The eJPT (eLearnSecurity Junior Penetration Tester) certification from INE Security is the leading entry-level credential for aspiring penetration testers. Unlike traditional multiple-choice exams, the eJPT is a 72-hour practical, blackbox lab assessment — you must demonstrate real skills, not just recall facts. Our free eJPT practice test PDF covers all core exam domains so you can study offline, annotate your notes, and arrive at the lab fully prepared. Topics span penetration testing methodology, network fundamentals, host discovery, web application hacking basics, Metasploit exploitation, password attacks, and pivoting techniques.
The eJPT exam expects you to follow a structured pentest lifecycle: reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting. Understanding each phase — and knowing which tools apply where — is fundamental to passing the lab.
You need a solid grasp of the TCP/IP stack, common ports and services, routing concepts, and ARP. The lab environment will have live hosts across subnets, and misreading network topology will cost you critical points.
Nmap is the backbone of the eJPT exam. Study the most-tested flags: -sV (version detection), -sC (default scripts), -A (aggressive scan), -p- (all ports), and OS detection options. Practice reading Nmap output quickly under time pressure.
The eJPT tests foundational web security: HTTP methods (GET, POST, PUT, DELETE), directory enumeration with tools like Gobuster or Dirb, using Burp Suite as an intercepting proxy, SQL injection introduction, and cross-site scripting (XSS) basics.
The msfconsole workflow is heavily tested: search, use, set (RHOSTS, LHOST, LPORT, payload), run/exploit. Know common auxiliary scanner modules and how to stage a basic Meterpreter shell.
Hydra is the primary tool tested for online brute-force attacks against services like SSH, FTP, and HTTP login forms. Hashcat basics for offline cracking may also appear. Know how to construct a Hydra command with a wordlist and service flag.
The eJPT lab frequently involves dual-homed hosts. You must understand how to route traffic through a compromised host using Metasploit route/autoroute or manual SSH tunneling to reach internal network segments.
After working through the printable PDF, reinforce your knowledge with interactive questions in our eJPT practice test suite. Online practice lets you track your score by topic, review detailed answer explanations, and identify any gaps before you enter the live 72-hour lab. We recommend rotating between the PDF and online tests until you consistently score above 80% — giving yourself solid headroom above the 70% passing threshold.