On this page
Intro
CompTIA PenTest+ validates the skills of penetration testers: planning an engagement, gathering information, finding and analyzing vulnerabilities, carrying out attacks, and reporting. The current version is PT0-003. CompTIA recommends 3–4 years of hands-on penetration testing experience along with Network+ and Security+ level knowledge, or equivalent. CertMonk can help organize review alongside practice in a lab you own. The details come from CompTIA’s PenTest+ page.
The exam mixes multiple-choice and performance-based questions, so preparation should include both recall and applying techniques to a scenario.
Exam at a glance
| Detail | PenTest+ PT0-003 |
|---|---|
| Exam code | PT0-003 |
| Questions | Up to 90 |
| Time | 165 minutes |
| Passing score | 750 on a 100–900 scale |
| Question types | Multiple-choice and performance-based |
| Price | Check the vendor’s site for current pricing |
| Retirement | CompTIA says exam versions typically retire about three years after launch; confirm the date on the certification page |
Source: CompTIA PenTest+ page, reviewed November 7, 2026.
Version update. CompTIA’s page states that the previous version, PT0-002, retired on June 17, 2025, so PT0-003 is the version to study. If a course or book mentions PT0-002 objectives, compare it with the current list before relying on it.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Engagement management | 13% | Scope, rules, legal issues, communication and reporting. |
| Reconnaissance and enumeration | 21% | Gather information and map targets. |
| Vulnerability discovery and analysis | 17% | Find weaknesses and judge their importance. |
| Attacks and exploits | 35% | Carry out attacks against networks, applications and more. |
| Post-exploitation and lateral movement | 14% | Persist, pivot and clean up after access. |
Attacks and exploits is by far the largest domain, but the other four together hold the majority, so a tester who only practices exploitation will leave marks on the table. Use CompTIA’s current objectives document as your checklist and confirm the weights on the certification page.
What each domain really tests
Engagement management
This domain is about doing the work legitimately and professionally. Study how an engagement is scoped, which documents authorize testing, how rules of engagement are set and what to do when a test touches something outside the scope. Learn what goes into a report and how to explain findings to different audiences.
Practice writing a short scope statement and a one-paragraph finding with a risk rating and a recommended fix. These small deliverables are the connective tissue of the whole exam.
Reconnaissance and enumeration
Distinguish passive from active information gathering, and know what each can reveal. Study scanning, service and version detection, enumeration of users, shares and services, and how to read the output of common tools.
For every technique, write what you learned about the target and what you would do next. Reconnaissance questions often ask for the next logical step, not the most aggressive one.
Vulnerability discovery and analysis
Learn how scanners work, what authenticated and unauthenticated scans see differently and why results require validation. Practice separating true findings from false positives, and ranking findings by exposure and potential impact.
Be ready to interpret scanner output and scripts at a basic level. Reading a short script and describing what it does is a skill worth practicing weekly.
Attacks and exploits
This is the largest domain, so allow the most lab time. Cover attacks on network services, authentication, web applications, wireless, cloud, and social engineering at the concept level, along with attacks on specialized systems. For each class, note how it works, what a successful attempt looks like and which control would have stopped it.
Performance-based questions often present a scenario and ask you to choose or order steps. Rehearse by describing an attack path from first access to objective in plain language, then compare it with the techniques named in the objectives.
Post-exploitation and lateral movement
Study persistence, privilege escalation, pivoting between systems, credential harvesting and data staging. Know how to clean up after testing and why documenting every change matters.
A useful exercise is to take one compromised host in your lab and map what an attacker could reach next. Then write what evidence your actions would leave for a defender to find.
The topics above follow CompTIA’s PenTest+ objectives; the exercises are our learning approach.
A realistic six-week study plan
This plan assumes you have network and security fundamentals and some lab experience. It is a suggested schedule, not a promise about readiness. Add time if scanning tools or scripting are new to you.
Week 1: engagement management and setup
Read the objectives, build an isolated lab and learn the engagement documents. Write a sample scope and a sample finding.
Week 2: reconnaissance and enumeration
Practice passive and active gathering and read tool output. For each result, write the next step you would take.
Week 3: vulnerability discovery
Run scans, validate findings and rank them. Add untimed practice and review every uncertain choice.
Week 4: attacks and exploits, part one
Cover network, authentication and web attacks in your lab. Note the control that defends against each.
Week 5: attacks and exploits, part two, and post-exploitation
Finish the remaining attack classes, then study persistence, pivoting and cleanup. Leave one session open for catch-up.
Week 6: mixed review under time pressure
Add timed practice, including scenario items. Separate rushed reading from missing knowledge and spend remaining sessions on recurring gaps.
Make a deliberate readiness decision. Finishing six weeks is an organizational milestone, not proof of readiness.
Common mistakes and how to avoid them
- Studying only exploitation. Four of the five domains are about everything around the attack.
- Ignoring scope and authorization. Legitimate, documented testing is part of the exam.
- Memorizing tool switches without understanding output. Practice interpreting results.
- Studying PT0-002 material. That version has retired; use current objectives.
- Skipping performance-based practice. Rehearse ordering steps and explaining a path in your own words.
- Rushing into timed practice. Build clear reasoning untimed first, then use the clock to check pacing.
How to use practice questions well
After each practice item, explain why the chosen answer fits and why each alternative does not. Review wrong-answer explanations for the assumption that misled you, and add that concept to your next session.
CertMonk includes explanations for every answer choice, randomized practice tests, timed and untimed modes, flip-card flashcards, study games and progress by exam domain. Use the domain view to choose follow-up work, and flashcards for brief review between lab sessions.
Keep a separate list of correct guesses and revisit them later without the answer choices in front of you. When you add timed practice, use the result to investigate your preparation rather than to predict an exam outcome.
Free practice questions
Use the free PenTest+ samples below to explore the explanations and spot areas to review without a purchase.
In an authorized physical assessment, a tester reads a staff member’s building badge from a short distance in the lobby and produces a working copy that opens the office doors. The badges use an older low-frequency proximity technology with no cryptographic protection. Which recommendation BEST addresses the root cause?
- AReplace the badges with cards that use cryptographic authentication, and add a PIN at high-risk doors.
- BReissue every member of staff a new badge of the same type, each carrying a new card number.
- CGive every member of staff a shielding sleeve and close the finding once all the sleeves have been handed out.
- DPost a guard in the lobby to watch for anyone who stands unusually close to members of staff.
Show the answer and explanation
Answer: A. Replace the badges with cards that use cryptographic authentication, and add a PIN at high-risk doors.
Correct. The badges can be copied because they only broadcast a fixed number. Cards that prove possession cryptographically cannot be cloned by reading them, and a second factor protects the most sensitive doors.
Why not the others
- B. New numbers on the same technology can be read and copied in exactly the same way.
- C. Sleeves help only when people use them every time, and the badge remains copyable whenever it is out of the sleeve.
- D. A reader can work from a bag or at a distance in many places besides the lobby. Watching for it does not make the badges any harder to copy.
Takeaway: Legacy proximity badges transmit a fixed identifier that can be copied. The root-cause fix is cryptographically authenticated credentials, with a second factor where the risk is highest.
Source: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
During authorized subdomain enumeration, every candidate name from a wordlist appears to resolve, and all of them return the same address. What is the MOST likely explanation, and how should the tester handle the results?
- AThe tester’s own DNS resolver is faulty, so enumeration of this domain should be abandoned.
- BThe client hosts every one of those subdomains on one shared server, so each should be scoped and tested as a separate site.
- CThe zone has a wildcard record; resolve a random name that cannot exist and discard results matching that answer.
- DAn intrusion prevention system is actively blocking the scan, so the tester should slow the query rate.
Show the answer and explanation
Answer: C. The zone has a wildcard record; resolve a random name that cannot exist and discard results matching that answer.
Correct. A wildcard record answers for any name, so every guess succeeds. Comparing against a deliberately nonsensical name gives the baseline to filter out.
Why not the others
- A. A broken resolver would fail for other domains too. Consistent answers for one zone point to how that zone is configured, and the enumeration can continue with filtering.
- B. It is implausible that every word in a list is a real hostname. Treating them all as targets inflates scope with names that do not exist.
- D. Blocking produces failures or timeouts, not successful answers. Slowing down would not change a zone that answers every name.
Takeaway: When every guessed subdomain resolves to one address, suspect a wildcard record. Establish a baseline with an impossible name and filter against it before recording anything as a real host.
Source: MITRE ATT&CK T1590: Gather Victim Network Information
A tester plans an authenticated dynamic scan of a production HR application using a real test account. The application has pages that delete employee records, send emails to staff and log the user out. The client wants broad coverage without disrupting the business. How should the tester configure the scan?
- ARun the full default scan overnight, when few HR staff are using the system
- BRun it unauthenticated only, so that no dangerous function can be reached
- CExclude logout and destructive actions, and prefer a staging copy if one exists
- DRun the scanner’s default crawl and audit policy so every page is exercised
Show the answer and explanation
Answer: C. Exclude logout and destructive actions, and prefer a staging copy if one exists
Correct. Excluding logout keeps the session alive, and excluding deletions and email sends prevents business impact. A production-like staging copy removes the remaining risk.
Why not the others
- A. Timing reduces the number of people affected but does not stop deleted records or sent emails. The harm is the same at 2 a.m.
- B. This avoids the risk by giving up most of the coverage the client asked for. Authenticated scanning with exclusions keeps both goals.
- D. A default crawl will submit every form it finds, including record deletion and staff emails, which can destroy data and alarm employees.
Takeaway: Before an authenticated dynamic scan, exclude logout and state-destroying or notification-sending functions, and scan a staging copy when possible. Off-hours timing lowers visibility, not damage.
Source: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
An internal test is ending. During it, the team created two test accounts, uploaded a small helper tool to three servers and added a scheduled task on one host. Which close-out action is MOST appropriate?
- AAsk the client to reimage the affected servers, since that is the only reliable way to remove test artifacts.
- BRemove every account, file and task the team created, verify removal, and list anything that could not be removed in the report.
- CLeave the items in place so the client’s administrators can study them and learn how they were used.
- DDisable the two test accounts but keep the tool and task, since those cannot be used without an account.
Show the answer and explanation
Answer: B. Remove every account, file and task the team created, verify removal, and list anything that could not be removed in the report.
Correct. Testers remove what they introduced, confirm it is gone, and tell the client about anything left so it can be dealt with deliberately.
Why not the others
- A. Reimaging is disruptive and unnecessary when the team has a record of exactly what it changed and can reverse it.
- C. Test artifacts left behind are real weaknesses, for example accounts with known passwords. Teaching belongs in the report, not in live systems.
- D. A scheduled task runs without an interactive login, and an uploaded tool is still an unmanaged binary on production servers.
Takeaway: Keep a running log of everything introduced during a test, remove it all at close-out, verify removal, and report anything that remains.
Source: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
A client supplies a scope document listing IP ranges and domain names for an external penetration test. While validating the scope before testing begins, the tester finds that one listed hostname resolves into an address block registered to a third-party SaaS provider that hosts the client’s marketing site. The client owns the domain name but not the infrastructure. What should the tester do NEXT?
- AHold that host out of testing until the client obtains written authorization from the provider, or agrees in writing to remove the host from scope.
- BRun only a light, non-intrusive port scan to establish whether the provider’s platform should be considered in scope.
- CRestrict work on that host to passive open-source research and note the observation in the final report without raising the discrepancy during the engagement.
- DTest the host as listed, because the client put it in the scope document and controls the domain name.
Show the answer and explanation
Answer: A. Hold that host out of testing until the client obtains written authorization from the provider, or agrees in writing to remove the host from scope.
Correct. Authority to test follows the owner of the asset, not the owner of the DNS name. Either the provider authorizes the work or the host leaves scope, and the decision is recorded.
Why not the others
- B. A port scan is already active interaction with third-party property. Using testing activity to decide whether you are allowed to test inverts the authorization sequence.
- C. Staying passive avoids the unauthorized-testing problem but quietly narrows the agreed scope. A scope discrepancy is a client decision and must be raised when it is found, not disclosed at the end.
- D. A client cannot grant permission over systems it does not own or control. Relying on the scope document alone leaves the tester without lawful authorization for that target.
Takeaway: Authorization attaches to the asset owner, not to the domain name or to the party who wrote the scope document. Scope discrepancies found during validation are escalated to the client and resolved in writing before any packets are sent.
Source: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
FAQ
Which version of PenTest+ is current?
CompTIA’s page lists PT0-003 and states that PT0-002 retired on June 17, 2025. See the PenTest+ page.
How many questions are on the exam?
CompTIA lists up to 90 questions, a mix of multiple-choice and performance-based, in 165 minutes.
What score do I need?
CompTIA lists 750 on a 100–900 scale.
Which domain is the largest?
Attacks and exploits, at 35%. Reconnaissance and enumeration is next, at 21%.
What experience does CompTIA recommend?
CompTIA recommends 3–4 years of hands-on penetration testing experience and Network+ and Security+ level knowledge, or equivalent.
How long should I study?
Use six weeks as a starting framework if you already have security and lab experience. Add time where your notes show gaps.
Next step
Try free practice questions → https://app.certmonk.app/samples
