CompTIA PenTest+ PT0-003 Study Guide 2026

What Is the CompTIA PenTest+ PT0-003 Exam?

The CompTIA PenTest+ PT0-003 is an intermediate-level certification for professionals who plan, scope, and execute penetration tests. Updated in 2024, PT0-003 reflects current attack techniques, modern reporting standards, and a heavier emphasis on cloud and hybrid environments than its predecessor. The exam consists of up to 85 questions — a mix of multiple-choice and performance-based — with a 165-minute time limit. Passing score is 750 out of 900.

CompTIA recommends at least three years of hands-on security experience and Security+ before attempting PenTest+. That guidance is realistic — this is not a beginner certification, and the scenario-based questions assume familiarity with real attack workflows.

The 5 PenTest+ Exam Domains

PT0-003 is organized around five domains. Understanding the weight of each helps you allocate study time correctly:

• Domain 1 — Engagement Management (18%): Scoping, rules of engagement, contracts, threat modeling, and communication with stakeholders.
• Domain 2 — Reconnaissance and Enumeration (21%): Passive and active recon, OSINT, network scanning, service enumeration, and target profiling.
• Domain 3 — Vulnerability Discovery and Analysis (16%): Vulnerability scanning, false positive analysis, prioritization, and manual verification of findings.
• Domain 4 — Attacks and Exploits (30%): The largest domain. Network, web application, wireless, cloud, and social engineering attacks. Exploitation, lateral movement, and privilege escalation.
• Domain 5 — Post-Exploitation and Reporting (15%): Persistence, pivoting, data exfiltration, cleanup, and writing professional pentest reports.

Legal and Ethical Considerations You Must Know

PenTest+ dedicates significant coverage to the legal and ethical framework surrounding penetration testing. These are not throwaway questions — they appear in scenario format and require precise answers:

• Statement of Work (SOW) and Rules of Engagement (ROE): Every engagement requires written authorization. The exam tests your ability to identify what is and is not in scope.
• Computer Fraud and Abuse Act (CFAA): US federal law governing unauthorized computer access. You need to understand how it applies to pentest scenarios.
• Data handling: What to do when you inadvertently discover sensitive data (PII, PHI) during an engagement.
• Third-party cloud environments: AWS, Azure, and GCP each have their own penetration testing policies. Testing without authorization from the cloud provider — not just the client — is a violation.

Tools Tested on PenTest+ PT0-003

PT0-003 tests conceptual and practical knowledge of industry-standard penetration testing tools. You do not need to memorize syntax perfectly, but you need to understand what each tool does, when to use it, and what its output means:

• Nmap: Network discovery and port scanning. Know common flags (-sV, -sC, -O, -p-, --script) and how to interpret output.
• Metasploit Framework: Exploitation framework. Understand the msfconsole workflow: search, use, set options, exploit. Know the difference between payloads and exploits.
• Burp Suite: Web application proxy for intercepting and modifying HTTP traffic. Key for testing OWASP Top 10 vulnerabilities.
• Mimikatz: Post-exploitation credential dumping on Windows. Understand pass-the-hash and pass-the-ticket attacks.
• Gobuster / Dirb: Directory and file enumeration against web servers.
• Wireshark / tcpdump: Packet capture and analysis. Know how to identify cleartext credentials and ARP poisoning.

Balancing Labs and Theory in Your Study Plan

PenTest+ is unique among CompTIA exams in that hands-on lab experience is nearly mandatory for passing. A purely book-based study approach will leave you unprepared for the performance-based questions (PBQs), which simulate real terminal environments and require you to complete tasks rather than select answers.

A balanced 8-week study plan looks like this: spend the first three weeks on Domain 1, 2, and 5 (engagement management and reporting) using study guides and video courses. Then dedicate weeks four through seven to Domains 3 and 4 with daily lab work in platforms like TryHackMe, Hack The Box, or a local Kali Linux VM. Reserve the final week for full practice exams and reviewing weak areas.

When you encounter scenario-based questions you do not understand, tools like Certify Copilot AI can explain the reasoning behind the correct answer — not just flag what is right or wrong. For a broader view of where PenTest+ fits in your career, see our CompTIA certification path guide.