CompTIA PenTest+
CompTIA PenTest+ (PT0-003, launched December 2024) covers the full penetration-testing engagement lifecycle. Five domains: engagement management, reconnaissance and enumeration, vulnerability discovery and analysis, attacks and exploits, and post-exploitation and lateral movement. Maximum 90 multiple-choice and performance-based questions, 165 minutes, passing score 750 on a scaled 100-900 scale.
Exam fee at last check: $439, per the vendor. The official objectives are at www.comptia.org/en-us/certifications/pentest/. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
- Engagement Management13%
- Reconnaissance and Enumeration21%
- Vulnerability Discovery and Analysis17%
- Attacks and Exploits35%
- Post-Exploitation and Lateral Movement14%
Source: Vendor exam objectives. Checked 2026-09-26. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
What's on the exam
Engagement Management 13%
Rules of engagement, scoping, legal authorization, and the reporting/communication deliverables that used to be their own domain under PT0-002.
- Statement of Work, Rules of Engagement, Master Service Agreement
- Authorization scope: included assets, excluded assets, testing window, escalation path for real incidents found mid-test
- Compliance: PCI DSS, HIPAA, GDPR effects on penetration testing scope
- Report structure: executive summary vs technical findings body, severity classification, post-engagement cleanup
Primary sources: CompTIA PenTest+ (PT0-003) Certification Exam Objectives, PTES (Penetration Testing Execution Standard)
Reconnaissance and Enumeration 21%
Passive and active information gathering, and enumerating hosts/services/accounts to plan the attack phase.
- Passive recon: WHOIS, DNS, certificate transparency logs, Shodan/Censys, GitHub leaks
- Active recon: port scanning, service/version enumeration, banner grabbing
- Active Directory enumeration: identifying accounts with Kerberos pre-authentication disabled (AS-REP roasting setup)
- Username enumeration via application response differences
Primary sources: NIST SP 800-115 Technical Guide to Security Testing
Vulnerability Discovery and Analysis 17%
Authenticated vs unauthenticated scanning, validating findings, and prioritizing by real-world exploitability, not just CVSS score.
- Authenticated (credentialed) scans surface local vulnerabilities unauthenticated scans miss
- False positive vs false negative classification through manual verification
- CISA KEV catalog as a stronger exploitability signal than CVSS alone
Primary sources: CISA Known Exploited Vulnerabilities (KEV) Catalog
Attacks and Exploits 35%
The largest domain by far. Network, Active Directory, application, wireless, cloud, and physical/social engineering attacks.
- Active Directory attacks: Kerberoasting, AS-REP roasting, golden ticket, pass-the-hash
- Application attacks: OWASP Top 10 (SQL injection, XSS, SSRF, directory traversal, IDOR)
- Cloud attacks: SSRF against the instance metadata service (IMDS) to steal IAM credentials
- WAF evasion techniques for signature-based filtering
- Physical and social engineering: phishing, tailgating/piggybacking
Primary sources: OWASP Top 10, MITRE ATT&CK
Post-Exploitation and Lateral Movement 14%
What happens after initial access: privilege escalation, persistence, moving to other hosts, and required engagement cleanup.
- Privilege escalation via local misconfigurations (e.g., SUID binaries)
- Persistence mechanisms (scheduled tasks, services) that survive the original exploited vulnerability being patched
- Lateral movement using harvested credentials to reach additional hosts
- Cleanup: removing every tester-introduced artifact before the engagement closes
Primary sources: CompTIA PenTest+ (PT0-003) Certification Exam Objectives
Exam-day strategy
Read each scenario's scope language carefully. PenTest+ tests scope discipline as much as exploitation knowledge.
Watch for ethical / legal traps. Many distractors are technically correct exploitation steps but exceed scope or break the law.
On PBQs, identify the engagement phase (engagement management, recon, vulnerability analysis, exploitation, post-exploitation) first; that often narrows the right answer immediately.
Memorize MITRE ATT&CK technique IDs for the major AD attacks (T1558 Kerberoasting, T1003 Credential Dumping, T1078 Valid Accounts) and OWASP Top 10 categories.
Pace at roughly 1 minute 50 seconds per question. Flag heavy-PBQ items and return.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of CompTIA. PenTest+ is a trademark of CompTIA. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.