CompTIA · PT0-003
CompTIA PenTest+ validates the skills required to plan, scope, and execute penetration testing engagements across network, web, cloud, and AI environments. It covers the full pentest lifecycle from reconnaissance and exploitation through post-exploitation, reporting, and communication of findings.
Practice Questions
699
≈ 7 practice exams
Duration
165 minutes
Passing Score
750/900
Difficulty
ProfessionalLast Updated
Mar 2026
PT0-003 weights Attacks and Exploits heaviest by a wide margin at 35 percent of the exam, followed by Reconnaissance and Enumeration at 21 percent, Vulnerability Discovery and Analysis at 17 percent, Post-exploitation and Lateral Movement at 14 percent, and Engagement Management at 13 percent. This practice bank of 699 questions is built to match that split, so exploitation and post-exploitation scenarios, over a third of the real exam, get matching depth.
On test day you face a maximum of 90 questions in 165 minutes, mixing multiple-choice with performance-based questions, and you need a scaled 750 on a 100 to 900 scale to pass. PT0-003 (V3) launched December 17, 2024, replacing the previous version with more emphasis on real exploitation technique over pure methodology recall. The performance-based questions simulate hands-on pentest tasks, so timed practice matters as much as knowing the terminology.
CompTIA recommends 3 to 4 years of experience in a penetration tester role, with Network+ and Security+ level knowledge as a foundation, though there is no formal prerequisite. CompTIA raised prices across its exam lineup around June 2026; check the official CompTIA store for the current voucher price before buying. The certification is valid for 3 years, renewed with 60 CEUs, CertMaster CE training, or retaking the current exam. Start with the 30 free questions to benchmark yourself, then work through the full 699-question bank until your accuracy holds steady across all five domains.
CompTIA PenTest+ (PT0-003) is a professional-level certification that validates the skills required to plan, scope, and execute penetration testing engagements across diverse environments including networks, web applications, cloud platforms, and AI systems. The certification demonstrates expertise across the full penetration testing lifecycle, from initial reconnaissance and vulnerability discovery through active exploitation, post-exploitation techniques, lateral movement, and comprehensive reporting. The PT0-003 version, launched December 17, 2024, represents the latest iteration of this credential and emphasizes modern attack surfaces and contemporary threat landscapes.
CompTIA PenTest+ is designed for security professionals with 3–4 years of hands-on experience in penetration testing or offensive security roles. Ideal candidates include penetration testers, ethical hackers, security analysts, vulnerability assessment specialists, and security consultants seeking to validate and advance their offensive security expertise. The certification is particularly valuable for professionals working in organizations requiring demonstrated competency in identifying and exploiting system vulnerabilities, as well as those pursuing careers in red team operations, bug bounty programs, or managed security services.
CompTIA recommends that candidates possess a minimum of 3–4 years of practical experience in a penetration testing role. Additionally, candidates should hold CompTIA Network+ and Security+ certifications or demonstrate equivalent knowledge in networking fundamentals, security concepts, and system administration. While formal prerequisites are not strictly enforced, candidates without this background may find the exam challenging, as it assumes proficiency with networking protocols, cryptography, operating systems, and security frameworks. Hands-on experience with penetration testing tools, vulnerability assessment platforms, and exploitation techniques is essential preparation.
The PT0-003 exam consists of a maximum of 90 questions combining multiple-choice and performance-based question types. The exam duration is 165 minutes (2 hours and 45 minutes), allowing approximately 1.8 minutes per question on average. The exam is delivered online through Pearson VUE testing centers worldwide and is available in English, French, Japanese, and Portuguese. Scoring is on a scale of 100–900, with a passing score of 750. The exam includes unscored pretest questions used for item analysis and future exam development. The previous version (PT0-002) retires on June 17, 2025, with PT0-003 estimated to remain current until approximately 2027.
Holding the CompTIA PenTest+ certification significantly enhances career prospects in the cybersecurity field. Penetration testers with this credential command competitive salaries, with median annual earnings around $110,540–$131,970 in the United States, representing 75–175% above the median national wage. The credential is increasingly featured in job postings across the industry and validates expertise required for roles such as Penetration Tester, Security Analyst, Red Team Specialist, and Vulnerability Assessment Specialist. The Bureau of Labor Statistics projects 32% growth in information security analyst positions through 2032, while the U.S. penetration testing market is expected to triple by 2028, indicating strong demand for certified professionals. PenTest+ has gained rapid adoption among employers and is recognized as a credible validation of offensive security skills, particularly in organizations requiring demonstrated competency in vulnerability identification and remediation. The certification positions holders for advancement into senior security roles, management positions, and specialized careers in bug bounty programs and managed security services.
5 sample questions with answers and explanations. The full bank has 699 questions, enough for 7 full-length practice exams.
Preview — answers shown1. You are performing a stealth scan of Woodgrove Bank's external network. The client is concerned about triggering IDS alerts and wants the scan to be as slow and undetectable as possible, even if it takes several days. Which Nmap timing template should you use? (Select one!)
