Summary#

TryHackMe’s PT1 seemed like an interesting exam to measure technical base, methodology and the ability to keep pace for many hours, but it also made it clear to me that knowing tools isn’t enough: you need judgment, order and very good mental management.

In this post I want to leave my personal opinion about the exam, what I found good, where I struggled the most, and what I took away from the experience.

Result#

In my case I made 2 attempts, and both ended in Fail, although the second was clearly better than the first.

What is the PT1?#

The PT1 is set up as a practical pentesting exam with several distinct areas. It doesn’t focus on a single discipline, but mixes web, network and Active Directory, which forces you to switch context several times and to keep a fairly solid methodology.

In my case, additionally, the context was particular because TryHackMe was giving away the exam pass at that moment and I managed to get it. That made me end up sitting it earlier than I probably would have under other circumstances.

That, for me, is precisely one of its strengths: it’s not an exam to improvise on the fly. If you don’t bring a clear way to enumerate, prioritize and document, you start losing time very fast.

What I liked most#

• The exam touches several relevant areas and doesn’t feel single-topic.
• I liked that it forces you to think about methodology and not just execution.
• The Active Directory part seemed pretty good to me for measuring real fluency.

What I struggled with most#

My worst block was clearly web, and that was reflected in the score. That’s where I most felt the exam punishes any lack of order in enumeration, vector validation and prioritization.

When you’ve spent many hours on it, it’s easy to start forcing hypotheses, falling into rabbit holes or insisting too much on paths that end up not adding points. In this exam that comes at a high price.

Real difficulty#

My overall sense was this:

• Technical difficulty: Basic
• Overall exam difficulty: Basic
• Time management: Very important

I didn’t find it impossible at a purely technical level, but I did find it demanding in terms of endurance, especially when you’re just taking your first Red Team exams, focus and the ability to decide where it’s worth investing time and where it isn’t.

What I learned from the attempt#

The most important thing these two attempts left me wasn’t the score, but a much more honest view of how I was performing under pressure.

The main lesson was that a practical certification isn’t passed with scattered knowledge alone. What makes the difference is arriving with a clear methodology, knowing how to prioritize well and not wasting time on paths that add nothing.

I also understood that part of my mistake was the mindset I arrived with. Since I got the pass when it was being given away, I thought it would be something closer to the eJPT, and that made me overconfident. Looking at it now, it was a clear mistake because I didn’t give the real weight it deserved to either the exam or the preparation.

Also, the result made it quite clear where my weakest point was: the web part. In network and Active Directory I felt more solid, and that helped me better understand where I had to focus my efforts to keep improving.

Another important lesson was documentation. In this type of exam it’s not a good idea to leave it for the end, because documenting as you go also helps you think better and stay organized when you’ve already spent many hours.

In the end, more than a bad grade, I take away that it was an experience that helped me not to underestimate any certification and to take much more seriously how I prepare each exam from now on.

Who would I recommend it to?#

I’d recommend it to:

• People who already have a basic pentesting base and want to test themselves in a practical environment.
• Folks who want to touch several areas in the same exam.
• Those who want to train methodology in addition to exploitation.

I wouldn’t recommend it to:

• People starting from scratch.
• Those who still rely too much on automated tools without really understanding why.
• Folks who aren’t yet fluent at switching between web, network and Active Directory environments.

Final verdict#

My final opinion is that TryHackMe’s PT1 is indeed a useful exam and more serious than it may seem at first, above all because it doesn’t only measure technique: it also confronts you with your methodology, your ability to prioritize and how you respond when fatigue starts to weigh on you.

In my case I didn’t pass it, but even so I found it a valuable experience because it gave me a very clear diagnosis. It confirmed that at that moment I performed better at network and Active Directory than at web, and that helped me focus my next preparation stages much better.

That’s why I don’t just keep the result. I keep that it was an exam that forced me to take certifications with more respect, to prepare each attempt better and to understand that improving isn’t just studying more, but studying with better direction. If someone plans to sit it, my recommendation would be to go with a locked-in methodology, enough practice in the weaker areas and a very clear strategy to handle blocks, documentation and time. That, for me, is where you really win or lose a good part of the exam.