TCM Security Practical Network Penetration Tester (PNPT) Domains Explained: What to Study, Practice, and Review

The PNPT is not a trivia exam. It tests whether you can think and work like an operator in a realistic environment. That means studying for it is different from studying for a multiple-choice test. You still need core knowledge, but the real work is turning that knowledge into actions: identifying attack paths, moving through a network, escalating access, documenting evidence, and explaining risk clearly. This guide breaks the major PNPT knowledge areas into practical study targets so you can see what to learn, what to practice, and what to review before taking practice tests.

What the PNPT is really testing

At a high level, the PNPT checks whether you can perform a penetration test across a modern enterprise-style environment. That usually means more than just getting one shell. You need to understand how systems connect, how users behave, how identity is managed, and how a small foothold can turn into broader access.

The exam leans heavily on operator judgment. In plain terms, that means:

• You must recognize opportunities instead of waiting for a question to tell you what tool to run.
• You must adapt when one path fails. Real environments are messy.
• You must explain impact through reporting, not just prove exploitation.
• You must manage time across reconnaissance, exploitation, post-exploitation, and documentation.

If you prepare by only memorizing commands, you will struggle. If you prepare by building repeatable workflows, you will do much better.

The major domains you should study

Most PNPT preparation falls into a few broad domains. They overlap, which matters because the exam is scenario-driven. You are not likely to see each domain in isolation.

• External reconnaissance and initial access
• Active Directory fundamentals and attack paths
• Lateral movement
• Privilege escalation
• Credential attacks and authentication abuse
• Command and control operations
• Cloud and Azure awareness
• Reporting, notes, and evidence handling

The best way to use this list is to treat each domain as a skill cluster. Learn the ideas first, then connect them in small attack chains.

Active Directory: the domain most candidates must understand deeply

For many candidates, Active Directory is the center of PNPT prep. That makes sense. In internal enterprise testing, AD often controls identity, access, and trust. If you do not understand how AD works, many attack steps will feel random.

Start with the basics:

• Domains, users, groups, computers, and organizational units
• Kerberos and NTLM
• Domain controllers and core services
• Group Policy
• Privilege structure, especially local admin, domain admin, and delegated rights

Then move into attack logic:

• Enumeration: finding users, groups, shares, SPNs, sessions, ACLs, and trust relationships
• Credential exposure: cleartext, hashes, tickets, browser storage, config files, scripts, and password reuse
• Kerberos abuse: Kerberoasting, AS-REP roasting, ticket handling, and what conditions make these attacks possible
• ACL abuse and object control: why permissions matter even when you are not an admin
• Attack path analysis: how a low-privileged user becomes useful through group membership, local admin rights, sessions, or delegated control

The key point is this: do not study AD as a list of attacks. Study it as a permission system. Once you understand who controls what, attack paths become easier to spot.

Cloud and Azure: what level of knowledge matters

Not every candidate comes from a cloud-heavy background, so this area can feel vague. For PNPT purposes, focus on practical identity and access concepts rather than trying to master every Azure service.

Study these areas first:

• Azure AD or Entra ID basics: users, groups, roles, applications, service principals
• Hybrid identity concepts: where on-prem and cloud identities touch each other
• Conditional access and MFA awareness: what changes your attack options
• Privilege assignment: global admin, privileged roles, app permissions, delegated permissions
• Token and session concepts: why browser sessions and token theft matter operationally

You do not need to memorize every portal setting. You do need to understand cloud attack paths as identity abuse problems. Example: a misconfigured application registration or an over-privileged service principal can be just as dangerous as a weak AD group assignment. The common thread is access control.

Lateral movement: moving matters more than landing

Many candidates spend too much time on initial compromise and not enough on what comes next. In realistic networks, the first shell is often low value. The skill is turning that foothold into reach.

Strong lateral movement prep includes:

• Remote execution methods and when each is likely to work
• Using valid credentials safely without making assumptions
• Share discovery and access validation
• Session awareness: finding where privileged users are logged in
• Host triage: deciding which systems are worth touching

The reason this domain matters is simple. A candidate who can enumerate and choose targets well will often outperform someone who knows more exploits but moves blindly. Lateral movement is about decisions, not just technique.

Privilege escalation: local and domain context

Privilege escalation needs to be studied in two layers. First, local escalation on a host. Second, privilege growth across the domain.

For local privilege escalation, focus on:

• Misconfigurations: services, scheduled tasks, weak file permissions, insecure paths
• Credential opportunities: stored passwords, registry secrets, config files, history files
• Token and impersonation concepts
• Situational awareness: what you can do as the current user before trying noisy methods

For domain-level escalation, focus on:

• Group membership and delegated rights
• ACL abuse paths
• Kerberos-based opportunities
• Admin session discovery
• Password reuse patterns across local admin accounts and service accounts

The why here is important. Privilege escalation is not just “get SYSTEM” or “become domain admin.” It is the process of increasing options. Sometimes a small increase in rights unlocks the next major move.

Command and control operations: enough to work cleanly

C2 is often misunderstood in study plans. Some candidates over-focus on tool syntax. Others ignore it completely. The useful middle ground is learning how to operate reliably.

