The PJPT is not a multiple-choice exam and there are no flags to grab. TCM Security drops you into an internal network, gives you 48 hours to compromise the domain controller, and then another 48 hours to write a professional report on how you did it. If you have only ever sat quiz-style exams, that format is the thing that catches people out, not the hacking.
This is a study plan for the PJPT (Practical Junior Penetration Tester) as it stands in 2026. It covers what the exam actually tests, the Active Directory attack chain you have to be fluent in, and a realistic week-by-week schedule to get there. The good news: the PJPT has one of the narrowest, most predictable scopes of any practical pentest cert, so a focused plan works.
What the PJPT Exam Actually Is
The PJPT assesses one skill: performing an internal network penetration test at an associate level. You start with a foothold on the network and you have to move laterally and vertically until you own the domain controller.
Here are the confirmed 2026 facts from the official TCM Security exam page:
- Cost: $249, which includes 12 months of access to the Practical Ethical Hacking course (20+ hours of video).
- Exam window: two full days (48 hours) to complete the penetration test.
- Report window: two additional days (48 hours) to write and submit the professional report.
- Format: a real internal network. No multiple-choice questions, no capture-the-flag tokens.
- Attempts: one attempt plus one free retake included with every voucher.
- Validity: the certification does not expire, so there is no renewal fee or CPE grind.
- Prerequisites: none required. Basic knowledge of computers and networking is recommended, and candidates must be 18 or over.
- Tools: all tools are permitted, including AI-enabled ones, but anything you use must be disclosed in the report.
Exam Tip: Your voucher includes the exact course the exam is based on. Nothing on the PJPT is designed to surprise a candidate who has worked through the Practical Ethical Hacking Active Directory section. Treat the course lab as your primary revision material, not a supplement.
PJPT vs eJPT: Which Junior Cert Should You Sit?
The PJPT gets compared to INE's eJPT constantly, and they are aimed at similar people but test very different things. The eJPT is a guided, largely automated-friendly assessment. The PJPT is a hands-on internal AD compromise with a written report, which is far closer to a real junior pentest engagement.
| PJPT (TCM Security) | eJPT (INE) | |
|---|---|---|
| Format | 48-hour internal AD pentest | Question-based practical lab |
| Report required | Yes, professional report in 48h | No |
| Flags / questions | None | 35 dynamic questions |
| Cost (2026) | $249 (course included) | $249 voucher |
| Free retake | Yes | No |
| Expiry | Never | 3 years |
| Best for | Learning the full AD kill chain | First ever hands-on cert |
If you want a first taste of hands-on hacking with training wheels, the eJPT is the softer landing. If you want to prove you can walk into an internal network and take a domain, the PJPT is the better signal, and the mandatory report is genuinely useful practice. Many candidates sit the eJPT first and use the PJPT as the step up. See our eJPT study plan if you are weighing that route, and our PNPT study plan for the senior TCM exam that comes after.
The Active Directory Attack Chain You Must Know
The PJPT tests one attack chain, and it tests it thoroughly. Every stage below is fair game, and the exam is designed so you cannot skip a link and still reach the domain controller.
Initial Foothold and Enumeration
You begin with network access, not a shell. You need to enumerate hosts, services and shares confidently. Be fast with nmap, netexec (formerly CrackMapExec), and SMB enumeration. Knowing what an unauthenticated attacker can see on a Windows network is the whole opening.
Poisoning and Relay Attacks
LLMNR and NBT-NS poisoning with Responder is the classic first-blood technique on the PJPT. You capture NetNTLM hashes, then either crack them offline with Hashcat or relay them with ntlmrelayx. If SMB signing is not enforced, relaying is your route to a first set of credentials.
Credential Attacks
Once you have one hash or one weak password, password spraying across the domain often gives you a real user account. Understand the difference between spraying and brute forcing, and why account lockout policy makes spraying the safer choice.
Lateral Movement
With a valid credential you pivot. Pass-the-hash, pass-the-password, and tools like psexec, wmiexec and evil-winrm let you move host to host. This is where most candidates either flow smoothly or stall.
