Everything on the penetration-testing exam, in one place: the five domains and their weights, a four-week study plan, a readiness checklist you can tick off, and reconnaissance / CVSS / Active Directory / engagement cheat sheets — with sourced, explained guidance throughout.
The CompTIA PenTest+ (PT0-003) validates the hands-on skills to plan and scope an engagement, find and exploit weaknesses, move through a network, and report findings to stakeholders. Here are the numbers that shape how you should study.
With up to 90 questions in 165 minutes, the performance-based questions are heavy: you may have to read scanner output, sequence an attack chain, or pick the right exploitation step. The exam is weighted across five domains, and Attacks and Exploits alone is 35% of the exam — more than a third — so it deserves the most study time, with Reconnaissance and Enumeration (21%) close behind.
What each domain covers, with the topics it drills and a link to the matching practice set. Expand a domain to dig in.
This domain is the professional discipline around a test: agreeing scope and rules of engagement, choosing the assessment type, respecting legal and ethical limits, communicating with the client, and writing a clear, prioritized report. It is small but easy points if you know the process.
The second-largest domain is about building the target picture: passive reconnaissance (OSINT, DNS, WHOIS, certificate transparency) versus active scanning, then enumerating hosts, services, OS versions, shares, and users — and using the right tools (Nmap, Recon-ng, Maltego, Censys, Wireshark) and scripts (Bash, Python, PowerShell, NSE).
Here you find weaknesses and prove they are real: choosing authenticated vs unauthenticated and static vs dynamic scans, reading scanner output, interpreting CVSS metric groups (including v4.0), and validating findings to rule out false positives before they reach the report. Tools include Nessus, OpenVAS/Greenbone, and sqlmap.
By far the largest domain at over a third of the exam. Expect scenario questions on network attacks (ARP/name-resolution poisoning, on-path, relay, VLAN hopping), authentication attacks (spraying, Kerberoasting, pass-the-hash/ticket), host and application attacks (privilege escalation, credential dumping, injection, XSS, CSRF, SSRF), and wireless, cloud/API, and social-engineering attacks. Over-invest here.
What you do after the foothold: establishing persistence (accounts, run keys, scheduled tasks, services), moving laterally and pivoting (pass-the-hash/ticket, remote services, tunneling), enumerating internal hosts and Active Directory attack paths, simulating exfiltration — and then cleaning up: removing artifacts, timestomping awareness, and documenting every change.
A realistic schedule at roughly 10–12 hours per week. Adjust to your experience — but keep the heaviest week on Attacks and Exploits, since it is over a third of the exam.
Pre-engagement, scope, rules of engagement, assessment types, and the report — then passive vs active recon, OSINT, and enumeration of hosts, services, and users with the core tooling.
Scan types (authenticated, SAST/DAST, web-app), reading Nessus/OpenVAS/sqlmap output, CVSS metric groups including v4.0, and validating findings to kill false positives.
The biggest week: network, authentication, host, and application attacks — spraying, Kerberoasting, pass-the-hash/ticket, privilege escalation, injection, XSS, SSRF — plus wireless, cloud/API, and social engineering.
Persistence, lateral movement, pivoting, AD attack paths, exfiltration, and cleanup. Then take full timed mocks, use the per-domain breakdown to find weak areas, and re-drill them. Keep the last days light.
Tick off each topic as it clicks. Your progress is saved in this browser, so you can come back to it.
Saved only in your browser — nothing leaves this device.
The reference tables worth memorizing cold — CVSS severity, common Active Directory attacks, recon tooling, scan types, and engagement essentials. Bookmark this.
| Rating | Base score range | What it tells you |
|---|---|---|
| None | 0.0 | No measurable impact |
| Low | 0.1 – 3.9 | Limited impact or hard to exploit |
| Medium | 4.0 – 6.9 | Moderate impact; remediate on schedule |
| High | 7.0 – 8.9 | Serious; expedite remediation |
| Critical | 9.0 – 10.0 | Severe; treat as urgent |
| Attack | What it does | Defense |
|---|---|---|
| Kerberoasting | Crack service-ticket hashes offline for service-account passwords | Strong, long service passwords; gMSA |
| AS-REP roasting | Crack accounts with pre-auth disabled | Require Kerberos pre-authentication |
| Pass-the-hash | Authenticate with an NTLM hash, no password | LAPS, credential guard, tiering |
| Pass-the-ticket | Reuse a stolen/forged Kerberos ticket | Limit admin reuse; monitor ticket anomalies |
| Password spraying | One common password across many accounts | MFA, lockout, strong password policy |
| Tool | Use it for |
|---|---|
| Nmap (+ NSE) | Host discovery, port/service/version scanning, scripted enumeration |
| Recon-ng | Modular OSINT framework for automated passive recon |
| Maltego | Link analysis and visual mapping of OSINT relationships |
| Censys / Shodan | Internet-wide asset and exposed-service discovery |
| Wireshark | Packet capture and protocol analysis during active recon |
| Choice | Trade-off |
|---|---|
| Authenticated vs unauthenticated | Credentialed scans see deeper config/patch detail; unauthenticated mimics an outside attacker |
| Active vs passive | Active probes targets (can disrupt); passive only observes (no impact) |
| SAST vs DAST | Static reads source code at rest; dynamic tests the running application |
| Internal vs external | Inside view finds lateral-movement risk; outside view shows the attack surface |
| Item | Why it matters |
|---|---|
| Authorization | Written permission makes testing legal; without it, testing is a crime |
| Rules of engagement | Defines targets, timing, allowed techniques, and escalation paths |
| Scope | The in-bounds systems; anything outside is off-limits |
| Shared responsibility | Determines what you may legally probe on cloud targets |
| Report & cleanup | Prioritized findings, remediation, and restoring the environment |
Take a free, explained practice test and see exactly which domains need more work.
Start a practice test