Overview
Module 1 introduces penetration testing as a disciplined, repeatable process rather than ad hoc hacking. It covers the purpose and benefits of testing, the main engagement types such as black box, grey box and white box, the phases a test moves through, and the recognized methodologies and standards including PTES, OSSTMM, the OWASP testing guide and the MITRE ATT&CK framework. It frames the CPENT philosophy: a progressive, multi-layered enterprise range where each segment is harder than the last, demanding adaptable, methodology-driven work.
CPENT v2 is a fully hands-on, remotely proctored practical exam of 24 hours, so this module matters less as memorization and more as the structure that keeps a long engagement organized. Every later module, from OSINT through network, web, Active Directory and binary exploitation, is a phase or specialty within the methodology introduced here. A candidate who works methodically scores far better across the range than one who improvises.
How it's tested
CPENT is entirely performance-based on live cyber ranges, scored on what you achieve and document. This module's concepts show up as the disciplined approach you must apply throughout: scoping, methodical phase progression, and professional documentation that the final report rewards.
-
Methodical progression
The range is progressive, so you apply the phases in order, using each foothold to reach the next segment rather than attacking at random.
-
Standards-based approach
You follow a recognized methodology such as PTES so the engagement is repeatable and defensible, which the report must reflect.
-
Document as you go
You record findings and evidence continuously, because the report and its evidence determine much of the score.
Faced with a fresh range segment, improvising feels fast, but the progressive design punishes it. A methodical tester runs reconnaissance, enumerates thoroughly, identifies and validates vulnerabilities, exploits, then uses the foothold to pivot, documenting evidence at each step. That disciplined cycle, repeated per segment, is what the CPENT range and its report scoring reward.
Modules 1
Official modules from the EC-Council outline, in outline order.
1.1 Introduction to Penetration Testing and MethodologiesPen test types and phases, recognized methodologies and standards, and the CPENT approach.
- What it means
- This module covers the purpose of penetration testing, engagement types (black, grey and white box), the phases of a test from reconnaissance through exploitation, post-exploitation and reporting, and recognized methodologies and standards such as the Penetration Testing Execution Standard (PTES), the Open Source Security Testing Methodology Manual (OSSTMM), the OWASP testing guidance and the MITRE ATT&CK framework. It also frames CPENT's progressive, enterprise-range philosophy.
- What to understand
- Penetration testing is authorized, methodical and repeatable, which is what separates it from attack. Black box tests start with no inside knowledge, white box with full knowledge, and grey box with partial. A standard methodology keeps a long, complex engagement organized and the report defensible. CPENT ranges are progressive, so each segment builds on access gained in the last.
- How it shows up
- The methodology is applied, not recalled: you progress through the phases methodically across each range segment and document thoroughly so the report reflects a repeatable process.
- Common confusion
- Treating a methodology as a rigid checklist rather than an adaptable framework. The phases guide the work, but a progressive range requires adapting the approach to what each segment reveals.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Black, grey and white box testing
Engagement types defined by how much the tester knows in advance.
- Remember
- Black box has no inside knowledge, white box has full, grey box has partial.
- Tested as
- Framing the engagement approach.
- Trap
- Confusing grey box with white box.
-
Penetration test phases
Reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting.
- Remember
- Each phase feeds the next, and reporting runs throughout.
- Tested as
- Structuring work on the range.
- Trap
- Skipping thorough enumeration before exploitation.
-
PTES
The Penetration Testing Execution Standard, a widely used end-to-end methodology.
- Remember
- It defines phases from pre-engagement to reporting.
- Tested as
- Methodology selection.
- Trap
- Confusing it with a vulnerability scoring system.
-
OSSTMM
The Open Source Security Testing Methodology Manual, a structured testing methodology.
- Remember
- It emphasizes measurable, repeatable testing.
- Tested as
- Methodology recognition.
- Trap
- Treating it as a tool rather than a methodology.
-
MITRE ATT&CK
A knowledge base of adversary tactics and techniques.
- Remember
- Useful for mapping real attacker behavior to test activity.
- Tested as
- Technique mapping.
- Trap
- Treating it as a linear sequence.
-
Progressive range philosophy
CPENT ranges get harder as you advance, with segments building on each other.
- Remember
- Access to one segment enables reaching the next through pivoting.
- Tested as
- CPENT exam strategy.
- Trap
- Attacking randomly instead of progressing methodically.
-
Authorization and scope
Written permission and a defined scope that make testing lawful.
- Remember
- Testing outside scope is unauthorized, even on a range mindset.
- Tested as
- Professional discipline.
- Trap
- Ignoring scope boundaries.
-
Repeatability
A methodical process produces consistent, defensible results.
- Remember
- Repeatability is what makes a report credible.
- Tested as
- Report quality.
- Trap
- Relying on undocumented ad hoc steps.
-
Continuous documentation
Recording findings and evidence throughout the engagement.
- Remember
- The report and its evidence drive much of the CPENT score.
- Tested as
- Scoring.
