Preparing for the PNPT: internal network assessment, reporting, and the debrief

What makes it different

The PNPT simulates an engagement: you have several days for testing, followed by time to write a professional report, and then a live debrief where you walk through findings with an assessor. Active Directory is central. Confirm current timings on TCM Security’s site.

• Multi-day testing window
• Separate reporting window
• Active Directory focus
• Live debrief presenting findings

Active Directory skills in a lab

Build or use a training AD lab and practice enumerating users, groups, and trust relationships, identifying weak configurations such as Kerberoastable service accounts with weak passwords, and reviewing attack paths with BloodHound. Then practice the defensive side: what each finding means and how to fix it, which strengthens your report.

lab finding  : service account svc_sql has an SPN and a weak password (lab only)
impact       : any domain user can request its ticket and attempt offline cracking
remediation  : use a group managed service account or a 25+ character password; monitor 4769 with RC4
evidence     : screenshot of SPN listing and cracked lab password, timestamped

Lab: write a mini report and rehearse the debrief

After a practice run in your AD lab, write a five-page report with an executive summary, scope, three findings with evidence, risk, and remediation, and an attack narrative. Then record yourself explaining the most serious finding in five minutes to a non-technical audience. Watch it back and cut jargon.

report outline
1 Executive summary (half a page, business impact)
2 Scope and approach
3 Attack narrative (how findings chained together)
4 Findings: title, severity, description, evidence, remediation, references
5 Appendix: tools and timeline

Report as the product

Clients pay for the report and the conversation, not for screenshots of shells. Practicing clear writing and calm explanation is as important as technical skill for this exam and for real work.