Study these C2 skills:

• Payload handling and listener setup
• Session management: naming, tracking, reconnect strategy, host context
• Basic OPSEC judgment: choosing quieter actions when possible
• File transfer methods
• Execution context awareness: integrity level, architecture, user, and network reach

The exam does not reward flashy operations. It rewards stable operations. If your C2 workflow is organized, you waste less time and make fewer mistakes.

Reporting: a tested skill, not an afterthought

Reporting is part of the job, so it is part of the exam mindset. Many technically strong candidates lose points here because they treat notes as cleanup work instead of active evidence collection.

Prepare for reporting by practicing:

• Clear finding structure: what happened, why it matters, how to reproduce it, and how to fix it
• Attack chain explanation: how one low-severity issue contributed to major impact
• Screenshot discipline: capture proof at the moment it happens
• Timestamped notes: commands, outputs, hosts, accounts, and decisions
• Executive clarity: explain business risk without jargon overload

This matters because the value of a penetration test is not the shell. It is the ability to communicate what the shell proves.

What to memorize versus what to practice in scenarios

This is one of the biggest study mistakes. Not all topics should be learned the same way.

Good memorization topics:

• Common ports and service patterns
• Kerberos and NTLM terminology
• AD object types and privilege concepts
• Basic command syntax you use constantly
• Common privilege escalation checks

Good scenario-based topics:

• Choosing an attack path from mixed enumeration data
• Deciding whether to roast, move laterally, dump creds, or enumerate more
• Turning one set of credentials into broader access
• Prioritizing targets under time pressure
• Writing a finding from raw notes and screenshots

A simple rule helps here: if a topic is about recognition, memorize the building blocks. If it is about judgment, practice it in a scenario.

How to convert each domain into practice sessions

Each domain should become a repeatable lab session with a narrow goal. Do not just “do AD” for three hours. That is too vague. Build small sessions that force one workflow at a time.

Examples:

• AD enumeration session: start with a low-privileged user and map groups, sessions, SPNs, shares, and possible ACL abuse.
• Credential attack session: practice identifying where passwords or hashes may exist, then test validation and next steps.
• Lateral movement session: use one valid credential set and see how many hosts you can assess safely and logically.
• Privilege escalation session: pick one host and document every escalation check in order, including dead ends.
• Reporting session: take one completed chain and write it as a client-facing finding.

For timed preparation, use a realistic practice run and then review your decisions, not just the final result. A focused resource for that stage is this PNPT practice test, especially if you want to test domain readiness under exam-style pressure.

The goal of practice is not only to prove you can complete a path. It is to see where your process breaks down. Did you miss a clue? Waste time on the wrong host? Fail to document proof? Those are the gaps to fix.

A practical review order that works well for most candidates

If your preparation feels scattered, use this review order:

1. Active Directory fundamentals
2. Internal enumeration and attack path analysis
3. Credential attacks and Kerberos abuse
4. Lateral movement and host targeting
5. Local and domain privilege escalation
6. C2 workflow and session management
7. Cloud and Azure identity abuse basics
8. Reporting and evidence packaging

This order works because each step supports the next one. AD fundamentals help you understand enumeration. Enumeration helps you find credentials and trust relationships. Those lead to movement and escalation. Reporting comes last in the list, but it should be practiced all the way through.

How to track weak areas honestly

Most candidates know their strong topics. Fewer can describe their weak points precisely. “I am weak at AD” is too broad to help. Break weaknesses into behaviors.

Better examples:

• I miss ACL abuse opportunities during enumeration.
• I know Kerberoasting theory but waste time validating targets.
• I can get shells, but I do not document enough evidence for reporting.
• I move laterally too early instead of finishing host triage.
• I understand Azure roles poorly and cannot spot cloud privilege paths.

Track each weak area with three columns:

• Concept gap: what you do not understand
• Workflow gap: what step you skip or do badly
• Correction drill: the exact lab or practice session that fixes it

This makes review much more efficient. You stop “studying everything” and start fixing actual failure points.

Mini FAQ

Are all domains weighted equally?

No, not in practical effect. Even if a formal breakdown is not presented as a simple percentage list, some domains naturally matter more because they connect to many others. Active Directory, enumeration, credential usage, lateral movement, and reporting usually have outsized importance because they influence the whole exam flow.

Should beginners focus on tools or concepts first?

Concepts first. Tools change. Concepts stay useful. If you understand why Kerberoasting works or why delegated rights matter, you can adapt to different tooling.

How much cloud knowledge is enough?

Enough to understand identity, roles, permissions, tokens, and hybrid risk. You do not need deep admin knowledge of every Azure feature, but you do need to recognize privilege relationships.

What if I am strong technically but weak at reporting?

Practice writing from your own lab work. Turn one attack chain into a finding every week. Reporting improves fastest when tied to evidence you personally collected.

How do I know I am ready for practice tests?

You are ready when you can explain your workflow in order: enumerate, identify paths, validate access, move carefully, escalate when justified, maintain notes, and write findings. Practice tests are most useful when you already have a process to test.

Final study advice

The PNPT rewards practical thinking more than perfect recall. Your best preparation is to study each domain as part of a chain, not as a separate chapter. Learn the fundamentals. Practice small operator tasks. Review your decisions. Write down evidence as you go. Then repeat until your workflow feels steady.

If you keep that focus, the domains stop looking like a long checklist and start looking like what they really are: the parts of one realistic penetration test.