CompTIA PenTest+ study guide
CompTIA PenTest+ · Work through your exam, one topic at a time.
CompTIA PenTest+ (exam series PT0-003, version V3) is a vendor-neutral certification that validates the ability to identify, mitigate, and report system vulnerabilities across the full penetration-testing lifecycle. CompTIA positions it for practitioners who plan and scope engagements, perform active and passive reconnaissance and enumeration, conduct and validate vulnerability scans, execute network, host-based, web application, cloud, and AI-targeted attacks, and then maintain persistence, move laterally, and document findings with remediation recommendations. The CompTIA PenTest+ study guide has 5 sections and about 2,321 words.
01Engagement Management
Engagement management covers everything before the first packet and everything that constrains it afterwards: authorization, scoping, legal and compliance obligations, communication and closeout. The exam tests whether you can distinguish 'the client asked us to' from 'we are legally permitted to', and turn a business request into a defensible test plan.
493 words, about 2 min02Reconnaissance and Enumeration
This domain turns a company name into a map of reachable assets, then into users, shares, services and versions. The exam separates passive collection that never touches the target from active probing that does, and expects you to match tool and protocol to question.
492 words, about 2 min03Vulnerability Discovery and Analysis
This domain converts scanner output into defensible findings. The exam tests tool selection, credentialed versus uncredentialed trade-offs, scoring, and the analysis step that separates a real vulnerability from a banner match.
434 words, about 2 min04Attacks and Exploits
This is the largest domain: network, wireless, application, credential and human attacks, plus the mechanics of delivering a payload and holding a session. Exam items give you an observed condition and expect the correct attack, with its safety and legal constraints.
477 words, about 2 min05Post-Exploitation and Lateral Movement
This domain demonstrates business impact after the first foothold: escalating privilege, harvesting credentials, moving to other hosts and proving access to sensitive data, all inside the rules of engagement and data-handling limits. Prove impact; do not maximize damage.
425 words, about 2 min