1.3 PEN-103 Syllabus & Study Path

The Seven Exam Domains

PEN-103's syllabus is the Kali Linux Revealed book itself: the exam draws from all 12 chapters, with no chapter exempt. To make study planning possible, this guide groups those chapters into seven domains with approximate exam weights. One caveat up front: OffSec does not publish official domain weights for KLCP — the official exam guidance states only that the exam covers the whole Kali Linux Revealed book. The weights below are OpenExamPrep's estimates, derived from observed question distribution, and exist purely to help you prioritize study time; treat them as informed approximations, not exam policy. Used that way, the weights tell you where your hours should go: a domain estimated at 20% deserves roughly four times the attention of one estimated at 5%.

*Weights are OpenExamPrep estimates based on question distribution; OffSec does not publish official KLCP domain weights.

Reading the Estimated Weights

Two conclusions fall out of the table immediately. First, by OpenExamPrep's estimate, fundamentals & configuration plus package management equal about 40% of the exam. If you master Kali's defaults (zsh since 2020.4, Xfce, kali/kali live credentials, services disabled by default, kali-rolling as the primary repository) and the Debian packaging toolchain (dpkg for local .deb files, apt for repository-aware dependency resolution), you have banked nearly half the points you need. Second, the middle tier — internals/filesystem and customization/ISO — is another third of the exam, and these are the domains where hands-on VM practice pays off most, because questions about the FHS directory layout or the live-build workflow are much easier to remember if you have actually typed the commands.

Notice what is not dominant: security tools sit at about 5% in this estimate. Candidates with penetration-testing backgrounds routinely over-study tools and under-study packaging. KLCP certifies Kali Linux knowledge, not exploitation skill.

How the Guide's 16 Chapters Map to the Syllabus

The guide expands the book's 12 chapters into 16 study chapters so that the heaviest domains get room. The mapping below shows which book chapter each guide chapter teaches and which domain it serves; use it to plan your read-quiz-review passes and to trace any quiz miss back to its source chapter in the book.

Building Your Study Path

Work the chapters in order the first time through — the material is deliberately cumulative, with fundamentals before package management and package management before the advanced usage and enterprise chapters. On your second pass, reorder by OpenExamPrep's estimated weights: chapters 12 and 13 (package management), then 2, 3, 7, 8, and 9 (fundamentals and configuration), then 4, 5, 6, and 14 (internals, bash, and customization), with chapters 10, 11, 15, and 16 closing out networking and services, enterprise deployment, and security assessments.

Before scheduling your exam attempt, hold yourself to a readiness checklist:

• You can recite the defaults table from section 1.1 without notes — shell, desktop, credentials, repository, release date, Debian base.
• You can explain the difference between dpkg and apt in one sentence each, and name what kali-rolling, kali-dev, and kali-bleeding-edge are for.
• You can sketch the FHS top-level directories and say what lives in /etc, /var, /usr, and /opt.
• You score consistently well on every guide chapter's quizzes taken closed-book, including the chapters you think are boring.

When all four are true, you are ready to book the ClassMarker session — and if you hold a Learn Fundamentals or Learn One subscription, remember that an attempt is already included.

Domain Traps Worth an Extra Pass

Each domain has a characteristic trap the exam writers lean on. In fundamentals, candidates confuse BackTrack's final Ubuntu base with Kali's clean rebuild on Debian, and forget that BackTrack itself merged WHAX and the Auditor Security Collection. In package management, the trap is believing apt replaces dpkg rather than building on top of it — dpkg handles individual .deb files while apt resolves dependencies across repositories. In internals/filesystem, the trap is assuming Kali deviates from the Filesystem Hierarchy Standard; it is FHS-compliant. In customization, candidates assume live-build is a third-party add-on when it is Kali's own image toolchain, used alongside the custom kernel patched for wireless injection. In networking, the trap is assuming SSH or Apache runs out of the box — network services are disabled by default. In bash, the classic miss is confusing the interactive default (zsh) with the POSIX script interpreter (/bin/sh is dash). And in security tools, the trap is strategic rather than factual: over-studying a 5% domain while a 20% domain goes unreviewed.