PenTest+
CompTIA PenTest+ (PT0-003)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
PenTest+ is CompTIA's vendor-neutral penetration testing certification. The current version, V3, is delivered under exam series code PT0-003 and validates that a candidate can plan and scope an engagement, perform reconnaissance and enumeration, discover and analyze vulnerabilities, execute attacks, and conduct post-exploitation and lateral movement work before documenting findings and recommending remediation.
It suits security analysts, vulnerability management staff, and aspiring penetration testers or security consultants who already hold networking and security fundamentals; CompTIA recommends three to four years in a penetration tester role, with Network+ and Security+ or equivalent knowledge, before attempting the exam.
The V3 blueprint leans heavily toward hands-on offensive work. Attacks and exploits carries the largest share of the exam, followed by reconnaissance and enumeration, vulnerability discovery and analysis, post-exploitation and lateral movement, and engagement management. Objectives reach beyond classic network and web testing into cloud, containers, APIs, IoT, and AI systems.
Effective preparation pairs supervised lab practice with scoping and report-writing drills, because the exam rewards both technical execution and the judgment to document and communicate risk. The material on this page and in our question set is independent study content; it is not affiliated with, endorsed by, or sponsored by CompTIA.
What you'll study
About PenTest+ preparation
What is the exam format and how much time do I get?
PT0-003 contains a maximum of 90 questions, mixing multiple-choice with performance-based items, and runs 165 minutes. The passing score is 750 on a scale of 100 to 900. Budget your time so the performance-based scenarios get real attention rather than whatever is left at the end.
How hard is PenTest+ compared with Security+?
It is generally considered a step up, because performance-based items ask you to apply offensive technique rather than recall definitions. CompTIA recommends three to four years in a penetration tester role plus Network+ and Security+ or equivalent knowledge, which is a good signal of the expected baseline.
Can I retake the exam if I fail the first attempt?
Retake terms are set by CompTIA and are not published in the source material we track, so confirm current policy on their site before booking. CompTIA does sell bundles that pair practice or learning products with a voucher plus Retake Assurance, which reduces the cost of a second attempt.
Which domain should I study first?
Start with engagement management even though it is the smallest domain, because scoping, rules of engagement, and reporting frame every later task and appear inside scenario questions. Then move to reconnaissance and enumeration, vulnerability discovery, attacks and exploits, and finally post-exploitation and lateral movement.
Do I need Network+ and Security+ before taking this exam?
They are recommended, not enforced. CompTIA lists three to four years in a penetration tester role with Network+ and Security+ or equivalent knowledge as recommended experience. If you already have strong networking, TCP/IP, and authentication fundamentals from another route, that background can substitute.
What languages is the exam offered in?
The source lists English, French, Japanese, and Portuguese. If you are testing in a non-English delivery, check availability in your region when you schedule, since appointment capacity varies by country and language.
How long is the certification valid, and when does V3 retire?
A validity period is not stated in the source we track, so verify it with CompTIA directly. The source estimates retirement roughly three years after launch, which puts V3 around 2027. The prior exam retired on June 17, 2025, so plan to sit PT0-003 rather than an older code.
What are the most common ways candidates fail?
Running out of time on performance-based items, neglecting the reporting and scoping objectives because they seem non-technical, and skipping the newer cloud, container, and AI objectives. Practicing full-length timed sets, including written findings, exposes all three weaknesses before exam day.
Is PT0-003 the same thing as PenTest+ V3?
Yes. V3 is the exam version and PT0-003 is its series code; the version launched on December 17, 2024. Study material labelled for PT0-002 targets the retired exam and will miss the cloud, container, and AI attack objectives added in this version.