PenTest+ PT0-003 Exam Objectives Explained: All 26 Objectives and Domain Weights
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
PenTest+ PT0-003 is built on 26 objectives in five domains, and 35% of the exam is Attacks and Exploits. The exam has up to 90 multiple-choice and performance-based questions in 165 minutes, with a passing score of 750 on a scale of 100 to 900. This guide lists every official objective title with a plain-English explanation of what it asks you to do, grouped by domain with the published weights. It also covers the recommended experience and how to study safely. The official CompTIA objectives document is the authoritative source, and the explanations here are our own wording. Use what you learn only on systems you own or have written permission to test.
PenTest+ PT0-003 at a Glance
PenTest+ is CompTIA's penetration testing certification. The current version, PT0-003 (V3), launched on December 17, 2024. All figures here come from CompTIA's certification page.
| Exam fact | PenTest+ PT0-003 |
|---|---|
| Questions | Maximum of 90 |
| Question types | Multiple-choice and performance-based |
| Length | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Recommended experience | 3 to 4 years as a penetration tester, plus Network+ and Security+ or equivalent knowledge |
| Retirement | Usually about three years after launch, estimated 2027 |
The recommended experience is a recommendation, not a prerequisite. See our comparison of the CompTIA security certification path for where PenTest+ fits after Security+.
Domain Weights and Objective Counts
PenTest+ has five domains and 26 objectives. Attacks and Exploits is the biggest domain by a wide margin, at 35% of the exam and ten of the 26 objectives.
| Domain | Weight | Objectives |
|---|---|---|
| 1. Engagement Management | 13% | 5 |
| 2. Reconnaissance and Enumeration | 21% | 4 |
| 3. Vulnerability Discovery and Analysis | 17% | 3 |
| 4. Attacks and Exploits | 35% | 10 |
| 5. Post-exploitation and Lateral Movement | 14% | 4 |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Domain 1: Engagement Management (13%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 1.1 | Summarize pre-engagement activities. | Scope, rules of engagement, written authorization, contracts and agreements, and the legal and ethical limits of a test |
| 1.2 | Explain collaboration and communication activities. | Keeping stakeholders informed, escalation paths, handling critical findings during a test, and secure communication with the client |
| 1.3 | Compare and contrast testing frameworks and methodologies. | How frameworks such as MITRE ATT&CK and OWASP structure a test and which one fits which engagement |
| 1.4 | Explain the components of a penetration test report. | Executive summary, scope, methodology, findings with risk ratings, evidence and remediation |
| 1.5 | Given a scenario, analyze the findings and recommend the appropriate remediation within a report. | Turning raw findings into prioritized, actionable fixes the client can act on |
Domain 2: Reconnaissance and Enumeration (21%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 2.1 | Given a scenario, apply information gathering techniques. | Passive and active reconnaissance, open-source intelligence and mapping a target's public footprint |
| 2.2 | Given a scenario, apply enumeration techniques. | Identifying hosts, services, users and shares once a target is in scope |
| 2.3 | Given a scenario, modify scripts for reconnaissance and enumeration. | Reading and adjusting short scripts to automate gathering and enumeration |
| 2.4 | Given a scenario, use the appropriate tools for reconnaissance and enumeration. | Choosing the right tool for the task and interpreting its output |
Domain 3: Vulnerability Discovery and Analysis (17%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 3.1 | Given a scenario, conduct vulnerability discovery using various techniques. | Scanning approaches, application testing and other ways to find weaknesses |
| 3.2 | Given a scenario, analyze output from reconnaissance, scanning, and enumeration phases. | Reading tool output to decide what is worth testing next and what is a false positive |
| 3.3 | Explain physical security concepts. | How physical controls such as locks, badges and visitor processes are tested within an authorized scope |
Domain 4: Attacks and Exploits (35%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 4.1 | Given a scenario, analyze output to prioritize and prepare attacks. | Choosing the most promising attack path from what discovery turned up |
| 4.2 | Given a scenario, perform network attacks using the appropriate tools. | Common network-layer attack techniques and the tools that demonstrate them |
| 4.3 | Given a scenario, perform authentication attacks using the appropriate tools. | Weak and reused credentials, password attacks and the controls that stop them |
| 4.4 | Given a scenario, perform host-based attacks using the appropriate tools. | Privilege escalation and abuse of weak configuration on operating systems |
| 4.5 | Given a scenario, perform web application attacks using the appropriate tools. | Injection, access control and other web flaws, such as those in the OWASP lists |
