CompTIA PenTest+ study plan
CompTIA PenTest+ · Give each week a clear focus.
8 weeks · About 6 hours per week
Engagement management & Reconnaissance and enumeration
Draft a scoping document for a fictional client that lists in-scope hosts, out-of-scope assets, testing windows, and emergency contacts.
Explain the difference between rules of engagement, a statement of work, and a master service agreement in your own notes.
Set up an isolated lab (hypervisor plus two VMs) and record the network diagram and IP ranges you will use.
Build a checklist of legal and compliance items to confirm before testing (written authorization, data handling, notification path).
Your checkpoint
A one-page engagement package containing the scope statement, rules of engagement summary, lab network diagram, and pre-engagement checklist.
Reconnaissance and enumeration
Perform passive reconnaissance on a target you own or a sanctioned practice range and log every source you queried.
Enumerate DNS records (A, MX, TXT, NS) and document what each record reveals about the target's infrastructure.
Use certificate transparency and search-engine operators to find subdomains, then verify which ones resolve.
Capture banner and service information from at least five open ports and map each to a likely service version.
Your checkpoint
A reconnaissance report for one target listing discovered hosts, subdomains, exposed services, and the evidence source for each finding.
Reconnaissance and enumeration & Vulnerability discovery and analysis
Run an authenticated and an unauthenticated vulnerability scan against the same lab host and compare the results.
Triage scan output by removing false positives and ranking the remainder by exploitability and business impact.
Map at least five findings to CVSS base scores and justify each metric choice in writing.
Write a finding in the standard format: title, description, evidence, risk rating, and remediation.
Your checkpoint
A vulnerability analysis worksheet covering five findings with CVSS scores, false-positive notes, and remediation recommendations.
Vulnerability discovery and analysis & Attacks and exploits
Exploit one validated vulnerability in the lab and capture proof of concept without causing service disruption.
Analyze a web application for input-handling flaws and demonstrate one injection or authentication weakness in a controlled environment.
Explain how to safely validate a finding before exploitation and document the guardrails you applied.
Compare at least three exploitation tools and note when each is the appropriate choice.
Your checkpoint
A proof-of-concept write-up for one exploited vulnerability including pre-checks, commands used, evidence, and cleanup steps.
Attacks and exploits
Demonstrate a password attack against a lab account and record the lockout and detection behavior observed.
Execute a network-level attack (for example, spoofing or interception) in the isolated lab and capture the traffic evidence.
Test one wireless or physical-social vector conceptually and describe the controls that would stop it.
Build a decision tree that maps a discovered weakness to the appropriate attack technique.
Your checkpoint
An attack log documenting three distinct techniques with the target, method, result, and the defensive control that would have prevented each.
Attacks and exploits & Post-exploitation and lateral movement
Escalate privileges on a lab host from a low-privilege account and document each step.
Establish a foothold and then move laterally to a second lab host using harvested credentials.
Collect and organize post-exploitation evidence (accounts, shares, configuration) without exceeding the agreed scope.
Identify what artifacts your actions left behind and how a defender would detect them.
Your checkpoint
A post-exploitation summary showing the escalation path, lateral movement chain, data collected, and detection opportunities for each step.
Post-exploitation and lateral movement & Engagement management
Write the executive summary and technical findings sections of a penetration test report from your week 3-6 evidence.
Prioritize remediation actions by risk and assign each a realistic owner and timeframe.
Prepare a client debrief outline covering scope, methodology, key risks, and next steps.
Verify that every finding in the report is traceable to captured evidence and stays within the authorized scope.
Your checkpoint
A complete mock penetration test report with executive summary, methodology, findings, risk ratings, and remediation roadmap.
Engagement management & Reconnaissance and enumeration & Vulnerability discovery and analysis & Attacks and exploits & Post-exploitation and lateral movement
Complete two timed practice assessments and record your score by domain.
Review every missed question and write a one-line reason for each error.
Re-drill the two weakest domains with focused lab or note review.
Finalize a one-page reference sheet of commands, tools, and report language you will review before the exam.
Your checkpoint
A score-tracking sheet showing domain results across both practice assessments plus a personal weak-area remediation list.
Milestones
Week 2: You can produce a reconnaissance report for a target from passive and active sources without referring to a template.
Week 4: You can validate, exploit, and document one vulnerability end to end with evidence and cleanup.
Week 6: You can chain initial access to privilege escalation and lateral movement in the lab and name the detection artifact for each step.
Week 8: You score at or above 80 percent on two timed practice assessments and have a written plan for your two weakest domains.