Domain 1: Engagement Management
- Written authorization (a signed Statement of Work plus a 'get-out-of-jail-free' authorization letter) is the legal prerequisite for any test; without it, activity violates the Computer Fraud and Abuse Act (CFAA) and equivalent laws.
- Rules of Engagement (RoE) define what, when, and how testing occurs: in-scope and out-of-scope targets, test windows, allowed techniques, escalation paths, and emergency contacts.
- Scope documents must explicitly list authorized IP ranges, domains, applications, and infrastructure, plus excluded systems, to avoid touching out-of-scope or third-party assets.
- Agreement types matter: an MSA sets overarching terms, the SOW defines the specific engagement, and an NDA governs confidentiality; black-, gray-, and white-box models set the knowledge level provided.
- Regulatory frameworks shape scope and handling: PCI DSS governs cardholder data, HIPAA governs protected health information, and GDPR governs EU personal data.
- Cloud and third-party hosting requires confirming each provider's testing policy; providers still prohibit certain test types (e.g., DoS and DNS-zone-walking) even where pre-authorization is not required.
- Common standards and methodologies include PTES, OSSTMM, NIST SP 800-115, the OWASP testing guides (WSTG/MASVS), and the MITRE ATT&CK framework for aligning tests to realistic adversaries.
- Communication triggers require pausing and notifying the client: discovery of a prior or active breach, evidence of criminal activity, or a critical finding that needs out-of-band disclosure before the report.
- Deconfliction, de-escalation, situational awareness, and goal reprioritization keep the engagement aligned with the client and blue team as conditions change during testing.
- A complete report contains an executive summary (business risk, non-technical) for leadership and detailed technical findings with reproduction steps, evidence, and CVSS rationale for engineers.
- Findings are prioritized by risk so the client fixes the highest-impact issues first; identical findings across many hosts are deduplicated and mapped to a common root cause while preserving evidence.
- For systemic issues, recommend the design-level fix (segmentation, secure baseline) plus interim compensating controls, and document the full attack path so the client understands real-world impact.
- A retest/closure step with stable finding identifiers and a per-finding status field confirms remediation, and a formal close-out/readout meeting aligns stakeholders on fixes and priorities.
- Reports are a roadmap of exploitable weaknesses, so they must be encrypted at rest and in transit, delivered over a secure channel, and governed by a defined retention/destruction policy.
Domain 2: Reconnaissance and Enumeration
- Passive reconnaissance collects data without touching the target: WHOIS, DNS records, certificate transparency logs, job postings, and social media (OSINT); it generates no target traffic.
- Active reconnaissance sends packets directly to targets (port scans, banner grabbing) and creates entries in the target's firewall and IDS/IPS logs.
- Nmap -sS performs a stealthy SYN (half-open) scan; -sT is a full TCP connect scan; -sU scans UDP; -sn does host discovery (ping sweep) with no port scan.
- Nmap -sV detects service and version; -O enables OS detection; -sC runs the default NSE script category; -A combines OS detection, version detection, scripts, and traceroute.
- Nmap timing templates range -T0 (paranoid) to -T5 (insane); -T3 is the default and -T4 a common faster choice; masscan --rate caps packet rate for very large sweeps.
- Nmap -Pn treats all hosts as online (skips host discovery), useful when ICMP is blocked; -p specifies ports, e.g., nmap -p 80,443,8080 target.
- A DNS zone transfer is attempted with dig axfr example.com @ns1.example.com; misconfigured name servers leak the full record set.
- Enumeration extracts specifics: SMB shares (enum4linux, smbclient, rpcclient), SNMP (snmpwalk, default community string 'public'), LDAP/AD users (ldapsearch), and SMTP VRFY/EXPN.
- OSINT tools include theHarvester (emails/subdomains), Shodan and Censys (internet-exposed devices), Maltego (link analysis), and recon-ng; Google dorking finds exposed files.
- Web content and directory enumeration uses gobuster, ffuf, or feroxbuster to brute-force paths and virtual hosts, exposing hidden endpoints and admin panels.
- Misconfigured cloud storage (public S3 buckets, Azure blobs, GCS) frequently exposes sensitive data and is a high-value passive/active recon target; cloud_enum aids discovery.
- Large environments are scanned efficiently by grouping assets into scoped batches by subnet/role, reusing a maintained asset inventory to target only deltas, and placing distributed scan engines near each segment.
- Recon evasion techniques include Nmap decoy scans (-D), packet fragmentation (-f), idle/zombie scans, source-port spoofing, and slow timing to stay under detection thresholds.
Domain 3: Vulnerability Discovery and Analysis
- Scanner findings must be manually validated because automated tools report false positives; testers confirm exploitability before listing a result as a confirmed vulnerability.