| 4.6 | Given a scenario, perform cloud-based attacks using the appropriate tools. | Misconfigurations and weak identity settings in cloud environments |
| 4.7 | Given a scenario, perform wireless attacks using the appropriate tools. | Weaknesses in wireless protocols and rogue access points |
| 4.8 | Given a scenario, perform social engineering attacks using the appropriate tools. | Phishing, pretexting and other human-targeted techniques, within the rules of engagement |
| 4.9 | Explain common attacks against specialized systems. | Mobile, IoT and operational technology systems and why they differ from standard IT |
| 4.10 | Given a scenario, use scripting to automate attacks. | Reading and writing short scripts to repeat or scale a test step |
Domain 5: Post-exploitation and Lateral Movement (14%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 5.1 | Given a scenario, perform tasks to establish and maintain persistence. | How access is kept after the first foothold, so defenders know what to look for |
| 5.2 | Given a scenario, perform tasks to move laterally throughout the environment. | Using one compromised system to reach others, and the segmentation that limits it |
| 5.3 | Summarize concepts related to staging and exfiltration. | How data is collected and moved out, and the detection points along the way |
| 5.4 | Explain cleanup and restoration activities. | Removing test artifacts and returning systems to their original state after the engagement |
How to Study for PenTest+
Penetration testing is a hands-on skill, and the exam leans on scenarios and performance-based questions, so reading alone is not enough. Always practice in environments you own or have written permission to test, such as your own lab or a deliberately vulnerable training system. Testing systems without authorization is illegal.
Build a small home lab
A few virtual machines on an isolated network let you practice scanning, enumeration and attack techniques safely and repeatably.
Practice reading tool output
Objectives 2.4, 3.2 and 4.1 ask you to interpret output and decide what to do next, so practice explaining what each line of a scan result means.
Get comfortable with short scripts
Objectives 2.3 and 4.10 expect you to read and modify scripts. You do not need to be a developer, but you should follow simple Bash, Python and PowerShell.
Do not skip engagement management
Domain 1 is 13% of the exam and covers scope, authorization and reporting, the parts that separate a professional test from unauthorized hacking.
Time your practice exams
The exam is 165 minutes with performance-based questions, so rehearse working through a scenario step by step under a clock.
Studying With DD Academy
DD Academy covers PenTest+ PT0-003 alongside Security+, Network+, CySA+, SecurityX, CISA and CISSP, with flashcards, practice questions and an AI tutor that explains why each answer is right or wrong. It is free to start on iPhone and the web.
The bottom line
PenTest+ rewards hands-on practice. Weight your study toward Attacks and Exploits and Reconnaissance, do not neglect engagement management, and practice in a lab you control. Confirm the current version and retirement date on CompTIA's page before you commit to a long plan.
Frequently asked questions
How many questions are on the PenTest+ exam?
PenTest+ PT0-003 has a maximum of 90 questions, a mix of multiple-choice and performance-based, in 165 minutes. The passing score is 750 on a scale of 100 to 900, according to CompTIA's certification page.
What are the PenTest+ PT0-003 domains and weights?
Engagement Management 13%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Attacks and Exploits 35%, and Post-exploitation and Lateral Movement 14%. The exam has 26 objectives across the five domains.
What experience does CompTIA recommend for PenTest+?
CompTIA recommends 3 to 4 years of experience as a penetration tester, plus Network+ and Security+ or equivalent knowledge. These are recommendations and not prerequisites, and many candidates take the exam earlier.
Is PenTest+ harder than Security+?
CompTIA does not publish difficulty comparisons. PenTest+ is longer (165 minutes versus 90), is aimed at hands-on testing experience and puts 35% of the exam on attacks and exploits, so it assumes more technical depth than Security+.
When does PenTest+ PT0-003 retire?
CompTIA says PenTest+ versions are usually retired about three years after launch, and estimates 2027 for PT0-003, which launched December 17, 2024. Check CompTIA's PenTest+ page for the confirmed date before you start a long study plan.
Do I need a lab to study for PenTest+?
A lab is strongly recommended because the exam includes performance-based questions and many scenario questions that test practical judgment. Use only systems you own or have written permission to test, such as a home lab or a purpose-built training environment.
Should I take PenTest+ or OSCP?
They differ in format and depth. PenTest+ is a CompTIA exam with multiple-choice and performance-based questions, while the OSCP is a hands-on practical exam. See our OSCP certification study guide for how that exam works and who it suits.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
