PenTest+
CompTIA PenTest+ (PT0-003)
CompTIA PenTest+ (PT0-003) is the intermediate-level penetration testing certification covering the full pen test methodology, from planning, scoping, and legal authorization through information gathering, scanning, exploitation, post-exploitation, and professional reporting. It is the only pen test certification with both performance-based questions and multiple choice, validating hands-on attack skills alongside conceptual knowledge.
Study Materials in C3RT
PenTest+ Exam Overview
| Detail | Information |
|---|---|
| Full Name | CompTIA PenTest+ (PT0-003) |
| Governing Body | CompTIA |
| Number of Questions | 85 |
| Time Limit | 165 minutes |
| Passing Score | 750/900 |
| Exam Fee | $392 USD |
| Category | IT Certifications |
| C3RT App Available On | iPhone, iPad, and Mac |
| Official Source | CompTIA official website ↗ |
PenTest+ Content Areas and Domains
| Domain / Content Area | Exam Weight |
|---|---|
| Planning and Scoping | 14% |
| Information Gathering and Vulnerability Scanning | 22% |
| Attacks and Exploits | 30% |
| Reporting and Communication | 18% |
| Tools and Code Analysis | 16% |
Domain weights are approximate and based on the CompTIA content outline. Always verify at the official source before your exam.
Topics Covered
- ✓ Planning & Scoping, rules of engagement, compliance, statement of work, authorizations, threat modeling
- ✓ Information Gathering & Vulnerability Scanning, passive/active recon, OSINT, network scanning, service enumeration
- ✓ Attacks & Exploits, network attacks, web application attacks (OWASP Top 10), social engineering, wireless attacks, cloud attacks
- ✓ Reporting & Communication, executive summaries, technical findings, remediation recommendations, risk ratings
- ✓ Tools & Code Analysis, Nmap, Metasploit, Burp Suite, Gobuster, Hydra, Python/Bash scripting for automation
How C3RT Helps You Pass the PenTest+
Adaptive Practice
Questions adapt to your weak areas automatically so every study session on the PenTest+ is time well spent.
Diagnostic Mocks
Full-length mock exams timed to the real PenTest+ format with detailed score breakdowns by topic.
Mistake Bank
Every wrong answer is saved for targeted re-drill. The system resurfaces your mistakes until they stick.
Native on iOS & Mac
Built with SwiftUI, not a web wrapper. Instant load, offline support, hardware-speed rendering.
Sample PenTest+ Practice Questions
Q1.When preparing the final report, which format element most effectively supports diverse stakeholder involvement such as technical teams, management, and legal advisors?
- A highly technical report focusing on detailed vulnerability data.
- An executive summary highlighting key findings and business impact.Correct
- A checklist of vulnerabilities without contextual explanation.
- A raw data appendix with no summarization.
An executive summary bridges technical details and business impact, addressing needs of various stakeholders. A highly technical report (Option 0) may overwhelm non-technical readers. A checklist without context (Option 2) lacks insight. Raw data only (Option 3) is insufficient for decision-making.
Q2.While conducting banner grabbing on an HTTP server, you receive a response header indicating "X-Powered-By: PHP/7.3.5". What is the significance of this information in your penetration test?
- It discloses the server-side technology and version, which can be cross-referenced for known vulnerabilities.Correct
- It confirms the server is immune to SQL injection attacks.
- It guarantees the server is running on Windows OS.
- It reveals the encryption protocol used for HTTPS connections.
The 'X-Powered-By' header reveals the server-side language and version, useful for identifying known vulnerabilities. This information does not guarantee immunity to SQL injection. It does not specify the underlying OS, and PHP runs on multiple OS platforms. It does not disclose encryption protocols used for HTTPS.
Q3.A penetration tester finds that a web application does not use HTTPS and transmits session cookies in plaintext. What is the primary threat, and which mitigation should be recommended?
- Session hijacking; implement TLS with secure cookie flagsCorrect
- Cross-Site Request Forgery; add CSRF tokens
- SQL Injection; sanitize all database inputs
- Buffer Overflow; apply input length validation
Without HTTPS, session cookies are sent in plaintext, enabling attackers to intercept and hijack sessions. Implementing TLS and setting secure cookie flags prevent this. CSRF, SQL Injection, and Buffer Overflow are unrelated to unencrypted session cookie transmission.
PenTest+ Frequently Asked Questions
What does PenTest+ stand for?
PenTest+ stands for CompTIA PenTest+ (PT0-003). It is administered by CompTIA.
Who administers the PenTest+?
The CompTIA PenTest+ (PT0-003) (PenTest+) is administered by CompTIA. For official information, visit the CompTIA website.
How many questions is the PenTest+?
The PenTest+ consists of 85 questions. Candidates are given 165 minutes to complete the exam.
