Skip to content
CertGPS

CompTIA PenTest+

Covers a full penetration test from scoping to report, including Active Directory, cloud and AI attacks, through scenario-based questions rather than a live lab

IntermediateCompTIA

The exam

Exam cost
$439
Study time
2-3 months
Passing score
750 (scale of 100–900)
Valid for
3 years

Before you book

  • No prerequisite certification listed
  • Recommended: 3–4 years in a penetration tester job role
  • Recommended: Network+ and Security+ or equivalent knowledge

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. CompTIA Security+

    Entry

    Comes before. Covers the security basics PenTest+ assumes, and PenTest+ renews it later

  2. CompTIA PenTest+

    You are here

  3. OffSec Certified Professional

    Advanced

    Next step. Proves the same attack skills in a 24-hour proctored hands-on exam

Study guide

Last updated

CompTIA PenTest+ PT0-003 Study Guide: What the Exam Tests and How to Prepare

PenTest+ checks that you can run a penetration test from the scoping call to the final report. Most of its objectives put you in a scenario and ask which tool, attack or finding comes next. The current exam, PT0-003, launched on December 17, 2024, and the older PT0-002 retired in June 2025. There's no live hacking lab: it's a 165-minute exam of multiple-choice and performance-based questions, and that shapes who should take it.

Who should take PenTest+

CompTIA writes the exam for three to four years in a penetration tester role, with Network+ and Security+ knowledge or the equivalent. In practice it fits a SOC or vulnerability analyst moving into offensive work, a consultant who runs authorized assessments and needs a vendor-neutral credential, and anyone filling a defense role: CompTIA says PenTest+ is recognized for DoD 8140.03M work roles such as exploitation analyst and cyber defense forensics analyst.

If you can't yet explain how a VLAN or a Kerberos ticket works, start with Security+. If you want proof that you can break into machines you've never seen under a clock, OSCP is a 24-hour proctored practical, and PenTest+ won't substitute for it. CompTIA's own FAQ compares PenTest+ with CEH, whose v13 knowledge exam has 125 multiple-choice questions in four hours plus an optional six-hour practical.

PT0-003 at a glance

ItemPT0-003 (V3)
StatusLaunched December 17, 2024; retirement estimated 2027, no date announced
QuestionsUp to 90, multiple-choice and performance-based
Time165 minutes
Passing score750 on a 100–900 scale
Price (US list)$439 voucher; $579 with one retake
DeliveryPearson VUE test center or Pearson VUE online proctoring
LanguagesEnglish, French, Japanese, Portuguese
Recommended experienceThree to four years in a penetration tester role, with Network+ and Security+ or equivalent knowledge
ValidityThree years; renew with 60 CEUs and a $150 fee

What the five domains test

Attacks and Exploits alone is 35% of PT0-003:

  • Engagement Management: 13%
  • Reconnaissance and Enumeration: 21%
  • Vulnerability Discovery and Analysis: 17%
  • Attacks and Exploits: 35%
  • Post-exploitation and Lateral Movement: 14%

That domain spreads across ten objectives, and 18 of the outline's 26 objectives begin "Given a scenario". The attack objectives lean hard on Active Directory. They name Impacket, CrackMapExec, Responder, BloodHound, Mimikatz, Rubeus and Certify, with pass-the-hash, pass-the-ticket and Kerberos attacks among the techniques. The web objective covers server-side request forgery, deserialization, server-side template injection and JSON Web Token manipulation, with sqlmap, Burp Suite, ZAP and Gobuster. Cloud gets its own objective too: metadata service attacks, container escape, and tools such as Pacu, ScoutSuite and kube-hunter.

Objective 4.9 adds attacks on AI systems, specifically prompt injection and model manipulation, next to operational technology attacks on Modbus and CAN bus. Scripting appears twice. Objective 2.3 asks you to modify Bash, Python and PowerShell scripts for reconnaissance, and 4.10 covers automating attacks with PowerView, PowerUpSQL and Scapy, plus breach and attack simulation tools such as Caldera and Atomic Red Team.

Don't skip the smallest domain. Engagement Management covers rules of engagement, statements of work and authorization letters, testing frameworks from PTES to the Purdue model, and the report itself: executive summary, methodology, detailed findings, attack narrative and remediation guidance. Objective 1.5 asks you to match findings to the right technical, administrative, operational or physical control, so it rewards knowing the defenses as well as the attacks.

A preparation plan with most of the time in a lab

CompTIA says candidates spend 8 to 12 weeks on average at 10 to 15 hours a week, so roughly 80 to 180 hours. We'd spend about two-thirds of that hands-on, in the same proportions as the domain weights.

Start by reading the PT0-003 objectives PDF line by line and marking every tool you've never run. Then work in this order:

  • Weeks 1 to 3: reconnaissance and enumeration. Run Nmap with the scripting engine, theHarvester, Amass and DNS lookups against lab targets, and modify one Python or Bash recon script so it does something new.
  • Weeks 4 to 8: attacks. Build a small Active Directory lab with one domain controller and two workstations, then capture hashes with Responder, map paths with BloodHound and move laterally with Impacket. Add web targets for SQL injection and server-side request forgery. Hack The Box and TryHackMe both offer ready-made machines if you'd rather not maintain your own.
  • Weeks 9 and 10: post-exploitation and cleanup, including persistence through scheduled tasks and services, pivoting, and the cleanup steps in objective 5.4.
  • Throughout: write a one-page finding for every machine you compromise, with a severity score and a remediation, so domain 1 is practised rather than memorized.

For reading, Mike Chapple, Robert Shimonski and David Seidl's PenTest+ Study Guide for PT0-003 (Sybex, third edition, March 2025) covers the whole outline. CompTIA's own options are CertMaster Learn ($599), CertMaster Labs ($199) and CertMaster Practice ($209). In the last week, review the "explain" objectives you can't lab: frameworks such as OSSTMM, CREST and MITRE ATT&CK, threat models such as STRIDE and DREAD, and physical attacks such as badge cloning.

Renewal and next steps

PenTest+ is valid for three years. Renewing through continuing education takes 60 continuing education units (CEUs) and a $150 fee per three-year cycle, which you pay only when you upload CEUs. Passing the newest PenTest+ exam, or earning SecurityX, renews it without the fee. PenTest+ sits above Security+ and Network+ in CompTIA's hierarchy, so it renews both. If you fail, a second attempt can follow immediately; a third needs a 14-day wait.

Where to go from here:

  • OSCP to prove the same skills in a practical exam: three standalone machines and a three-machine Active Directory set in 24 hours. OffSec's course and exam bundle costs $1,749.
  • SecurityX if you're moving toward architecture and engineering rather than deeper offense.

Our view

PenTest+ covers more of the real job than its reputation suggests: the scoping paperwork, Active Directory, cloud, AI targets and the report. What it can't show is that you'll compromise an unfamiliar host before time runs out, which is the core of offensive work. We'd treat it as a structured first credential on the way to OSCP rather than a replacement. At $439 it makes sense for an analyst moving into offense, a consultant in a DoD-mapped role, or anyone who wants one exam to renew Security+ and Network+ too. If you already root lab machines every week, spend the money on OSCP.

Sources