Privilege Escalation and Domain Compromise
The finish line is Domain Admin. Kerberoasting, AS-REP roasting, abusing misconfigured ACLs with BloodHound, and dumping NTDS.dit are the techniques that get you there. You must be able to run BloodHound, read the attack paths it maps, and act on them.
Exam Tip: Install and practise BloodHound until reading its graph is second nature. On the PJPT, the difference between a five-hour compromise and a stuck weekend is usually whether you can spot the shortest path to Domain Admin in the data you have already collected.
The Week-by-Week PJPT Study Plan
This is a six-week plan assuming you can put in around 8 to 10 hours a week. Compress it to four weeks if you already have Linux and networking fundamentals, or stretch it to eight if you are starting from scratch.
Weeks 1 to 2: Fundamentals and Enumeration
Work through the Practical Ethical Hacking course up to the Active Directory section. Get comfortable with Kali, nmap, and SMB enumeration. Build a small home AD lab (a domain controller and two Windows clients in VirtualBox or VMware) because you will use it constantly.
Weeks 3 to 4: The Active Directory Kill Chain
This is the heart of the PJPT. Practise the full chain in your lab: Responder poisoning, hash cracking, relaying, password spraying, lateral movement, and Kerberoasting. Run BloodHound against your own domain and trace the paths by hand. Repeat the chain end to end until you can do it without notes.
Week 5: Report Writing and Full Dry Run
The report is half the exam, so treat it that way. Download a professional pentest report template, then run a complete mock exam against your lab: compromise the domain, and write it up as if a client will read it. Screenshot everything with commands visible. Most first-attempt failures are report failures, not hacking failures.
Week 6: Mock Exams and Weak-Spot Drilling
Rebuild your lab clean and run the compromise again under time pressure. Note every command you had to look up, then drill those. Rehearse taking screenshots as you go rather than at the end, because reconstructing your steps after the fact is where the 48-hour report window disappears.
How the Report Is Marked and Why It Fails People
The professional report is not an afterthought. TCM assesses whether you can communicate findings the way a real pentester must, and a technically perfect compromise with a poor report can still fail.
Your report needs a clear executive summary, a methodology section, and detailed findings with reproduction steps, evidence and remediation advice. Every screenshot should show the command and its output. If you used AI-enabled tooling, you must disclose it. Write the report as though the reader has to fix the issues, because that is exactly the audience it simulates.
Exam Tip: Take your screenshots live, during the 48-hour test window, not from memory during the report window. Include the terminal command in every capture. Candidates who leave documentation to the report phase routinely run out of time.
Frequently Asked Questions
How much does the PJPT certification cost?
The PJPT costs $249 as of 2026. That price includes the exam voucher, one free retake, and 12 months of access to TCM Security's Practical Ethical Hacking course, which is the training the exam is based on.
Is the eJPT better than the PJPT?
Neither is strictly better; they test different things. The eJPT is a question-based practical with no report, ideal for a first hands-on cert. The PJPT is a full 48-hour internal Active Directory compromise with a mandatory professional report, which is a closer simulation of a real junior pentest role.
How hard is the PJPT exam?
The PJPT is challenging in scope but predictable. It only tests internal Active Directory attacks, and everything on it is covered in the bundled course. Candidates who can run the full kill chain, from Responder poisoning to Domain Admin, without notes tend to pass comfortably. The most common reason for failure is a weak report, not the hacking.
Do I need experience before taking the PJPT?
No prior penetration testing experience is required. Basic knowledge of computers and networking is recommended, and the bundled Practical Ethical Hacking course takes you from fundamentals through the Active Directory attack chain.
Does the PJPT certification expire?
No. The PJPT does not expire, so there are no renewal fees or continuing-education requirements once you have passed.
Ready to Start Practising?
The PJPT rewards repetition of one clear attack chain, so the candidates who pass are the ones who have run it enough times to do it under pressure. Build the lab, drill the chain, and rehearse the report before exam day.
CertCrush helps you lock in the underlying penetration testing knowledge with realistic practice questions and explanations. If you are building toward a broader pentest career, our CompTIA PenTest+ practice exam pairs well with hands-on certs like the PJPT, and it is worth reading whether CompTIA PenTest+ is worth it alongside the practical route.
Create your free CertCrush account and start practising today.