IICTI Certified Penetration Testing

Holders demonstrate that they can apply and evaluate engagement scoping, authorization and rules of engagement, threat-led test planning and adversary emulation design, attack surface intelligence and external exposure analysis and web application and API security assessment methodology, plus 6 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Penetration Testing.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Engagement scoping, authorization and rules of engagement10% of the exam

   • Design defensible engagement scopes and rules of engagement that balance coverage, legal exposure and operational safety.
   • Scope: Written authorization chains, PTES and NIST SP 800-115 scoping, cloud provider testing policies, third-party consent, safe-harbour clauses, deconfliction and emergency-stop procedures.
2. 02Threat-led test planning and adversary emulation design10% of the exam

   • Architect threat-informed test plans that map realistic adversary objectives to the client's critical business services.
   • Scope: MITRE ATT&CK-based scenario design, TIBER-EU and DORA threat-led penetration testing (TLPT), CBEST, attack trees and threat-intelligence-driven test objectives.
3. 03Attack surface intelligence and external exposure analysis10% of the exam

   • Evaluate an organisation's external exposure and prioritise assets for testing based on reachability and business criticality.
   • Scope: OSINT collection governance, attack surface management (ASM), DNS and certificate transparency analysis, cloud asset discovery and GDPR-compliant handling of collected data.
4. 04Web application and API security assessment methodology10% of the exam

   • Design comprehensive, standards-aligned assessment strategies for complex web applications and API ecosystems.
   • Scope: OWASP WSTG, ASVS 5.0, OWASP API Security Top 10 2023, authentication and authorization logic, business-logic flaws, GraphQL and gRPC coverage strategy.
5. 05Active Directory and hybrid identity attack path analysis10% of the exam

   • Analyse identity attack paths to demonstrate privilege escalation risk and recommend structural identity hardening.
   • Scope: Kerberos and NTLM weakness classes, AD CS misconfiguration categories, attack path graphing (BloodHound), Entra ID hybrid trust, tiered administration model validation.
6. 06Cloud and container environment security assessment10% of the exam

   • Evaluate cloud and container environments for exploitable misconfiguration while respecting provider policies and tenant boundaries.
   • Scope: AWS, Azure and GCP shared responsibility, IAM privilege escalation path analysis, CSPM finding validation, Kubernetes RBAC and workload isolation review, CIS Benchmarks.
7. 07Segmentation, wireless and OT assurance testing10% of the exam

   • Design safe assurance tests that verify segmentation and wireless controls, including in safety-critical OT environments.
   • Scope: PCI DSS 4.0 requirement 11.4 segmentation testing, firewall and VLAN boundary validation, WPA3 and 802.1X/EAP assessment, IEC 62443 safety constraints for OT/ICS.
8. 08Vulnerability validation, chaining and risk rating10% of the exam

   • Evaluate exploitability and business impact of findings to produce accurate, defensible risk ratings.
   • Scope: CVSS v4.0, EPSS, CISA KEV, SSVC decision trees, false-positive elimination, attack chaining analysis and minimal-footprint impact demonstration.
9. 09Operational safety, evidence handling and test data governance10% of the exam

   • Lead engagement operations that preserve client stability, evidential integrity and data confidentiality.
   • Scope: Operator activity logging, chain of custody, encrypted evidence storage, data minimisation, post-test artefact cleanup and ISO/IEC 27001:2022 aligned engagement controls.
10. 10Reporting, retesting and penetration testing programme leadership10% of the exam

    • Lead a penetration testing practice that delivers actionable reporting and measurable risk reduction over time.
    • Scope: Executive and technical reporting, remediation guidance, retest verification, CREST-style quality assurance, PTaaS and continuous testing models, programme metrics and tester ethics.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner