CompTIA PenTest+ case studies
CompTIA PenTest+ · Put your knowledge to work in context.
CompTIA PenTest+ (exam series PT0-003, version V3) is a vendor-neutral certification that validates the ability to identify, mitigate, and report system vulnerabilities across the full penetration-testing lifecycle. CompTIA positions it for practitioners who plan and scope engagements, perform active and passive reconnaissance and enumeration, conduct and validate vulnerability scans, execute network, host-based, web application, cloud, and AI-targeted attacks, and then maintain persistence, move laterally, and document findings with remediation recommendations. The CompTIA PenTest+ case studies are 5 cases and about 3,460 words.
1The Verbal Scope Expansion
Your firm has a signed statement of work (SOW) with Northwind Logistics covering two things: the external range 203.0.113.0/28 and the HQ internal subnet 10.20.0.0/24. Testing is authorized 20:00–05:00 local for five nights, and the SOW requires notification of the client's security team within four hours of any critical finding.
694 words, about 3 min2What Passive Recon Turned Up
Meridian Health Scheduling commissions an external penetration test of meridian-sched.example and three public IP addresses listed in the SOW. The rules of engagement prohibit social engineering and phishing, and state that the SaaS provider hosting the patient portal is out of scope: "the cloud is out of scope, our provider handles it." Scope is further described as "the meridian-sched.example domain and the listed IPs." Passive work returns more than expected.
705 words, about 4 min3187 Criticals and One Real Problem
Day three of a five-day internal assessment at a 600-host regional insurer. You ran an authenticated scan with domain credentials and got 4,120 findings, of which the scanner labels 187 critical.
684 words, about 3 min4Production-Only Injection and a Lockout Counter
Blackridge Water's customer billing portal is the target. It is a production-only system with no staging copy, and a nightly batch job owns the database from 22:00 to 04:00, so the client has authorized testing 08:00–17:00 only.
687 words, about 3 min5How Far Is Far Enough
You have SYSTEM on a claims-department Windows 11 workstation, gained through an unpatched SSL VPN appliance that was in scope. The SOW says: demonstrate the maximum business impact achievable, but do not modify Active Directory, do not touch domain controllers beyond read-only queries, and do not exfiltrate real customer data.
690 words, about 3 min