CMIT 386 at the University of Maryland Global Campus teaches you to run a penetration test from first contact with the client to the final management briefing.
UMGC describes it as an introduction to penetration testing and red teaming built on the Penetration Testing Execution Standard (PTES), with tools such as Kali Linux and the Metasploit Framework. The course is designed to help prepare for the CompTIA PenTest+ certification exam.
It sits late in the cybersecurity sequence for a reason. The prerequisites combine the Linux track and the ethical hacking track, so you arrive knowing how to move around a shell and how attacks work. What is new is discipline: scoping, rules of engagement, evidence and a report that a non-technical manager can use.
Course at a Glance
| Item | Details |
|---|---|
| University | University of Maryland Global Campus (UMGC) |
| Course code | CMIT 386 (3 credits) |
| Level | Undergraduate, upper level |
| Prerequisites | CMIT 291 or CMIT 391 (or Linux+ / LPIC-1) and CMIT 321 (or CEH) |
| Certification alignment | CompTIA PenTest+ |
| Typical work | Hands-on labs, a planned penetration test, a findings report for management |
What CMIT 386 Covers
The course follows the phases of PTES. Each one produces something you will be asked to show:
| PTES phase | What you do |
|---|---|
| Pre-engagement interactions | Agree scope, targets, timing and rules of engagement in writing |
| Intelligence gathering | Passive and active reconnaissance on the in-scope systems |
| Threat modeling | Decide which assets matter and which attackers are realistic |
| Vulnerability analysis | Scan, verify and rank weaknesses, filtering out false positives |
| Exploitation | Prove a weakness is real, using tools such as Metasploit |
| Post-exploitation | Assess what an attacker could reach or change after access |
| Reporting | Present findings, risk and remediation to management |
Red teaming adds a wider lens: rather than listing every flaw, a red team emulates a realistic adversary against a goal and tests how well the organization detects and responds.
Key Concepts Explained
Scope and Rules of Engagement
Testing without written permission is an attack, not a test. The scope names the systems you may touch; the rules of engagement say how, when and what is off limits (for example, no denial of service on production).
Example: The scope lists a web server and a file server on one subnet. During recon you find a VPN appliance on a neighboring range. A sound tester records it as an observation and asks the client before touching it, rather than adding it to the test.
From Vulnerability to Finding
A scanner result is a lead. A finding is a verified weakness with evidence, an impact statement and a fix. Rating severity with a recognized scheme such as CVSS keeps your rankings consistent.
Example: A scan flags an outdated SMB service. You confirm the version, show that an exploit module gains a shell in the lab, and write: "An unauthenticated attacker on the internal network can take control of the file server. Apply the vendor patch and disable SMBv1."
Typical Assignments and How to Approach Them
| Assignment type | What it tests | How to approach it |
|---|---|---|
| Lab exercises | Using Kali tools correctly | Screenshot each command and its output, with a line on what it shows |
| Engagement plan | Scoping and permission | Define targets, limits, contacts and timing before any tool runs |
| Penetration test | Working through PTES | Keep a timestamped log so every finding can be traced |
| Management report | Translating risk for leaders | Executive summary first, technical detail and evidence after |
Legal and Ethical Boundaries
Every technique in CMIT 386 is illegal against systems you are not authorized to test. Course labs give you a safe, isolated environment; practice there and on deliberately vulnerable machines built for training, never on networks you do not own.
Ethics also shapes the report. Testers handle sensitive data they discover with care, record only what is needed as evidence, and disclose findings to the client alone.
Where Students Get Stuck
- Raw tool output in the report. Pages of Nmap text do not tell a manager anything. Summarize, then put the evidence in an appendix.
- Skipping the planning phase. Rubrics usually expect scope and rules of engagement, not only exploitation.
- Unranked findings. Ten issues of equal weight leave the reader unsure what to fix first. Rank them and justify the ranking.
- Weak remediation advice. "Patch the system" is vague. Name the fix, who owns it and how to verify it.
Study Tips for CMIT 386
- Revise Linux file permissions and networking basics from the prerequisite courses before week one.
- Keep one running lab journal with dates, commands and results; it becomes your report evidence.
- Write the executive summary last but read it first: could a manager decide what to fund from it alone?
- Map each report section to a PTES phase so the marker can see the methodology.
How We Help with CMIT 386
Send the assignment brief, the scenario or lab environment notes, your own findings and the rubric. A writer with a security background can explain a PTES phase, review your draft report for structure and clarity, or prepare a custom report you can study before writing your own.
We never run tests against real systems, and we never log in to your UMGC classroom or lab.
GradeEssays is independent of the University of Maryland Global Campus. Our work is a study and reference aid, to be used within UMGC's academic integrity policy. Orders are written from scratch, include free revisions within the scope of your original request, and are refunded in full if late.
Turn Your CMIT 386 Lab Work into a Clear Report
Share the scenario, scope and your findings. A cybersecurity writer prepares a custom report structure you can learn from and check against.
Start My Pen Test Report HelpFree revisions · Full refund if late · Written from scratch for your order
Frequently Asked Questions
UMGC lists CMIT 291 or CMIT 391 (or CompTIA Linux+ or LPIC-1 certification) and CMIT 321 (or EC-Council Certified Ethical Hacker certification).
UMGC states that the course is designed to help prepare for the CompTIA PenTest+ exam. The exam itself is taken separately through CompTIA.
The Penetration Testing Execution Standard (PTES), which runs from pre-engagement interactions through intelligence gathering, threat modeling, vulnerability analysis, exploitation and post-exploitation to reporting.
UMGC names Kali Linux and the Metasploit Framework. Expect common Kali utilities for scanning and enumeration alongside them.
A lab write-up shows what you did. A report tells a manager what is at risk, how serious it is and what to do, with the technical proof kept in supporting sections.
No. We do not access your lab or classroom. We explain concepts, give feedback on your drafts and provide model material you can learn from.