This intensive four-day course follows Check Point's HackingPoint "Advanced Infrastructure Hacking" curriculum, covering attacks on Windows, Active Directory, Linux, databases, containers and the three major public clouds. It is built for technical staff who already know penetration-testing basics and want to earn the CCPE-AI accreditation (exam 156-409). Most of the time is spent in hands-on labs, so you leave with techniques you can reuse on real engagements and a clear plan for the exam.
Run advanced IPv4 and IPv6 reconnaissance and gather open-source intelligence
Compromise database servers and exposed web services
Escalate privileges on Windows and Linux and bypass local defences
Attack an Active Directory domain, move laterally and keep persistence
Break out of Docker containers and abuse Kubernetes weaknesses
Spot exploitable misconfigurations in AWS, Azure and GCP
Program
Reconnaissance and OSINT
Advanced IPv4/IPv6 scanning
Open-source intelligence gathering
Databases and web technologies
MySQL, PostgreSQL, Oracle, MongoDB
CI servers and version-control repositories
Java, Python, Node and PHP deserialization
SSL/TLS, Shellshock, credential harvesting
Windows exploitation
Desktop breakout and AppLocker bypass
Local privilege escalation
Antivirus and AMSI evasion, offensive PowerShell
GPO and delegation abuse
Active Directory
Pass-the-hash and pass-the-ticket
Lateral movement and port forwarding
Persistence: Golden Ticket, DCSync, LOLBAS
Linux exploitation
Enumeration and configuration flaws
SSH, file-share and X11 attacks
Restricted-shell escape, escalation and kernel exploits
Containers, network and cloud
Docker breakout and Kubernetes flaws
Weak VPN setups, VLAN hopping, VoIP
Storage, serverless and multi-cloud attacks on AWS, Azure, GCP
Prerequisites
Recommended: solid hands-on Linux, Windows and TCP/IP networking skills
Recommended: penetration-testing experience or the Infrastructure Hacking (CCPE-I) course
Target audience
Penetration testers and red-team members
SOC analysts who want to understand attacker techniques
System administrators and network engineers
Security enthusiasts already comfortable with the basics
The exam
The CCPE-AI accreditation is earned by passing exam 156-409, booked and taken through Pearson VUE. It belongs to Check Point's Infinity Specialist Accreditations and remains valid for two years; you may retake it up to six months before expiry, which starts a fresh two-year period. A pass can also extend a CCSE, CCSM or CCSM Elite certification that is still current. Question count, time limit and pass mark are confirmed when you register. We walk you through booking, identification rules and the practical logistics of the test day.
Preparation tips
Redo every lab without the instructor's notes
Keep a command cheat sheet per platform (Windows, AD, Linux, cloud)
Practise on a small personal Active Directory lab before the exam
Frequently asked questions (FAQ)
What is the difference between CCPE-I and CCPE-AI?
CCPE-I (exam 156-402) covers infrastructure hacking fundamentals. CCPE-AI (156-409) goes further into Active Directory, defence evasion, containers and cloud.
How long is the course?
Four days, delivered live online, in person in Casablanca or on-site at your organization.
Where do I take the CCPE-AI exam?
The exam is delivered by Pearson VUE; results usually show in your Check Point User Center within 24 to 48 hours.
How long is the accreditation valid?
Two years. It cannot be extended; you retake the exam to start a new period.
Do I need to know Check Point products?
No. The content is about vendor-neutral attack techniques, not Check Point firewalls.