PenTest+ study guide
PenTest+ · Work through your exam, one topic at a time.
PenTest+ is CompTIA's vendor-neutral penetration testing certification. The current version, V3, is delivered under exam series code PT0-003 and validates that a candidate can plan and scope an engagement, perform reconnaissance and enumeration, discover and analyze vulnerabilities, execute attacks, and conduct post-exploitation and lateral movement work before documenting findings and recommending remediation. The PenTest+ study guide has 5 sections and about 1,730 words.
01Engagement Management
Engagement management covers everything that happens before the first packet and after the last one: scoping, authorization, contracts, compliance obligations, resource planning, communication, and reporting. Questions here test judgment as much as recall, so learn the artifacts and what each one controls.
365 words, about 2 min02Reconnaissance and Enumeration
Recon splits into two halves, and exams love the distinction. Passive reconnaissance collects information without sending traffic to the target: search engines and Google dorks, WHOIS, DNS records held by third parties, certificate transparency logs, Shodan/Censys, social media, job postings, code repository leaks, and breach data.
356 words, about 2 min03Vulnerability Discovery and Analysis
This domain is about finding weaknesses and, more importantly, deciding which ones are real and which ones matter. Discovery methods include vulnerability scanners, web application scanners, manual testing, configuration review, SAST (analyzing source or bytecode without running it), DAST (testing a running application), software composition analysis for dependencies, fuzzing, and threat modeling to map the attack surface.
349 words, about 2 min04Attacks and Exploits
This domain asks you to match a vulnerability to a working technique and to know the side effects. Group your knowledge by layer.
327 words, about 2 min05Post-Exploitation and Lateral Movement
Once access is proven, the engagement continues under the same scope, with more caution. Post-exploitation objectives typically include privilege escalation, credential access, persistence, lateral movement, data discovery, and - only if authorized - exfiltration.
333 words, about 2 min