- Trap
- Leaving documentation until the end.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Black box vs. grey box vs. white box
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Black box | No prior knowledge of the target | Simulates an external attacker | Expecting internal detail to be provided |
| Grey box | Partial knowledge, such as some credentials | Balances realism and coverage | Confusing it with white box |
| White box | Full knowledge, including architecture and code | Maximizes coverage and depth | Treating it as the only thorough approach |
Methodology vs. tool vs. framework
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Methodology | A structured approach such as PTES or OSSTMM | Defines the process | Confusing it with a single tool |
| Tool | Software used in a phase, such as a scanner | Performs a specific task | Treating a tool as a methodology |
| Framework | A knowledge base such as MITRE ATT&CK | Organizes techniques for reference | Treating it as a step-by-step process |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Improvise on the range
- What candidates pick
- Attack targets opportunistically without following a methodology.
- Why it looks right
- It feels faster under time pressure.
- Why it's wrong
- The progressive range rewards methodical phase progression and punishes disorganized work with missed footholds.
Clue to watch for A new segment opens up that depends on access from the previous one.
-
Document later
- What candidates pick
- Defer note-taking until after exploitation.
- Why it looks right
- It keeps momentum during the attack.
- Why it's wrong
- The report and its evidence drive much of the score, and details are easily lost in a 24-hour exam.
Clue to watch for The engagement will be judged partly on a written report.
-
Skip enumeration
- What candidates pick
- Jump to exploitation after basic discovery.
- Why it looks right
- Finding a service feels like enough.
- Why it's wrong
- Thorough enumeration reveals the services, versions and paths that make exploitation possible.
Clue to watch for Initial exploits fail because the target was not fully enumerated.
-
Checklist rigidity
- What candidates pick
- Follow the phases mechanically without adapting.
- Why it looks right
- A fixed checklist feels safe.
- Why it's wrong
- A progressive range requires adapting to what each segment reveals while still following the methodology.
Clue to watch for A segment behaves unexpectedly and the rote approach stalls.
-
Grey box assumptions
- What candidates pick
- Assume full architecture knowledge in a grey box test.
- Why it looks right
- More assumed knowledge simplifies planning.
- Why it's wrong
- Grey box provides only partial knowledge, so unverified assumptions lead to wrong moves.
Clue to watch for Only limited information was provided at the start.
Answer framework
For any CPENT engagement, use these steps to apply the methodology from this module.
- Confirm the scope and authorization, and choose the engagement approach, black, grey or white box, that the test defines.
- Work through the phases in order, from reconnaissance and enumeration to exploitation and post-exploitation, for each range segment.
- Adapt the methodology to what each progressive segment reveals, rather than following a rigid checklist.
- Use each foothold to pivot toward the next segment, since the range is built so that access compounds.
- Document findings and evidence continuously, because the report and its evidence determine much of the score, and record evidence and the reasoning for each decision as you go, since the engagement is judged partly on the professional report you submit at the end.
Practice question
Want more like this? The CPENT practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Because CPENT is a practical exam, treat this module as the operating system for your whole engagement rather than a set of facts to memorize. Learn the phases until running through them is automatic, and practice applying them end to end against a lab network so the cycle of reconnaissance, enumeration, exploitation, post-exploitation and documentation becomes second nature.
Study the methodologies, PTES and OSSTMM, for what they contribute to a repeatable process, and learn how MITRE ATT&CK maps techniques, but do not over-invest in memorizing clauses. The exam rewards disciplined application, not recall.
Most importantly, build the habit of documenting as you work. Set up a note-taking and evidence workflow now and use it in every practice session, because the CPENT report and its evidence carry much of the score. Afterwards, move to Module 2, scoping and engagement, which formalizes the pre-test discipline this module introduces. Throughout, keep a disciplined note-taking and evidence workflow, because the CPENT report and its evidence carry much of the score, and details are easily lost across a long, intense exam.
FAQ
Is CPENT a multiple-choice exam?
No. CPENT v2 is a fully hands-on, remotely proctored practical exam conducted on live cyber ranges over 24 hours, with no multiple-choice questions.
What score do I need to pass CPENT?
At least 70% earns the CPENT certification. Scoring 90% or higher earns the LPT (Master) designation.
Why does methodology matter so much?
On a long, progressive range, disciplined phase progression and continuous documentation are what carry a tester through. Most failures come from disorganized work, not missing tool knowledge.
What methodologies should I know?
Understand PTES and OSSTMM as end-to-end methodologies, the OWASP testing guidance for web, and MITRE ATT&CK as a technique knowledge base.
What is the difference between black, grey and white box testing?
Black box gives the tester no prior knowledge, white box gives full knowledge including architecture, and grey box gives partial knowledge such as some credentials.
Does the report affect my score?
Yes. CPENT requires a professional report, and its quality and evidence contribute to the result, which is why documentation must be continuous.
How does this module connect to the rest of CPENT?
Every later module, from OSINT through network, web, Active Directory and binary exploitation, is a phase or specialty within the methodology introduced here.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Practice Module 1 skills
You have covered penetration testing types, phases, methodologies and the CPENT approach. Practice applying the methodology end to end so it becomes automatic on the range.