPT exam?

Accepted Answer

Key tools include: Responder and ntlmrelayx.py for LLMNR/SMB relay attacks; Impacket suite (secretsdump.py, GetUserSPNs.py, GetNPUsers.py, psexec.py, wmiexec.py) for AD attacks; mimikatz for credential dumping and ticket attacks; BloodHound/bloodhound-python and PowerView for AD enumeration; crackmapexec and evil-winrm for lateral movement; Chisel/proxychains for pivoting; nmap for scanning; and standard offensive Linux tools. Kali Linux is the recommended operating system.

Question 6

Is this practice exam like the real PNPT?

Accepted Answer

No — this is a theoretical multiple-choice knowledge exam. The real PNPT is a 5-day hands-on practical penetration test where you must actually exploit a simulated network and write a professional report. Use this practice exam to test your understanding of PNPT concepts, tools, and attack techniques. To pass the actual PNPT, you must practice hands-on exploitation in lab environments like TCM Academy, TryHackMe, and Hack The Box.

100+ Free PNPT Practice Questions

TCM Security Practical Network Penetration Tester (PNPT)

Explore More TCM Security Practical Certifications

TCM Security Practical IoT Pentest Associate (PIPA)

TCM Security Practical Junior Penetration Tester (PJPT)

TCM Security Practical Malware Research Professional (PMRP)

TCM Security Practical Mobile Pentest Associate (PMPA)

TCM Security Practical OSINT Research Professional (PORP)

TCM Security Practical SOC Analyst Associate (PSAA)

Key Facts: PNPT Exam

Sample PNPT Practice Questions

About the PNPT Practice Questions