PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free PT1 Practice Questions

Prepare for the TryHackMe Junior Penetration Tester (PT1) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More TryHackMe Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

TryHackMe Security Analyst Level 1 (SAL1)

Practice Questions

TryHackMe Cyber Security 101 (SEC1)

Practice Questions

TryHackMe Security Analyst Level 2 (SAL2)

Practice Questions
2026 Statistics

Key Facts: PT1 Exam

48 hours

Exam Duration

TryHackMe

750 pts

Passing Score

TryHackMe

$297

Exam Cost

TryHackMe

3 domains

Engagements (Web/Network/AD)

TryHackMe

1 retake

Free Retake Included

TryHackMe

3 months

Premium Subscription Included

TryHackMe

The TryHackMe PT1 is a 48-hour practical penetration testing exam with three engagements: web (OWASP Top 10), network (SMB/RDP/FTP/SNMP), and Active Directory. You need 750 points to pass plus a professional report. The exam costs $297 including one free retake and a 3-month Premium subscription. Recommended prep: complete the Jr Penetration Tester learning path (~80 hours) on TryHackMe before attempting.

Sample PT1 Practice Questions

Try these sample questions to test your PT1 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which Nmap flag is used to perform a SYN stealth scan (half-open scan) against a target?
A.-sS
B.-sT
C.-sU
D.-sA
Explanation: The -sS flag performs a TCP SYN scan (also called a stealth or half-open scan). Nmap sends a SYN packet and waits for a SYN-ACK to confirm the port is open, then sends a RST to tear down the connection without completing the handshake. This is faster and stealthier than a full TCP connect scan (-sT).
2Which Nmap flag enables version detection for discovered services?
A.-sV
B.-O
C.-A
D.-p-
Explanation: The -sV flag enables Nmap's service/version detection, which probes open ports to determine the service name, version number, and sometimes OS information. This is essential for identifying exploitable software versions during reconnaissance.
3What Nmap Scripting Engine (NSE) script category is best used to check for known vulnerabilities on open ports?
A.discovery
B.auth
C.vuln
D.brute
Explanation: The 'vuln' NSE script category contains scripts that check for specific known vulnerabilities (e.g., ms17-010 for EternalBlue). Running --script vuln against a host will attempt to identify exploitable services by matching them against known CVEs and vulnerability signatures.
4During SMB enumeration, which tool is commonly used on Linux to gather shares, users, and OS information from a Windows SMB host?
A.enum4linux
B.Hydra
C.Nikto
D.Gobuster
Explanation: enum4linux is a Linux tool that wraps Samba utilities to enumerate SMB (Server Message Block) information from Windows and Samba hosts. It can retrieve share lists, user accounts, group memberships, password policy, and OS details — all critical for planning SMB-based attacks.
5Which default TCP port does the SMB protocol use on Windows systems?
A.139
B.389
C.445
D.3389
Explanation: SMB (Server Message Block) operates on TCP port 445 in modern Windows versions (Windows 2000+). Port 139 is used by the older NetBIOS Session Service (SMB over NetBIOS). Port 445 allows direct SMB communication without NetBIOS and is the primary target during SMB enumeration.
6What does the Nmap script 'smb-enum-shares' reveal about a target Windows system?
A.Available SMB shares and their access permissions
B.Open TCP ports and service banners
C.Active user sessions on the system
D.The SMB dialect version in use
Explanation: The smb-enum-shares NSE script queries a target for all available SMB shares and shows the share name, type (disk, IPC, printer), comment, and access level (READ/WRITE/NONE). Discovering readable or writable shares without authentication is a common misconfiguration that pentesters exploit.
7An FTP server responds to an anonymous login attempt with '230 Login successful'. What does this indicate from a penetration testing perspective?
A.Anonymous FTP access is enabled, allowing unauthenticated file listing or download
B.The server uses encrypted FTP (FTPS) and requires a certificate
C.The server only allows local network connections
D.The FTP service is running behind a firewall and requires VPN
Explanation: FTP response code 230 means 'User logged in, proceed.' When this follows an anonymous login (username: anonymous, password: any email), it means the FTP server allows unauthenticated access. This is a common misconfiguration that can expose sensitive files. Testers should enumerate available files and check for write access.
8Which SNMP version sends community strings and data in cleartext, making it vulnerable to network sniffing?
A.SNMPv1
B.SNMPv2c
C.SNMPv3
D.Both SNMPv1 and SNMPv2c
Explanation: Both SNMPv1 and SNMPv2c use community strings (like 'public' or 'private') as their only authentication mechanism, and they transmit all data in cleartext over UDP port 161. An attacker on the network can capture these packets and read community strings to gain read or write access to SNMP-managed devices. SNMPv3 added authentication and encryption.
9What tool can enumerate SNMP OIDs and retrieve system information using the default 'public' community string?
A.snmpwalk
B.crackmapexec
C.enum4linux
D.netdiscover
Explanation: snmpwalk is a command-line utility that uses SNMP GETNEXT requests to walk through all OIDs (Object Identifiers) accessible with a given community string. Running 'snmpwalk -v2c -c public <target> .' can retrieve system description, hostname, running processes, network interfaces, and installed software — all useful for enumeration.
10When performing RDP reconnaissance, which Nmap script checks whether the target's Remote Desktop Protocol service is vulnerable to the BlueKeep exploit (CVE-2019-0708)?
A.rdp-enum-encryption
B.rdp-vuln-ms12-020
C.rdp-vuln-ms17-010
D.rdp-vuln-ms19-0708
Explanation: The rdp-vuln-ms19-0708 NSE script checks for CVE-2019-0708 (BlueKeep), a critical pre-authentication Remote Code Execution vulnerability in Windows RDP affecting Windows 7, XP, Server 2003/2008. BlueKeep was classified as wormable and rated CVSS 9.8. The script probes whether the target is patched without attempting exploitation.

