PenTest+ study materials
PenTest+ study resources

PenTest+ case studies

PenTest+ · Put your knowledge to work in context.

PenTest+ is CompTIA's vendor-neutral penetration testing certification. The current version, V3, is delivered under exam series code PT0-003 and validates that a candidate can plan and scope an engagement, perform reconnaissance and enumeration, discover and analyze vulnerabilities, execute attacks, and conduct post-exploitation and lateral movement work before documenting findings and recommending remediation. It suits security analysts, vulnerability management staff, and aspiring penetration testers or security consultants who already hold networking and security fundamentals; CompTIA recommends three to four years in a penetration tester role, with Network+ and Security+ or equivalent knowledge, before attempting the exam. The V3 blueprint leans heavily toward hands-on offensive work. The PenTest+ case studies are 5 cases and about 3,230 words.

1

The Billing Vendor, the Shift Change, and the Subsidiary Nobody Mentioned

Your firm signed a fixed-fee SOW with a regional hospital group (three hospitals, 4,200 staff). Authorized targets: external ranges 203.0.113.0/24 and 198.51.100.0/24, plus "the patient portal." The SOW's testing-window clause says testing may occur at any time.

623 words, about 3 min
2

Certificate Transparency, a Dangling CNAME, and an Employee's GitHub

You are in the recon phase of a 10-day external test against a national retailer. Scope: example.com and .example.com only.

656 words, about 3 min
3

1,240 Criticals, 900 Backports, and One Jenkins Box

An authenticated internal scan of 10.10.0.0/16 returns 3,812 live hosts and 1,240 Critical findings. Nine hundred of them are OpenSSH 7.4 issues on RHEL 7.9; the client's Linux team says those packages carry Red Hat backports.

647 words, about 3 min
4

One Attempt per Account, and an EDR That Is Watching

Day 4 of a covert internal assessment at a 900-person insurer. You have a foothold on FIN-WS-114 from an approved macro document.

656 words, about 3 min
5

A Service Account Between You and the PII Database

After compromising a developer workstation you find svc deploy's password in cleartext in a CI config file. svc deploy is a domain service account with local admin on JUMP-01 and a CI runner, and the DBA team's privileged sessions land on JUMP-01.

648 words, about 3 min