The eJPT was my first practical penetration testing certification and also my first certification in the cybersecurity field. In this post, I want to share how I prepared for it, what I liked about the course, and why I think it is a good entry-level certification for people interested in penetration testing.

During my practical semester, I got the opportunity to complete the eJPT training and certification paid for by the company where I am currently working as a penetration tester.

📚 Course and preparation#

I spent around four weeks working through the relevant learning path on the INE platform.

The course mainly consists of videos combined with practical labs and smaller CTF-style challenges. After learning about a tool or technique, you can usually try it directly in a lab. This made the course much more useful to me than simply watching videos or reading documentation.

The labs are browser-based and provide a remote attacker machine with the required tools already installed. The environments do not have an Internet connection, but this is usually not a problem because everything needed for the exercises is available on the attacker machine.

The course is quite Metasploit-heavy. Tools such as msfconsole, Meterpreter, and msfvenom are used regularly, and in many exercises the use of Metasploit is explicitly expected.

Some people prefer to avoid Metasploit when learning penetration testing. For an entry-level certification, however, I think it helps students understand the general workflow without having to build every exploit or payload manually. It is still important to understand what the selected module does instead of only copying commands.

🔍 Course content#

A large part of the course focuses on enumeration and information gathering. This includes network discovery, port scanning, service enumeration, vulnerability scanning, and collecting information about the target environment.

I liked this focus because enumeration is one of the most important parts of a penetration test. The course repeatedly shows that we should understand the target before selecting an exploit.

Other topics include exploitation, persistence, and privilege escalation on Linux and Windows systems. Web exploitation is also covered, although it played a smaller role in my certification experience.

The learning path even contains sections about using AI in penetration testing and red teaming. These provide an introduction to possible use cases, but the practical fundamentals remain much more important.

🧪 The certification#

The certification itself is practical and takes place in an interactive lab environment. You work from a remote attacker machine and have to investigate the provided targets.

This is what I liked most about the eJPT. Instead of only answering theoretical multiple-choice questions, you have to enumerate systems, identify vulnerabilities, use the available tools, and find the information required for the assessment.

The labs in the learning path prepare you well for this style of exam. If you complete the exercises yourself and understand the steps instead of only following the solutions, the certification environment should feel familiar.

I will not include specific targets, answers, or other exam details in this post. However, I can say that careful enumeration was very important.

✅ My conclusion#

For me, the eJPT was a good entry-level penetration testing certification.

It provides a structured introduction to the different phases of a penetration test and includes enough practical work to apply the material directly. I especially liked the focus on enumeration and the combination of videos, labs, and CTF-style exercises.

The course will not make someone an experienced penetration tester on its own. Its strong focus on Metasploit also means that additional manual practice is useful. Still, it provides a solid starting point and explains how the different parts of a penetration test fit together.

My main advice is simple: complete the labs yourself, take useful notes, and make sure you understand why a technique works. Do not only memorize the required commands.

For people who already have some basic experience with Linux, networking, or platforms such as Hack The Box and now want to complete their first practical certification, I can recommend the eJPT.

Now that I have completed the eJPT, I am focusing on the Hack The Box Certified Penetration Testing Specialist (CPTS) path again. The eJPT was a good first certification and gave me additional practical experience that I can now build on while continuing my CPTS preparation.