Explanation
The -T0 (Paranoid) timing template is the slowest and most stealthy option, serializing scans to send one probe every 5 minutes, making it extremely difficult for IDS systems to correlate traffic as a scan. This is appropriate when detection avoidance is the highest priority and time is not a constraint. -T1 (Sneaky) is also slow but sends probes every 15 seconds, which is faster and slightly more detectable. -T2 (Polite) slows down scans to use less bandwidth but is not optimized for IDS evasion. -T3 (Normal) is the default timing and makes no special attempt at stealth.
2. During an authorized penetration test of Adatum's internal network, a tester uses wmiexec.py from the Impacket suite to execute commands on a remote Windows host. The client's security team asks why the tester preferred wmiexec over PsExec for lateral movement. Which explanation BEST justifies this choice? (Select one!)
Explanation
wmiexec uses Windows Management Instrumentation (WMI) to execute commands remotely without dropping any binary to disk or creating a Windows service on the target. PsExec, by contrast, copies an executable (PSEXESVC.exe) to the target's ADMIN$ share and creates a service named PSEXESVC, both of which are easily detected by endpoint detection tools, antivirus, and Windows Event ID 7045. wmiexec's semi-interactive shell operates entirely through WMI, leaving a much smaller footprint. Both tools require valid credentials, with wmiexec typically needing username and password or NTLM hash. Neither tool provides a GUI session. Both tools only support Windows targets as WMI is a Windows-specific technology.
3. You need to scan Adatum's Terraform infrastructure-as-code repository for security misconfigurations before deployment. Which IaC scanning tool uses graph-based resource relationship analysis and supports Terraform, CloudFormation, Kubernetes, ARM templates, and Helm charts? (Select one!)
Explanation
Checkov by Bridgecrew uses graph-based analysis to understand resource relationships and scan infrastructure-as-code across Terraform, CloudFormation, Kubernetes, ARM templates, and Helm charts. TruffleHog is specifically for secrets scanning (not IaC misconfigurations). Trivy does scan IaC but is the successor to tfsec and focuses on containers, vulnerabilities, and secrets in addition to IaC without graph-based analysis. KICS (by Checkmarx) scans IaC but uses query-based detection with approximately 1,900+ queries rather than graph-based relationship analysis.
4. During reconnaissance of Adatum Corporation, a tester uses the following Google dork: site:adatum.com filetype:pdf intext:confidential. What is the primary purpose of this search? (Select one!)
Explanation
Google dorks use advanced search operators to discover specific types of information indexed by Google. This particular query searches for PDF files on the target domain containing the word confidential, which could reveal sensitive documents like financial reports, strategic plans, or internal policies that were unintentionally exposed. The site operator limits results to the target domain, filetype restricts to PDFs, and intext searches document content. This technique does not identify SQL injection vulnerabilities, enumerate servers directly, or map network topology, though PDF metadata could separately provide additional reconnaissance information.
5. Adatum's development team must choose security testing tools for a new microservices application. The QA team can instrument the runtime environment during testing. Leadership requires early SDLC integration, low false positives, and analysis of third-party dependencies. Which combination addresses all requirements? (Select three!)
Multiple correct answersExplanation
SAST (Static Application Security Testing) analyzes source code early in the SDLC without requiring a running application, meeting the early integration requirement with tools like Bandit for Python or Checkmarx. IAST (Interactive Application Security Testing) instruments the runtime during QA testing, providing gray-box analysis with significantly lower false positive rates than DAST due to runtime context. SCA (Software Composition Analysis) specifically addresses third-party dependencies, identifying vulnerable libraries and supply chain risks with tools like Snyk or OWASP Dependency-Check. DAST requires fully running applications in late SDLC and has higher false positive rates. Nikto is black-box web scanning without dependency analysis. Manual testing alone does not scale for continuous integration pipelines.
A maximum of 90 questions in 165 minutes, mixing multiple-choice with performance-based questions.
A scaled 750 on a 100 to 900 scale.
CompTIA does not publish exam pricing directly on its certification page; check the official CompTIA store or a Pearson VUE checkout for the current price before buying, since CompTIA raised prices across its lineup around June 2026.
Attacks and Exploits (35%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Post-exploitation and Lateral Movement (14%), and Engagement Management (13%).
None formal. CompTIA recommends 3 to 4 years of experience in a penetration tester role, with Network+ and Security+ level knowledge.
December 17, 2024 (version 3 of the exam), with more emphasis on hands-on exploitation technique than the prior version.
Yes, after 3 years. Renew with 60 CEUs, CertMaster CE training, or by retaking the current exam.
CompTIA does not publish an official pass rate. The performance-based questions simulating hands-on pentest tasks are usually what trips up candidates who’ve only studied methodology, not practiced technique.
CompTIA DataSys+ (DS0-001)
DS0-001 · 700 questions
CompTIA Linux+ (XK0-006)
XK0-006 · 699 questions
CompTIA Network+ (N10-009)
N10-009 · 699 questions
CompTIA Project+ (PK0-005)
PK0-005 · 696 questions
CompTIA SecAI+ Certification (CY0-001)
CY0-001 · 600 questions
CompTIA Security+ (SY0-701)
SY0-701 · 700 questions
$17.99
One-time access to this exam