- Common scanners include Nessus, OpenVAS/Greenbone, Qualys, Nexpose, and Nikto/wpscan (web); they rely on version comparisons and banner analysis and therefore need validation.
- Authenticated (credentialed) scanning logs into targets to reduce false positives and see installed patches and configuration, whereas unauthenticated scans see only what is externally exposed.
- CVSS v3.1 scores vulnerabilities 0.0-10.0 using attack vector, complexity, privileges required, user interaction, scope, and CIA impact; a vector string encodes each metric (e.g., AV:N/AC:L/PR:N/UI:N).
- Prioritization combines CVSS severity with real exploitability and business context: risk = likelihood x impact, and EPSS or known-exploited status raises urgency above raw score.
- Research and exploit mapping use CVE/CWE/NVD entries plus searchsploit, Exploit-DB, and Metasploit search to determine whether a public exploit exists for a finding.
- Scan tuning avoids outages: throttle rate, schedule scan windows, and exclude fragile hosts (legacy/ICS/OT) that aggressive scanning can crash, causing an unintended denial of service.
- Common finding classes include misconfigurations, default or weak credentials, end-of-life/unsupported software, missing patches, and weak TLS/SSL ciphers and protocols.
- SCAP and compliance scans (PCI, CIS Benchmarks) measure configuration against a defined baseline rather than only searching for exploitable CVEs.
- Attack-surface analysis maps the discovered footprint - exposed services, ports, and entry points - to focus deeper testing where impact is highest.
- Threat modeling methodologies (STRIDE, DREAD, PASTA, attack trees) and MITRE ATT&CK mapping structure how discovered weaknesses could be chained by a realistic adversary.
- Supply-chain and third-party component risk is assessed with dependency scanning and SBOM review, since a single vulnerable library can affect many applications.
- Correlating multiple scanner outputs and distinguishing true positives from false positives with a manual proof-of-concept keeps the final finding set accurate and actionable.
Domain 4: Attacks and Exploits
- Intercepting proxies such as Burp Suite and OWASP ZAP sit between the browser and the app to capture, modify, and replay HTTP/HTTPS requests for injection and logic testing.
- SQL injection inserts SQL syntax into unsanitized input (e.g., OR '1'='1', UNION SELECT); the primary defense is parameterized queries/prepared statements; sqlmap automates exploitation.
- Cross-site scripting (XSS) injects attacker JavaScript that runs in victims' browsers; types are stored, reflected, and DOM-based; defenses include output encoding and Content Security Policy.
- Server-side request forgery (SSRF) coerces a server into making attacker-controlled requests, often used to reach cloud metadata endpoints (169.254.169.254) for credentials.
- Password attacks include dictionary, brute force, hybrid, and password spraying (one common password tried slowly across many accounts to avoid lockout); spraying evades lockout thresholds.
- Offline cracking uses GPU acceleration with targeted wordlists, rule sets, and mask attacks (Hashcat, John the Ripper) before resorting to raw brute force.
- LLMNR/NBT-NS poisoning with Responder captures NTLM hashes on a LAN; SMB relay (ntlmrelayx) forwards captured authentication to other hosts that lack SMB signing.
- Kerberoasting requests service tickets (TGS) for accounts with SPNs and cracks them offline; AS-REP roasting targets accounts with Kerberos pre-authentication disabled.
- Social engineering vectors include phishing, spear phishing, pretexting/impersonation, vishing, smishing, and physical tactics like tailgating; SET and GoPhish assist campaigns.
- On-path (man-in-the-middle) attacks include ARP spoofing/poisoning, evil twin / rogue access points, and DNS spoofing, threatening confidentiality and integrity of traffic.
- Metasploit Framework provides exploit modules, payloads (e.g., windows/meterpreter/reverse_https), and post modules; msfvenom generates and encodes standalone payloads.
- Wireless attacks include capturing WPA2 4-way handshakes (or PMKID) for offline cracking, deauthentication attacks, and exploiting WPS PINs.
- Cloud, container, and API attacks include abusing instance metadata for IAM credentials, IAM privilege escalation, container/Kubernetes escapes, and API flaws such as BOLA and mass assignment.
Domain 5: Post-exploitation and Lateral Movement
- Privilege escalation elevates access beyond what was initially granted: on Linux via permissive sudo rules and SUID root binaries (see GTFOBins), on Windows via weak service permissions, unquoted service paths, and kernel exploits (e.g., PrintNightmare).
- Lateral movement pivots from a foothold to additional systems using Pass-the-Hash, Pass-the-Ticket, SMB relay, and remote execution via PsExec, WMI (wmic /node:target process call create), or PowerShell remoting.
