CompTIA PenTest+ (PT0-003)
exam objectives

48 practice questions in this domain

• 1.1Summarize pre-engagement activities (scope definition, rules of engagement, agreement types, target selection, assessment types, shared responsibility model, legal and ethical considerations)
• 1.2Explain collaboration and communication activities (peer review, stakeholder alignment, escalation path, articulation of risk, business impact analysis, client acceptance)
• 1.3Compare and contrast testing frameworks and methodologies (OSSTMM, CREST, PTES, MITRE ATT&CK, OWASP Top 10, OWASP MASVS, Purdue model, DREAD, STRIDE, OCTAVE)
• 1.4Explain the components of a penetration test report (format alignment, report components, test limitations and assumptions, reporting considerations)
• 1.5Given a scenario, analyze the findings and recommend the appropriate remediation within a report (technical, administrative, operational, and physical controls)

77 practice questions in this domain

• 2.1Given a scenario, apply information gathering techniques (active/passive reconnaissance, OSINT, protocol scanning, certificate transparency logs, banner grabbing, HTML scraping)
• 2.2Given a scenario, apply enumeration techniques (OS fingerprinting, service/protocol/DNS/directory enumeration, secrets enumeration, attack path mapping, WAF enumeration, manual enumeration)
• 2.3Given a scenario, modify scripts for reconnaissance and enumeration (Bash, Python, PowerShell; logic constructs; libraries/functions/classes)
• 2.4Given a scenario, use the appropriate tools for reconnaissance and enumeration (Nmap, Shodan, Maltego, Recon-ng, WHOIS, nslookup/dig, Amass, theHarvester, Wireshark/tcpdump, Aircrack-ng, etc.)

63 practice questions in this domain

• 3.1Given a scenario, conduct vulnerability discovery using various techniques (container/application/network/host-based/wireless scans, ICS vulnerability assessment, tools like Nikto, OpenVAS, Nessus, BloodHound)
• 3.2Given a scenario, analyze output from reconnaissance, scanning, and enumeration phases (false positives/negatives, scan completeness, public exploit selection, scripting to validate results)
• 3.3Explain physical security concepts (tailgating, site surveys, USB drops, badge cloning, lock picking)

130 practice questions in this domain

• 4.1Given a scenario, analyze output to prioritize and prepare attacks (target prioritization incl. CVSS/CVE/CWE/EPSS, capability selection, exploit customization, documentation)
• 4.10Given a scenario, use scripting to automate attacks (PowerShell/PowerSploit/PowerView, Bash, Python/Impacket/Scapy, breach-and-attack-simulation frameworks)
• 4.2Given a scenario, perform network attacks using the appropriate tools (default credentials, on-path, VLAN hopping, relay attacks; Metasploit, Netcat, Nmap, Impacket, CrackMapExec, Responder, Hydra)
• 4.3Given a scenario, perform authentication attacks using the appropriate tools (MFA fatigue, pass-the-hash/ticket/token, Kerberos attacks, LDAP injection, password spraying; hashcat, John the Ripper, Hydra, Medusa)
• 4.4Given a scenario, perform host-based attacks using the appropriate tools (privilege escalation, credential dumping, process injection; Mimikatz, Rubeus, Certify, Seatbelt, PsExec, Evil-WinRM, LOLBins)
• 4.5Given a scenario, perform web application attacks using the appropriate tools (SSRF, CSRF, deserialization, SQLi, XSS, IDOR, JWT manipulation; Burp Suite, ZAP, sqlmap, Gobuster, WPScan)
• 4.6Given a scenario, perform cloud-based attacks using the appropriate tools (metadata service attacks, IAM misconfigurations, container escape, supply chain attacks; Pacu, Docker Bench, Prowler, ScoutSuite)
• 4.7Given a scenario, perform wireless attacks using the appropriate tools (wardriving, evil twin, deauthentication, WPS PIN attack; Aircrack-ng, WiFi-Pumpkin, Kismet)
• 4.8Given a scenario, perform social engineering attacks using the appropriate tools (phishing, vishing, whaling, pretexting; SET, Gophish, Evilginx, BeEF)
• 4.9Explain common attacks against specialized systems (mobile, AI, OT, NFC, Bluejacking, RFID; Scapy, MobSF, Frida, Drozer)

52 practice questions in this domain

• 5.1Given a scenario, perform tasks to establish and maintain persistence (scheduled tasks, service creation, reverse/bind shells, C2 frameworks, backdoors, rootkits)
• 5.2Given a scenario, perform tasks to move laterally throughout the environment (pivoting, relay creation, service discovery, WMI/WinRM, LOLBins, CrackMapExec, Impacket, PsExec, Mimikatz)
• 5.3Summarize concepts related to staging and exfiltration (file encryption/compression, covert channels, cloud storage, alternate data streams)
• 5.4Explain cleanup and restoration activities (remove persistence mechanisms, revert configuration changes, secure data destruction)