Build a tool sheet early.
A candidate who passed on the first attempt with 772 credits a spreadsheet of every tool in the objectives, with what it does, whether it is command-line or graphical, and whether it is open source.
CompTIA PenTest+ (PT0-003) Exam Guide
Validates practical skills in planning, performing and reporting penetration tests, from scoping and reconnaissance to exploitation and post-exploitation.
PenTest+ tests whether you can run an authorized penetration test from start to finish. Expect questions on scoping rules, tool choice, command output, web requests and reporting. Learn the objectives with one course, practise in a lab you are allowed to test, then use timed tests to find gaps.
Understand the exam
Syllabus
1.0Engagement management13%
- 1.1Summarize pre-engagement activities.
- 1.2Explain collaboration and communication activities.
- 1.3Compare and contrast testing frameworks and methodologies.
- 1.4Explain the components of a penetration test report.
- 1.5Analyze the findings and recommend the appropriate remediation within a report.Scenario
Example scenario: Midway through a test, the client asks you to include an extra IP range that is not in the signed scope. What would you do before touching it?
2.0Reconnaissance and enumeration21%
- 2.1Apply information gathering techniques.Scenario
- 2.2Apply enumeration techniques.Scenario
- 2.3Modify scripts for reconnaissance and enumeration.Scenario
- 2.4Use the appropriate tools for reconnaissance and enumeration.Scenario
Example scenario: Public certificate records show a forgotten subdomain for the client's old customer portal. How would you confirm whether it is in scope and still active?
3.0Vulnerability discovery and analysis17%
- 3.1Conduct vulnerability discovery using various techniques.Scenario
- 3.2Analyze output from reconnaissance, scanning, and enumeration phases.Scenario
- 3.3Explain physical security concepts.
Example scenario: An authenticated scan finds many more issues than the unauthenticated scan of the same server. What does that difference tell you about the risk?
4.0Attacks and exploits35%
- 4.1Analyze output to prioritize and prepare attacks.Scenario
- 4.2Perform network attacks using the appropriate tools.Scenario
- 4.3Perform authentication attacks using the appropriate tools.Scenario
- 4.4Perform host-based attacks using the appropriate tools.Scenario
- 4.5Perform web application attacks using the appropriate tools.Scenario
- 4.6Perform cloud-based attacks using the appropriate tools.Scenario
- 4.7Perform wireless attacks using the appropriate tools.Scenario
- 4.8Perform social engineering attacks using the appropriate tools.Scenario
- 4.9Explain common attacks against specialized systems.
- 4.10Use scripting to automate attacks.Scenario
Example scenario: A search form returns your input on the results page without encoding it. What class of weakness would you suspect, and how would you show its impact safely in your report?
5.0Post-exploitation and lateral movement14%
- 5.1Perform tasks to establish and maintain persistence.Scenario
- 5.2Perform tasks to move laterally throughout the environment.Scenario
- 5.3Summarize concepts related to staging and exfiltration.
- 5.4Explain cleanup and restoration activities.
Example scenario: You created a test account and uploaded a script during the engagement. What should your cleanup checklist and report include?
Official PT0-003 exam objectives · PT0-003 (V3)
Format
- Questions
- Up to 90
- Duration
- 2h 45m
- Passing score
- 750 / 900
- Delivery
- Test centre or online
- Languages
- English, French, Japanese, Portuguese
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
A tester wants to identify the software versions running on the open ports of an in-scope host. Which Nmap option should they add to the scan?
Show answer
A. -sV probes open ports to find the service and version. -Pn skips host discovery, -oN saves output to a file and -T0 slows the scan.
Complete a task in a simulated environment, such as choosing the right tool or reading command output.
CertUp example
A scan of an internet-facing host shows 22/tcp (OpenSSH), 443/tcp (HTTPS) and 3306/tcp (MySQL) open. Choose the finding to validate first.
Show answer
3306/tcp MySQL. A database exposed to the internet is the most likely to allow weak or default credentials, so check it first.
Make a study plan
Read the objectives and list every tool they name. Choose one main course, then spend the remaining time in a lab and on questions.
Most candidates spend 60–100 hours. Plan for the low end if you already test for a living; plan for the high end if Linux, scripting or web requests are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.48 h
- 4Practice with mock examsTake timed practice tests and review every mistake.24 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
Learn the core concepts
Use one complete PT0-003 course as your main resource and the objectives as your checklist. Add the Sybex guide if you prefer reading.
Best complete coursePenTest+ PT0-003 Complete Course, Labs & Practice Exams
Best low-cost courseCompTIA PenTest+ (PT0-003) Full Course & Practice Exam
Best bookPenTest+ Study Guide, 3rd editionKeep a tool sheet. For every tool in the objectives, note what it does, a typical command and the output you would expect. Test only in your own lab or on platforms that allow it.
Practice with mock exams
Use fresh questions to find weak domains, then review why each option is right or wrong. Practise reading command output and web requests, and take full timed tests before booking.
PenTest+ (V3) Practice TestCompTIA PenTest+ (PT0-003) 6 Practice Exams
PenTest+ PT0-003 Question BankAre you ready?
- You can say what each tool in the objectives does and when you would choose it.
- You can read a short script or command output and explain what it does.
- You can finish a timed practice exam with time left to review.
Prepare for exam day
Buy a voucher and schedule with Pearson VUE. The voucher is valid for 12 months, subject to the exam retirement date.
At a test centre
Testing from home
- Bring the identification listed in your appointment confirmation, with the same name as your booking.
- Arrive at the time specified in your confirmation and store personal belongings as instructed.
- Use the exam tutorial before the 165-minute timer starts.
- Run the OnVUE system test on the computer and connection you will use.
- Prepare a private room and clear your desk.
- Have your accepted ID ready and begin check-in at the time stated in your confirmation.
Advice from exam takers
Learn exact commands and web requests.
The same candidate says they should have studied command syntax and HTTP requests more closely. A commenter who failed a first attempt describes several PBQs with a lot of scripting.