- Pass-the-Hash reuses a captured NTLM hash to authenticate without the plaintext password; Impacket's psexec.py and wmiexec.py both accept the -hashes syntax.
- Mimikatz dumps plaintext passwords and NTLM hashes from LSASS memory (sekurlsa::logonpasswords); DCSync (Mimikatz or Impacket secretsdump.py) replicates credentials from a domain controller.
- BloodHound with the SharpHound collector maps Active Directory attack paths, revealing the shortest route to Domain Admin and abusable ACLs.
- Persistence mechanisms that survive reboot/credential change include new services, scheduled tasks running a stored PowerShell one-liner, Run registry keys, and adding a Linux user with UID 0; authorized testers must document and later remove all of them.
- Living-off-the-land binaries (LOLBins) such as certutil, bitsadmin, and rundll32, plus native tools, help evade detection by avoiding dropped malware.
- Pivoting reaches segmented networks via SSH port forwarding, a SOCKS proxy over an SSH/Meterpreter tunnel that many tools can reuse, or tools like Chisel and Ligolo-ng.
- Token impersonation/kidnapping (e.g., Potato family exploits) and abusing SeImpersonate privileges can elevate a service account to SYSTEM.
- Data exfiltration during testing should be demonstrated with stealthy channels such as encrypted chunked HTTPS transfers and DNS tunneling, exfiltrating only proof-of-concept data.
- Cleanup obligations require removing uploaded tools and backdoors, deleting created accounts, reverting configuration changes, and restoring systems to their original state.
- Comprehensive, timestamped documentation of every action (logs, screenshots) supports an accurate, reproducible report and provides accountability for what was done within scope.
- Windows privilege-escalation gotchas include writable PATH entries letting an attacker plant a malicious C:\Program.exe, and creating a malicious MSI executed via AlwaysInstallElevated to gain SYSTEM.
- Common credential locations include LSASS memory, the SAM/SYSTEM registry hives, ntds.dit on a domain controller, and Linux /etc/shadow; /proc/<pid>/environ can leak secrets passed as environment variables.
CompTIA PenTest+ (PT0-003) exam tips
- Watch for the 'first/most important step' qualifier in engagement questions - the answer is almost always obtaining written authorization and a signed scope/RoE before any other action.
- Memorize Nmap flags cold: -sS, -sT, -sU, -sn, -sV, -O, -sC, -A, -Pn, -p, and the -T0 to -T5 timing templates; performance-based questions often ask you to build or interpret a command.
- Separate reconnaissance/enumeration (discovering hosts, services, and info) from vulnerability discovery/analysis (scanning for and validating weaknesses) - PT0-003 treats them as distinct domains.
- Map each attack to its category and tool (e.g., Responder for LLMNR poisoning, Hashcat for offline cracking, Burp/ZAP for web, BloodHound for AD paths) so terminology questions are quick wins.
- When two answers both look correct, pick the one that is safest, legal, and consistent with the rules of engagement - notifying the client and stopping usually beats continuing.
Study guide FAQ
What is the difference between PenTest+ PT0-002 and the current PT0-003 exam?
PT0-003 is the current version (PT0-002 retired) and reorganizes the objectives into five domains - Engagement Management, Reconnaissance and Enumeration, Vulnerability Discovery and Analysis, Attacks and Exploits, and Post-exploitation and Lateral Movement. It increases emphasis on hands-on attack execution, modern environments (cloud, containers, APIs, and AI/ML systems), and scripting/automation. Always study against PT0-003 objectives.
How is the exam scored and what do I need to pass?
PenTest+ uses a scaled score from 100 to 900, and you need 750 to pass. The 165-minute exam includes up to 90 questions mixing multiple-choice and performance-based (hands-on simulation) items. Performance-based questions are weighted heavily, so practice building commands and analyzing tool output.
Do I need to memorize exact tool syntax and commands?
Yes. Performance-based questions can require you to construct or interpret real commands - Nmap scans, Hashcat cracking, Metasploit/msfvenom payloads, Impacket (psexec.py/wmiexec.py) for Pass-the-Hash, and dig for zone transfers. Know the common flags, default ports, and which tool solves which problem.
How much experience should I have before taking PenTest+?
CompTIA recommends 3-4 years of hands-on information security or penetration testing experience and a Network+/Security+ level of foundational knowledge. It is an intermediate certification, so prior comfort with networking, the command line, and basic scripting (Bash, Python, PowerShell) is expected.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- CompTIA PenTest+ (PT0-003) certification pagelink and content verified 8 September 2026Exam code PT0-003. Recommended, not required: "3-4 years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge".