Network Penetration Testing Essentials (PEN-200)

Most organizations only learn how an attacker would move through their environment after an incident. IT teams complete this PEN-200 training to build that offensive perspective in-house. The course covers reconnaissance, vulnerability scanning, web application exploitation, Windows and Linux privilege escalation, tunneling, and Active Directory attacks. It also teaches teams to report findings in executive summaries that non-technical leadership can act on.

Role fit: Best for security analysts, blue team members moving into red team work, and IT practitioners building advanced penetration testing skills. This is Expert-level content, so assign it to staff who are already comfortable with networking, Linux, and Windows administration.

Time investment: The course has 46 skills and about 37 hours of video. Individual lessons and skill sections vary in length, and each learner will need hands-on lab time beyond the video runtime.

Risk and governance: The instructor repeatedly stresses written permission, defined scope, and rules of engagement. Team Leads should reinforce that these techniques are used only against authorized targets, with clear documentation and approval before any internal assessment begins.

Change management: Teams come back with repeatable methods they can reuse in future internal assessments, including documented SOPs, lessons learned, and Metasploit-based workflows.

CBT Nuggets Virtual Labs give learners hands-on practice in a controlled, isolated environment. The labs include Kali Linux, Windows and Linux targets, and a full Active Directory domain.

IT teams use this training to test their own environment the way a real attacker would, then turn findings into fixes leadership can act on. Every exercise runs inside hands-on Virtual Labs, and the course repeatedly stresses written permission and rules of engagement before touching any system.

• Find exposures before attackers do. Your team works through the full pen testing lifecycle: passive reconnaissance, scanning with Nmap, Nessus, and OpenVAS, and web application assessment in a Kali-based Virtual Lab against a purpose-built test site. Practitioners learn to cut wasted effort by validating findings before spending time on remediation.
• Validate Active Directory and lateral movement risk. Starting from a simulated compromised client on a domain, learners enumerate accounts, test domain authentication paths, and explore persistence. This shows how one foothold can spread across the network.
• Strengthen the blue team, too. The course connects offensive testing to defensive preparation, showing how controlled, coordinated attacks help teams identify gaps before a real incident. It also covers physical and social engineering risks, such as stolen laptops and passwords on sticky notes. Defenders see where controls, monitoring, and policies may need reinforcement.
• Report in language executives understand. Note-taking and executive summary writing are built in from the first skill. Findings reach leadership as clear, non-technical action items, not raw scan output. Teams also document repeatable workflows as SOPs and lessons learned for future engagements.

Knowledge

• How the pen testing lifecycle runs, from scoped, permission-based reconnaissance through exploitation, post-exploitation, and cleanup. It also covers why the work often loops back to earlier phases instead of moving in a straight line.
• The difference between passive and active scanning, and where Nmap, Nessus, OpenVAS, and passive reconnaissance methods each fit.
• Common web application weaknesses, including cross-site scripting (XSS), directory traversal, file inclusion, command injection, and SQL-based attacks.
• Windows and Linux enumeration, insecure services, file and permission weaknesses, and how attackers use them to escalate privileges.
• How post-exploitation activity can support persistence, lateral movement, and discovery of additional systems or sensitive information.
• Why rules of engagement, careful note-taking, and a plain-language executive summary matter to stakeholders outside IT.

Ability

• Run the Metasploit workflow end to end: search, select, configure, and launch exploits and payloads. Then automate repeatable tasks to build team SOPs.
• Assess web applications with a browser proxy workflow, and run Metasploit scanner modules, such as WMAP, to confirm which attacks are viable before trying them.
• Carry out post-exploitation tasks, including persistence, discovering other systems to target, and collecting sensitive files.
• Use Metasploit post-exploitation in the lab to maintain access, identify follow-on activity, and understand why cleanup matters after testing.
• Spot attacker artifacts, such as phantom processes, that defenders can use to detect intrusions. This helps red and blue teams work together.
• Document findings and write executive summaries that turn technical results into prioritized fixes for leadership.