CompTIA PenTest+ (PT0-003) Study Guide
CompTIA PenTest+ covers the full penetration-testing workflow, and the current exam is PT0-003, which launched on 17 December 2024; the previous version retired on 17 June 2025. It is up to 90 questions in 165 minutes with performance-based tasks, and needs 750 on a 100–900 scale. The domains run from engagement scoping and rules of engagement through reconnaissance, attacks and exploitation, to post-exploitation and reporting — including the written deliverable, which is the part most candidates underestimate.
Overview
Level
Intermediate
Vendor
CompTIA
Audience
Aspiring penetration testers, vulnerability analysts, and defenders who want to understand offence properly. CompTIA recommends three to four years in a penetration-testing role with Network+ and Security+ level knowledge. This is not an entry-level security certification, and offensive work is rarely a first job — most people arrive from a SOC, systems or networking seat, which is the honest route in.
Why get PenTest+
PenTest+ proves you can actually run a penetration test end to end—not just understand attacks in theory, but plan an engagement, find and exploit vulnerabilities, move laterally, and write the report that makes it useful. It's one of the few pentest certs that is both hands-on and vendor-neutral, and the PT0-003 version added current topics like cloud, API, and AI/ML attack techniques. It carries DoD 8140 approval for offensive-security workforce roles. For someone targeting a penetration testing, red team, or vulnerability-analyst role, PenTest+ is a recognized way to validate practical offensive skill.
Salary expectations
Typical salary range
$90,000 – $140,000
Offensive security pays well. Entry-level penetration testers and junior red teamers commonly start around $80K–$100K, with experienced pentesters reaching $110K–$140K and senior/red-team and consulting roles going higher. PenTest+ is most valuable backed by demonstrable hands-on skill—lab work, write-ups, and a portfolio matter as much as the cert.
When to get PenTest+
Take PenTest+ when you already break things in a lab regularly and can read the output without reaching for a walkthrough. It suits people who want a vendor-neutral credential covering the whole engagement — scoping, testing and the report — rather than a single toolchain. If your target is a dedicated red-team job, hands-on practical exams tend to carry more weight with technical interviewers, and a portfolio of write-ups carries more than either; PenTest+ is the one that gets through HR filters and government role requirements. PT0-003 is expected to run until roughly 2027.
Exam details
Exam Quick Reference
- Exam Code
- PT0-003
- Vendor
- CompTIA
- Level
- Intermediate
- Duration
- 165 minutes
- Format
- Up to 90 questions: multiple choice and performance-based. Passing score: 750 (on a scale of 100–900).
- Questions
- Up to 90 questions
Renewal: Valid for 3 years. Renew through CompTIA's Continuing Education (CE) program by earning CEUs, or by passing a higher-level CompTIA exam. PenTest+ also renews lower CompTIA certs.
Facts on this page last verified September 24, 2026 against official CompTIA sources.
Skills covered
Engagement Management (13%)
- Pre-engagement: scoping, rules of engagement, and legal concepts
- Governance, risk, and compliance considerations
- Communication and collaboration during an engagement
- Professionalism and ethical conduct
- Managing the testing process and deliverables
Reconnaissance & Enumeration (21%)
- Passive recon and open-source intelligence (OSINT)
- Active scanning with Nmap and similar tools
- Enumeration of hosts, services, and users
- Network, host, and application discovery
- Documenting and prioritizing findings
Vulnerability Discovery & Analysis (17%)
- Running and interpreting vulnerability scans
- Analyzing code and configurations for weaknesses
- Identifying network, web, wireless, and cloud vulnerabilities
- Validating findings to remove false positives
- Tooling: Nessus, Burp Suite, and analysis utilities
Attacks & Exploits (35%)
- Exploiting network, web application, and wireless targets
- Cloud, API, and IoT/OT attack techniques
- AI/ML and supply-chain attack concepts
- Social engineering and physical attacks
- Using Metasploit and exploitation frameworks
Post-exploitation & Reporting (14%)
- Lateral movement, persistence, and privilege escalation
- Pivoting and maintaining access
- Cleanup and covering the engagement responsibly
- Writing clear, actionable penetration-test reports
- Recommending remediation and communicating risk
Step-by-step study path
This sequence reflects what consistently works. Follow it in order—don't skip ahead.
- 1
Download the PT0-003 exam objectives
Get the official PenTest+ PT0-003 objectives from CompTIA. They follow the real engagement lifecycle—planning through reporting—so they double as a mental model for the whole exam.
- 2
Confirm your security and networking base
PenTest+ assumes Security+ level knowledge plus networking comfort. If TCP/IP, common services, or core security concepts are shaky, shore them up first—exploitation builds on understanding how systems work.
- 3
Work through a primary video course
Choose one comprehensive PT0-003 course and complete it end to end. Jason Dion's PenTest+ course on Udemy covers all five domains with tool demos. See the paid resources section.
- 4
Read the official study guide
The Sybex PenTest+ Study Guide (PT0-003) by Chapple, Shimonski & Seidl is the standard written reference. Use it to deepen the attacks-and-exploits domain, which is 35% of the exam.
- 5
Practice on hands-on hacking platforms
Offensive skill comes from doing. Work through TryHackMe and Hack The Box machines, learn Nmap, Burp Suite, and Metasploit by using them. Build a home lab and attack it. This is the single highest-value activity.
- 6
Drill performance-based questions
PenTest+ is heavy on PBQs—analyzing tool output, choosing the right command, interpreting a scan. Practice them specifically. Knowing a tool conceptually is different from using it correctly under time pressure.
