If you’re here, you’re probably wondering whether this certification is actually worth it. Maybe you’re comparing it to the OSCP, questioning who the PNPT is really for, or asking yourself, “Can I actually do this ?”

In this post, I’ll try to answer most of those questions by sharing what worked for me, what didn’t, the resources I used, and practical tips including what to do when you might hit a wall.

Why I Chose the PNPT (and What Sets It Apart) ?

The main reason I chose the PNPT was how closely its style mirrors a real world penetration testing engagement.

• You had to perform OSINT and external recon to get information and gain access into the network
  (Limited or overlooked in many other certifications).
• You are expected to dig deeper and pivot to the internal network and expand your access.
• You compromise the domain controller by performing AD attacks, privilege escalation and lateral movement.
• You must write a Professional Penetration Testing Report and then present your findings during a live debrief with a member of the TCM team
  (Limited or overlooked in many other certifications).

There are no flags to capture. You’re given five days to conduct the assessment and two additional days to complete the report, which felt fair and realistic.

There was no time pressure like in traditional CTFs, making the experience feel far closer to a real-world engagement than an exam! 🙂

My Personal Experience

One of the things I had initially decided was that I was going to approach the PNPT as a real world engagement, not a CTF.

Instead of rushing to exploitation, I took quite a bit of time during recon and OSINT. I enumerated each possible attack vector broadly, before committing to a specific attack path. You’ve probably heard it countless times before: enumerate, enumerate, and enumerate. As cliché as it sounds, it’s true 🫠.

I also had a checklist of commands to readily run to save quite a bit of time. I will be sharing this in tips and resources section.

Since I had plenty of time with the five-day exam, I made sure to take breaks and get proper rest. This helped more times than I can count, allowing me to come back with a clearer mindset and new perspectives.

When you are stuck and hit a wall, maybe a walk or a good night’s sleep can do wonders.

I kept track of everything which worked and didn’t work in my notes so that it was easy to identify missed details whenever I didn’t have enough information to move forward. For example:

• Every time I found new credentials, I immediately ran netexec to spray those credentials on previously enumerated users. I also updated my notes right away.
• If I uncovered information that revealed information but didn’t immediately present a clear exploit path, I kept it in the “TO REVIEW” section of my notes. These details become useful later especially when I was stuck and needed to re-evaluate the environment with fresh eyes. Eg:
  - Users with interesting group memberships that didn’t appear powerful initially but had indirect access.
  - Shares containing scripts or configurations with important information.

After plenty of head-scratching and several failed escalation attempts, I finally became Domain Admin, and boy was it a relief 🫡

The Report Writing & Client Debrief Experience

This section was where I struggled the most on my first attempt. I didn’t provide enough depth in the OSINT section, as I focused too heavily on the external and internal penetration testing findings. The lack of information in the OSINT section made the overall report incomplete and I was unable to pass the first time around.

On my second attempt, I made sure to include detailed explanations of how each finding fit into the overall attack path, and remediation guidance for every required issue (including the OSINT section).

Report writing has always been a weak point for me (this was harder than the actual exam 🙂), and PNPT turned that into a valuable learning experience.

Once my report was accepted, I moved on to the client debrief section. The client debrief was a 15-minute call with a member of the TCM Security team. During the debrief, I was expected to clearly explain the attack flow, technical findings, and recommended remediations. I practiced the debrief four to five times beforehand to stay within the time limit.

While 15 minutes might sound like a lot, it goes by very quickly so being prepared will definitely help.

These were the 2 sections where I learned a lot from this certification!

Tips and Resources I Used

1. What you actually need to study

• Practical Ethical Hacking (PEH)
• External Pentest Playbook
• OSINT Fundamentals

You don’t need any Linux or Windows Privilege Escalation courses. Everything you need are in the above courses.

If you’re looking for a note-style summary of the courses, a kind person has already put one together here: https://pnpt.adot8.com

2. Have a Methodology / Checklist

In the PEH course, listen to how Heath approaches each stage of the Penetration test (Eg: Initial attack vectors, Post compromise enumeration) and try incorporating that into your methodology (Eg: gather credentials, spray them, and iterate until progress is made).

PNPT Prioritizes Methodology Over AD Complexity. So you don’t need to know any specific complex AD exploits other than the ones already taught in the course. If you’ve stuck and exhausted all options, revisiting and rewatching the AD section of the PEH course and following Heath’s process/methodology in each of those videos can often help in moving forward.

Having a go-to checklist of commands for different phases of a penetration test can be extremely valuable. I put one together for my own use and included the link below(can be used for different certifications as well). I’d love to hear your thoughts on it 🙂

Windows Checklist — https://gokulkarthik.gitbook.io/pentesting-checklist/

Additionally, Heath mentions a External Pentest checklist which can be used to map breached credentials, findings, scope etc. I used it in my exam and it was very helpful. I have linked it below:

External Pentest Checklist — External Pentest Checklist Link

3. Take understandable notes

Keep track of everything you do — what works and what doesn’t. Document any new findings as you go, whether that’s newly discovered credentials, potential attack paths, or interesting behaviors in the environment.

If something doesn’t work immediately, don’t discard it. Keep it under review and revisit it later, especially when you gain more context or privileges.

Your notes don’t need to be perfectly clean. They just need to make sense to you. Clarity is more important than formatting. I personally used basic Markdown, but tools like Notion, Joplin, or any note-taking system you’re comfortable with work just as well.

4. Get to know your tools before the exam

Make sure you understand what the tools are actually doing and not just how to run them. This is something Heath emphasizes throughout the course. Take the time to learn the important flags and options, and don’t ignore errors when they appear. Read the output carefully and try to understand why an error is happening.

Increasing the verbosity level can often reveal what’s going on under the hood. It’s also worth reviewing the default configurations of the tools so you know what assumptions they’re making on your behalf.
For example: By default, netexec’s SMB module checks for domain accounts, not local accounts. To test local authentication, you need to explicitly use the -local-auth flag.

5. Pivoting

Pivoting is essential for moving between networks during the exam. While the PEH course covers this concept to an extent, I’d recommend working through the following TryHackMe room to become more comfortable operating in that type of environment.

THM Room — https://tryhackme.com/room/wreath

6. Take screenshots and be ready with a report template

Take a screenshot of EVERYTHING (OSINT to Domain compromise). You never know what you might need in your report. You can use the same report template which TCM provides. I have linked it below.

Report Template — Report Template Link

7. Take breaks when needed

Remember that the exam is 5 days. Take breaks when you need them and especially take them when you are stuck.
Go out with your friends. Relax and detach yourself from the exam. Trust me on this🙂

Final Thoughts

If you’re someone who:

• Wants to pursue the OSCP but is looking for a solid build-up beforehand (like I was), PNPT is for you.
• Is seeking a realistic beginner-to-intermediate Active Directory certification, PNPT is for you.
• Wants something more than just labs and CTFs, PNPT is for you.

Thank you for reading and scrolling this far down :)
If you have any questions regarding the PNPT or any of the tips/resources, drop a comment and I would be happy to help!

You can also connect with me on LinkedIn if you have any questions: https://www.linkedin.com/in/gokulkarthik2001/

Good luck on your PNPT journey 🙌