About the PT1 Exam

The TryHackMe PT1 (Junior Penetration Tester) is a practical 48-hour certification exam covering web application security, network enumeration and exploitation, and Active Directory attacks. Candidates connect via OpenVPN, tackle three separate engagements, earn flag-based points, and submit a professional penetration test report. This practice test covers the knowledge needed for the Jr Penetration Tester learning path and PT1 exam.

Assessment

Performance-based assessment

Time Limit

48 hours

Passing Score

750 points

Exam Fee

$297 (TryHackMe)

PT1 Exam Content Outline

20%

Reconnaissance and Network Enumeration

Nmap scanning (SYN, UDP, version detection, NSE scripts), passive OSINT (WHOIS, Shodan, Censys, certificate transparency), SMB/FTP/RDP/SNMP enumeration with enum4linux, snmpwalk, and Nmap scripts

30%

Web Application Security (OWASP Top 10)

SQL injection (union, blind, time-based), XSS (stored, reflected, DOM), IDOR, SSRF (regular and blind), command injection, file upload bypass, directory brute-forcing with Gobuster, and Burp Suite (Proxy, Repeater, Intruder)

30%

Active Directory Enumeration and Attacks

BloodHound/SharpHound, PowerView, Kerbrute username enumeration, AS-REP Roasting, Kerberoasting, Pass-the-Hash, LLMNR/NBT-NS poisoning with Responder, DCSync with secretsdump.py, and lateral movement with CrackMapExec

15%

Exploitation and Post-Exploitation

Metasploit Framework (msfvenom, multi/handler, meterpreter), EternalBlue (MS17-010), privilege escalation (Linux SUID/sudo/cron, Windows unquoted service paths, SeImpersonatePrivilege), and pivoting with Ligolo-ng or SSH tunneling

5%

Methodology and Report Writing

Penetration testing phases (recon→scan→exploit→post-exploit→report), scoping and rules of engagement, CVSS scoring, executive summary vs technical findings, proof file documentation

How to Pass the PT1 Exam

What You Need to Know

  • Passing score: 750 points
  • Assessment: Performance-based assessment
  • Time limit: 48 hours
  • Exam fee: $297

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

PT1 Study Tips from Top Performers

1Complete the full TryHackMe Jr Penetration Tester learning path — every room in it builds directly applicable skills for PT1's three engagements
2Master Nmap: know the difference between -sS, -sU, -sV, -O, -A, -p-, -Pn, --script, and -oA flags inside-out
3Practice Burp Suite's Repeater and Intruder extensively — most web vulnerabilities in PT1 are tested manually with Burp
4Complete TryHackMe's Attacktive Directory room multiple times — it walks through the full AD attack chain used in PT1
5Learn Ligolo-ng for pivoting — TryHackMe specifically recommends it for the PT1 exam environment
6Practice report writing before the exam — submit clear findings with screenshots, impact statements, and remediation recommendations
7Budget time across all three engagements — don't spend all 48 hours on one section if stuck; move on and return
8Keep a personal cheat sheet of commands for enum4linux, snmpwalk, Responder, GetUserSPNs.py, and CrackMapExec

Frequently Asked Questions

What is the TryHackMe PT1 exam format?

PT1 is a 48-hour practical exam. Candidates receive an OpenVPN file and access to a pentest simulator with three separate engagements: web application security, network penetration testing, and Active Directory exploitation. Points are earned by capturing flags on compromised systems. You need 750 points to pass. After the exam, you submit a professional penetration test report, which is graded by an AI system.

What tools are needed for the PT1 exam?

TryHackMe allows any tools of your choice. Key tools include: Nmap (port scanning), Burp Suite (web testing), Gobuster/Nikto (web enumeration), Metasploit Framework (exploitation), Hydra (brute-forcing), enum4linux/CrackMapExec (SMB/AD), BloodHound/SharpHound + PowerView (AD enumeration), Impacket suite (GetUserSPNs.py, secretsdump.py), Responder (LLMNR poisoning), and Ligolo-ng (pivoting). Kali Linux is the recommended OS.

How does the PT1 exam compare to eJPT and PJPT?

PT1 ($297) is comparable in difficulty to INE Security's eJPT and TCM Security's PJPT. All three are entry-level practical certifications. PT1 covers all three domains (web/network/AD) in a single exam, while PJPT focuses specifically on Active Directory. eJPT includes MCQ components alongside labs. PT1 is attractive because it bundles 3 months of TryHackMe Premium and a free retake with the purchase.

What learning path should I complete before PT1?

TryHackMe recommends completing the Jr Penetration Tester learning path (approximately 80 hours), which covers: pentesting methodology, Nmap, Burp Suite, OWASP Top 10 web vulnerabilities, Metasploit, network services exploitation (SMB, FTP, SNMP, RDP, Telnet), Active Directory enumeration and attacks, and Linux/Windows privilege escalation. Practice rooms like Attacktive Directory, OWASP Juice Shop, and Blue are especially valuable.

How difficult is the PT1 exam?

PT1 is designed for junior-level pentesters. Community reviews indicate the Active Directory engagement is the most straightforward, while the web application engagement is the most technically challenging. Candidates who have completed the full Jr Penetration Tester path and practiced on Active Directory rooms (Attacktive Directory, AD Basics) generally report being well-prepared. Budget your 48 hours wisely across all three engagements.

Is this practice test the same as the PT1 exam?

No — this is a theoretical multiple-choice knowledge-prep test. The real PT1 exam requires actually exploiting live systems and capturing flags in a virtual environment. This practice test helps you learn and verify the concepts, tools, commands, and techniques covered in the Jr Penetration Tester learning path. To pass PT1, you must practice hands-on exploitation in TryHackMe's interactive labs.