CompTIA · PT0-003
CompTIA PenTest+ validates the skills required to plan, scope, and execute penetration testing engagements across network, web, cloud, and AI environments. It covers the full pentest lifecycle from reconnaissance and exploitation through post-exploitation, reporting, and communication of findings.
Practice Questions
699
≈ 7 practice exams
Duration
165 minutes
Passing Score
750/900
Difficulty
ProfessionalLast Updated
Mar 2026
Use this PT0-003 practice exam to prepare for CompTIA PenTest+ (PT0-003) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 699 questions for CompTIA PT0-003, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Engagement Management, Reconnaissance and Enumeration, Vulnerability Discovery and Analysis, Attacks and Exploits, and Post-Exploitation and Lateral Movement. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
CompTIA PenTest+ (PT0-003) is a professional-level certification that validates the skills required to plan, scope, and execute penetration testing engagements across diverse environments including networks, web applications, cloud platforms, and AI systems. The certification demonstrates expertise across the full penetration testing lifecycle, from initial reconnaissance and vulnerability discovery through active exploitation, post-exploitation techniques, lateral movement, and comprehensive reporting. The PT0-003 version, launched December 17, 2024, represents the latest iteration of this credential and emphasizes modern attack surfaces and contemporary threat landscapes.
CompTIA PenTest+ is designed for security professionals with 3–4 years of hands-on experience in penetration testing or offensive security roles. Ideal candidates include penetration testers, ethical hackers, security analysts, vulnerability assessment specialists, and security consultants seeking to validate and advance their offensive security expertise. The certification is particularly valuable for professionals working in organizations requiring demonstrated competency in identifying and exploiting system vulnerabilities, as well as those pursuing careers in red team operations, bug bounty programs, or managed security services.
CompTIA recommends that candidates possess a minimum of 3–4 years of practical experience in a penetration testing role. Additionally, candidates should hold CompTIA Network+ and Security+ certifications or demonstrate equivalent knowledge in networking fundamentals, security concepts, and system administration. While formal prerequisites are not strictly enforced, candidates without this background may find the exam challenging, as it assumes proficiency with networking protocols, cryptography, operating systems, and security frameworks. Hands-on experience with penetration testing tools, vulnerability assessment platforms, and exploitation techniques is essential preparation.
The PT0-003 exam consists of a maximum of 90 questions combining multiple-choice and performance-based question types. The exam duration is 165 minutes (2 hours and 45 minutes), allowing approximately 1.8 minutes per question on average. The exam is delivered online through Pearson VUE testing centers worldwide and is available in English, French, Japanese, and Portuguese. Scoring is on a scale of 100–900, with a passing score of 750. The exam includes unscored pretest questions used for item analysis and future exam development. The previous version (PT0-002) retires on June 17, 2025, with PT0-003 estimated to remain current until approximately 2027.
Holding the CompTIA PenTest+ certification significantly enhances career prospects in the cybersecurity field. Penetration testers with this credential command competitive salaries, with median annual earnings around $110,540–$131,970 in the United States, representing 75–175% above the median national wage. The credential is increasingly featured in job postings across the industry and validates expertise required for roles such as Penetration Tester, Security Analyst, Red Team Specialist, and Vulnerability Assessment Specialist. The Bureau of Labor Statistics projects 32% growth in information security analyst positions through 2032, while the U.S. penetration testing market is expected to triple by 2028, indicating strong demand for certified professionals. PenTest+ has gained rapid adoption among employers and is recognized as a credible validation of offensive security skills, particularly in organizations requiring demonstrated competency in vulnerability identification and remediation. The certification positions holders for advancement into senior security roles, management positions, and specialized careers in bug bounty programs and managed security services.
5 sample questions with answers and explanations. The full bank has 699 questions, enough for 7 full-length practice exams.
Preview — answers shown1. A penetration tester is conducting a physical security assessment at Litware Corporation. An employee holds the secure door open and explicitly allows the tester to enter the restricted area without verifying credentials. Which social engineering technique was successfully demonstrated? (Select one!)
Explanation
Piggybacking occurs when an authorized person knowingly and willingly allows an unauthorized person to enter a secured area. The key distinction from tailgating is explicit employee AWARENESS and CONSENT. Tailgating involves following someone through a door without their knowledge or against their wishes. Pretexting creates a fabricated scenario to manipulate targets. Shoulder surfing involves observing credentials being entered, not physical access.
2. A penetration tester executes the following Nmap command against a target network: nmap -sS -p- -T0 192.168.1.0/24. The scan has been running for several hours with minimal progress. What is the MOST likely reason for the extremely slow scan speed? (Select one!)
Explanation
The -T0 (paranoid) timing template is designed for extreme stealth and IDS evasion, implementing a 5-minute delay between probes. This makes scans extraordinarily slow. While the -p- flag does scan all 65,535 ports instead of the default 1,000, this alone would not cause the extreme delays described. The -sS SYN scan does require root privileges but is not throttled by the OS when properly executed. The /24 subnet size is standard and not the primary cause of the delay.
3. Contoso Ltd's post-exploitation phase requires establishing persistence on compromised Windows hosts. Which TWO statements about Windows Registry Run Keys are correct? (Select two!)
Multiple correct answersExplanation
HKCU Run keys require user-level privileges and execute when the current user logs in. HKLM Run keys require administrator privileges and execute when any user logs in. Both are part of MITRE T1547.001. HKCU RunOnce requires user privileges (not admin) and the entry is automatically deleted after execution, not persisted. HKLM RunOnce requires admin privileges (not user) and also auto-deletes after one execution. The RunOnce variants execute only once and self-delete, making them less useful for persistent access than Run keys.
4. A penetration tester at Northwind wants to maximize vulnerability discovery during a network assessment. Which approach yields the most comprehensive results compared to all other options? (Select one!)
Explanation
Authenticated scanning with provided credentials discovers approximately 300% more unique vulnerabilities than any form of unauthenticated scanning. Authenticated scans can identify missing patches, insecure configurations, weak permissions, installed software versions, and internally visible vulnerabilities that an external scan cannot reach. Unauthenticated scanning, regardless of timing aggressiveness, number of source IPs, or version detection flags, is limited to what is visible from a network perspective without system access. Version detection (-sV) helps identify service versions but cannot assess internal configuration or patch state. Authenticated scanning is also required by many compliance frameworks such as PCI-DSS and HIPAA.
5. A penetration tester is analyzing captured network traffic in Wireshark and wants to exclude all traffic from IP address 192.168.50.100 from the view. Which display filter syntax is correct? (Select one!)
Explanation
In Wireshark display filters, 'ip.addr != 192.168.50.100' does NOT correctly exclude that IP because ip.addr matches both source and destination — a packet still appears if either the source OR destination differs from that IP. The correct syntax is '!(ip.addr == 192.168.50.100)', which properly negates the entire expression and hides all packets where that IP appears in either field.
CompTIA DataSys+ (DS0-001)
DS0-001 · 700 questions
CompTIA Linux+ (XK0-006)
XK0-006 · 699 questions
CompTIA Network+ (N10-009)
N10-009 · 699 questions
CompTIA Project+ (PK0-005)
PK0-005 · 696 questions
CompTIA SecAI+ Certification (CY0-001)
CY0-001 · 600 questions
CompTIA Security+ (SY0-701)
SY0-701 · 700 questions
$17.99
One-time access to this exam