CPENT study guide · 2026
14 areas and 14 modules. EC-Council does not publish weights for these areas, so each gets equal space here. Each guide explains what the area covers, how it is assessed and where candidates slip.
EC-Council does not publish weights, so every area is drawn the same size.
14 official modules 140–210 hrs suggested study
This module sets the framework for the whole CPENT program. It covers what penetration testing is, the types and phases of a test, the industry methodologies, and the mindset the hands-on CPENT exam demands.
Inside this domain
Watch for Improvise on the range
This module covers the professional groundwork before any testing: defining scope, agreeing rules of engagement, securing written authorization, and planning the engagement so the hands-on work stays lawful and organized.
Inside this domain
Watch for Attack the bonus target
This module covers gathering public information about a target and mapping its attack surface: OSINT sources, DNS and infrastructure discovery, and building the picture that drives every later attack.
Inside this domain
Watch for Scan for stealth
This module covers testing the human layer: phishing and its variants, pretexting and impersonation, and the controls and awareness that defend against social engineering, all within authorized scope.
Inside this domain
Watch for Generic mass phish
This module covers attacking web applications: the testing methodology and the OWASP-style classes from injection and cross-site scripting to broken authentication, insecure direct object references and server-side request forgery.
Inside this domain
Watch for WAF fixes injection
This module covers testing modern APIs and token-based authentication: API reconnaissance, the OWASP API risks, authorization flaws, and attacks against JSON Web Tokens.
Inside this domain
Watch for Authz is injection
This module covers testing networks end to end: external perimeter attacks, internal network exploitation and lateral movement, and attacking perimeter devices such as firewalls, routers and IDS or IPS.
Inside this domain
Watch for Rescan the perimeter
This module covers compromising Windows hosts and escalating privileges: exploitation techniques, local privilege escalation, credential dumping, and post-exploitation on Windows systems.
Inside this domain
Watch for Crack first
This module covers attacking Active Directory: reconnaissance of the domain, abusing authentication such as Kerberos, escalating to domain dominance, and recognizing the paths that lead to Domain Admin.
Inside this domain
Watch for Hit the DC directly
This module covers attacking wireless networks: the encryption standards and their weaknesses, capturing and cracking handshakes, rogue access point and evil twin attacks, and wireless countermeasures.
Inside this domain
Watch for Capture equals crack
This module covers compromising Linux hosts and escalating privileges: exploitation techniques, local privilege escalation routes, and post-exploitation on Linux systems.
Inside this domain
Watch for Kernel exploit first
This module is CPENT's most advanced technical content. It covers reverse engineering binaries, fuzzing to find flaws, and writing exploits, including buffer overflows and the evasion of modern memory protections.
Inside this domain
Watch for Find a public exploit
This module covers specialized environments: testing IoT devices, operational technology and SCADA systems with their safety-first priorities, and cloud environments with their shared-responsibility model.
Inside this domain
Watch for Scan the SCADA hard
This module covers delivering the engagement: writing a clear, evidence-backed report with risk ratings and remediation, and the post-testing actions that close out a professional penetration test.
Inside this domain
Watch for Raw output report
No official weights are published, so follow the outline order, across about 140–210 hrs of study.
The answer that looks right, and the clue that gives it away.
Clue A new segment opens up that depends on access from the previous one.
Clue The target is outside the defined range or scope.
Clue The scenario requires avoiding detection.
Clue The target is a specific group such as finance.
Clue The question asks for the best long-term remediation.
Clue Changing an identifier returns data belonging to another user.
Clue The target segment is isolated behind a compromised host.
Clue Hashes are captured and time is limited.
Study guides for exams that overlap with CPENT.
CPENT has 14 domains with 14 official modules between them: Introduction to Penetration Testing and Methodologies, Penetration Testing Scoping and Engagement, Open Source Intelligence (OSINT) and Attack Surface Mapping, Social Engineering Penetration Testing, Web Application Penetration Testing, API and Java Web Token Penetration Testing, Network Penetration Testing (External, Internal, and Perimeter Devices), Windows Exploitation and Privilege Escalation, Active Directory Penetration Testing, Wireless Penetration Testing, Linux Exploitation and Privilege Escalation, Reverse Engineering, Fuzzing, and Binary Exploitation, IoT, OT/SCADA, and Cloud Penetration Testing and Report Writing and Post Testing Actions.
Questions: Hands-on practical (no multiple-choice items). Time allowed: 24 hours (one 24-hour session or two 12-hour sessions). Passing score: 70% for CPENT; 90% earns LPT (Master).
Our planning estimate is 140–210 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.
Work through the areas in order, since each builds on the one before. Use the checklist on each page to confirm you can do what it asks before moving on.
This guide follows CPENT program version 2.0 (CPENTv2), current in 2026, published by EC-Council. It was last reviewed in October 2026.
Domain names, weights and modules come from EC-Council's official outline (CPENT program version 2.0 (CPENTv2), current in 2026). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.