I recently obtained the Practical Network Penetration Tester certification offered by TCM Security and I’m writing this post to tell you about my journey.
Background
My background has nothing at all to do with IT or cyber security. I became interested in the field a few years ago, but at the time life got in the way and I did not progress very far.
At the beginning of this year, 2023, my passion for all things cyber security and penetration testing was re-ignited and I began anew, starting from scratch with a subscription to TryHackMe.
I completed several of the paths offered on THM (Junior Penetration Tester, Web Fundamentals, CompTIA Pentest+, Complete Beginner) and got through most of the other offensive paths (Offensive Pentesting and Red Teaming).
I was also lucky enough to be able to partake in and complete the Red Team Capstone while it was available for free to subscribers for several weeks (be on the lookout for my write-up on that).
TCM Security
Thanks to the community there, I heard of TCM Security and the overwhelmingly positive feedback their courses and offered certifications were receiving.
I went to the source and found their offering of the PNPT + training to be an absolute steal at the $400 price point. I had made up my mind and took the plunge.
The abovementioned offering comes bundled with five courses — Practical Ethical Hacking, Windows Privilege Escalation, Linux Privilege Escalation, Open-Source Intelligence and External Pentest Playbook — along with 2 exam attempts.
It’s also a lifetime voucher — you can take the exam whenever you’re ready and you have lifetime access to the course materials and any future updates (the entire Active Directory section was updated quite recently in fact to stay current).
Believe me when I say that these five courses with over 50 hours of training contain everything you need to pass the exam. My previous experience only helped to go through the courses faster as I was already somewhat familiar with the material, but you can absolutely start there from zero and be fully prepared for the exam.
The Exam
As per TCM Security’s website:
The PNPT certification exam is a one-of-a-kind ethical hacking certification exam that assesses a student’s ability to perform an external and internal network penetration test at a professional level. Students will have five (5) full days to complete the assessment and an additional two (2) days to write a professional report.”
After all that, you will have to perform a live 15-minute report debrief where you need to present your findings and recommendations for remediation.
There are no flags and no multiple-choice questions. The exam aims to simulate a real-world penetration testing engagement and the goal is to compromise the Domain Controller.
Tips for the Exam
I would like to provide some tips that will hopefully help to maximize your chances for success.
The number one tip I can give you is to take very detailed notes. There’s no filler in the courses and nothing should be deemed irrelevant. I personally used Obsidian for my note-taking and cannot recommend it enough.
Another tip that I cannot stress enough is that you must shed the mindset that this will be like any CTF that you’ve done. This mindset tripped me up majorly and cost me my first attempt. You have to think of the exam as a real-life engagement.
Next I would like to say that you should leave no stone unturned, go back to the detailed notes you’ve taken, or even to the source material if you need to, and try everything. Don’t dismiss anything you find — there are no insane rabbit holes, only the ones you create yourself.
Lastly, make sure to join the TCM Discord. It’s introduced in every course and can be an invaluable resource to help you on your journey. There’s 24/7 support available to assist you with any issues you run into while going through the courses. The response time is astounding — you have to see it to believe it.
Conclusion
At the end of your journey, you will feel much more prepared for the world of penetration testing and will hopefully have obtained the certification as well. The course material not only prepares you for the exam itself, but also for questions you may have to answer in interviews.
Not only that, but during the PEH course you will get to build your own personal Active Directory home lab, which will help you to better understand how AD works and will be a good addition to your resume. You can then easily use that to practice and experiment further.
I cannot recommend TCM Security and the PNPT enough.