- 7
Take timed practice exams
Use full-length PT0-003 practice exams. Aim to score consistently above 85% before booking. Review every miss and reproduce the technique in your lab to truly understand it.
- 8
Schedule and sit the exam
Register through Pearson VUE for the 165-minute exam (test center or online proctored). Book about two weeks out to set a deadline. Pace yourself—PBQs take longer than multiple-choice.
Ready for a structured course?
A top-rated course covers every PenTest+ exam domain in order. See the paid resources section below for options and pricing.
View course options →Free resources
The official PT0-003 objectives across all five domains. Your study roadmap—start here.
Guided, browser-based offensive-security labs covering recon, exploitation, and reporting. The most accessible free way to build PenTest+ hands-on skill.
Real vulnerable machines to practice the full attack chain. The free tier plus HTB Academy modules map well to the attacks-and-exploits domain.
Free, practical ethical-hacking content on tools and techniques—great for building the offensive intuition the exam rewards.
Active community with PenTest+ study advice and recent PT0-003 pass reports. Search the PenTest+ flair before posting.
Paid resources
The resources below are the most commonly recommended for the PT0-003 exam. Prices reflect typical pricing—discounts run frequently.
| Provider | Type | Price | Best for | Link |
|---|---|---|---|---|
| Udemy – Jason Dion PenTest+ (PT0-003) Complete Course | Video Course | ~$15–$20 (on sale) | Most candidates – full coverage of all five PT0-003 domains with tool demonstrations and a practice exam | |
| Udemy – PenTest+ (PT0-003) 6 Practice Exams | Practice Exams | ~$15–$20 (on sale) | Final exam preparation with realistic, timed questions across all five domains | |
| CompTIA PenTest+ Study Guide PT0-003 (Sybex, Chapple, Shimonski & Seidl) | Book | ~$45–$60 | Candidates who want the definitive written reference covering 100% of the PT0-003 objectives |
Udemy – Jason Dion PenTest+ (PT0-003) Complete Course
Video Course · ~$15–$20 (on sale)
Most candidates – full coverage of all five PT0-003 domains with tool demonstrations and a practice exam
Jason Dion's PenTest+ course is highly rated and aligned to the current PT0-003 objectives. Pair with hands-on lab practice.
Udemy – PenTest+ (PT0-003) 6 Practice Exams
Practice Exams · ~$15–$20 (on sale)
Final exam preparation with realistic, timed questions across all five domains
Six full-length practice exams timed to match the real PT0-003. Use to gauge readiness before booking.
CompTIA PenTest+ Study Guide PT0-003 (Sybex, Chapple, Shimonski & Seidl)
Book · ~$45–$60
Candidates who want the definitive written reference covering 100% of the PT0-003 objectives
The standard PenTest+ book, updated for the PT0-003 V3 objectives (including cloud, API, and AI/ML attacks). Best used alongside a video course and hands-on labs.
Affiliate links (buttons) may earn us a commission at no extra cost to you. Plain text links are unaffiliated references and earn us nothing. Affiliate disclosure →
Vouchers & exam cost
The PT0-003 exam runs about $404–$425 USD. Verify current pricing on the official CompTIA store before purchasing; voucher + retake bundles are sometimes available.
Frequently asked questions
Is CompTIA PenTest+ worth it?
For offensive-security roles, yes. PenTest+ is hands-on, vendor-neutral, and DoD-8140 approved for penetration-testing workforce roles. It's most valuable backed by demonstrable lab skill—employers want to see you can actually do the work.
PenTest+ or CEH — which is better?
PenTest+ is more hands-on and performance-based; CEH is broader and more theory-heavy with stronger brand recognition in some HR filters. PenTest+ tends to better reflect real pentesting ability. Many people choose based on which their target employers list.
Is PenTest+ good for beginners?
It's intermediate, not entry-level. There's no formal prerequisite, but PenTest+ assumes Security+ level knowledge and real comfort with attacking tools. Newcomers should build a foundation with Security+ and lab practice (TryHackMe, Hack The Box) first.
How hard is the PT0-003 exam?
It's a challenging, hands-on exam. The attacks-and-exploits domain alone is 35%, and performance-based questions require real tool fluency. Candidates who put serious time into hands-on labs find it fair; those who only watch videos often struggle.
How long does it take to study for PenTest+?
Most candidates spend 3 to 6 months, much of it on hands-on practice. Those already doing security work may move faster. Lab time on platforms like TryHackMe and Hack The Box is the highest-value preparation.
Should I take CySA+ before PenTest+?
Not required, but they complement each other—CySA+ is the defensive (blue team) analyst cert, PenTest+ is the offensive (red team) one. Doing both gives a rounded security profile. Order depends on whether you lean defensive or offensive.
Does PenTest+ expire?
Yes. PenTest+ is valid for three years. Renew through CompTIA's Continuing Education program by earning CEUs or passing a higher-level CompTIA exam. Renewing PenTest+ also renews lower CompTIA certs.
Jobs where PenTest+ shows up
2 roles in our Career Navigator list PenTest+ as worth having. Each page covers what the job involves day to day, its honest downside, and the typical pay.
- Application Security EngineerSecond step · CoreThe attacker perspective, formalised.
- Penetration TesterSecond step · CoreThe methodology and reporting side, properly covered.
Not sure which of these fits you? Take the free Navigator assessment →
More CompTIA certifications
Ready to study?
Start with the free resources above, then add a top-rated course and practice exams when you're ready to test yourself.