How many practice questions does C3RT have for the PenTest+?
The C3RT app includes 6,000 practice questions for the PenTest+, along with 1,500 flashcards, 300 concept reels, and 400 concept cards.
What is the passing score for the PenTest+?
The passing score for the PenTest+ is 750/900, as set by CompTIA. Scoring methodology and passing standards may be updated periodically. Always verify current requirements with the governing body.
How much does the PenTest+ exam cost?
The PenTest+ exam fee is $392 USD. This fee is set by CompTIA and may vary by testing centre, region, or membership status. Additional fees for registration or rescheduling may apply.
How does PenTest+ compare to GPEN and CEH?
PenTest+ is generally considered intermediate-level. GPEN (GIAC) is more technically rigorous with scenario-based questions requiring deep practical knowledge aligned to SANS SEC560. CEH (EC-Council) covers a very wide range of topics but is considered shallower in technical depth by practitioners. PenTest+ is good for building a foundation; GPEN or OSCP (Offensive Security) are preferred for professional pen testing roles.
What is OSCP and how does it compare to PenTest+?
OSCP (Offensive Security Certified Professional) is the industry's most respected hands-on pen testing certification, it requires passing a 24-hour live hacking exam on real machines with no multiple choice. PenTest+ includes both multiple choice and performance-based questions. OSCP is significantly harder and more respected for professional penetration tester roles; PenTest+ is more accessible and meets DoD 8140 requirements.
What scripting does PenTest+ test?
PenTest+ PT0-003 added expanded scripting coverage, candidates are expected to understand Python and Bash scripts for automation and to analyze existing scripts for malicious behavior (code analysis). Common tasks include identifying what a script does, recognizing common exploit patterns, and understanding how attackers use scripting for automation, payload delivery, and post-exploitation.
What is a rules of engagement (RoE) document?
The Rules of Engagement document formally defines the scope, boundaries, and permissions for a penetration test, what systems can be tested, what attack techniques are permitted or prohibited, what happens if critical systems are disrupted, notification procedures, and the testing window. PenTest+ tests RoE because pen testing without documented authorization is illegal, and scope creep can cause significant damage to client systems.
How difficult is the CompTIA PenTest+ exam?
CompTIA PenTest+ (PT0-003) is considered intermediate to advanced in difficulty, with a mix of multiple-choice and performance-based questions. The exam covers penetration testing methodologies, tools, and reporting. Most candidates with prior security experience and 2–3 months of focused study pass on the first attempt.
What are the eligibility requirements for CompTIA PenTest+?
There are no mandatory prerequisites. CompTIA recommends Network+, Security+, and 3–4 years of hands-on penetration testing or vulnerability assessment experience. PenTest+ is designed for junior to mid-level penetration testers and security consultants.
How long should I study for CompTIA PenTest+?
Most candidates invest 2–3 months in preparation, covering reconnaissance, exploitation, post-exploitation, and reporting phases. Hands-on lab practice using tools like Metasploit, Nmap, and Burp Suite is essential alongside study guides and practice exams.
What career value does CompTIA PenTest+ provide?
PenTest+ validates penetration testing and ethical hacking skills in a vendor-neutral format. It is suitable for roles in ethical hacking, red team operations, and vulnerability assessment. Salaries for PenTest+ holders in penetration testing roles typically range from $70,000 to $110,000+.
What is the CompTIA PenTest+ retake policy?
No waiting period for the first retake; a 14-day wait applies after a second failure. CompTIA standard policies apply for all subsequent attempts.
How long is CompTIA PenTest+ valid?
PenTest+ is valid for three years. It can be renewed through the CompTIA CE program with 60 CEUs or by passing the current version of the exam. Earning SecurityX also renews PenTest+.
What continuing education is required for CompTIA PenTest+ renewal?
Renewal requires 60 CEUs over three years. CEUs from security conferences (such as DEF CON or Black Hat), CTF competitions, and professional development courses all typically qualify under CompTIA's CE program.
How does CompTIA PenTest+ compare to EC-Council CEH?
Both cover ethical hacking and penetration testing, but the EC-Council CEH is older, more widely recognized internationally, and requires documented work experience or mandatory training. CompTIA PenTest+ has no experience prerequisite and is stronger in the DoD 8570 framework (CSSP Incident Responder approved). CEH tends to command slightly higher name recognition in enterprise and government markets; PenTest+ is better positioned in the CompTIA certification ecosystem.
C3RT is a native iOS and macOS exam preparation platform covering the CompTIA PenTest+ (PT0-003) (PenTest+), a IT Certifications certification, administered by CompTIA. C3RT is not affiliated with or endorsed by CompTIA. Certification names and trademarks are the property of their respective organisations. For official exam registration, eligibility requirements, and content outlines, visit the CompTIA official website ↗ .