Prepare from the PT0-003 objectives and use legitimate applied tasks to find gaps. This guide explains the exam, maps its five domains and includes two original exercises: reading an authorization and checking what a script result really establishes.
Which version applies and how the exam runs
PT0-003 is PenTest+ V3, launched December 17, 2024. Match your study materials to this exam code and its current objectives.
The exam is offered in English, French, Japanese and Portuguese. PT0-002 retired June 17, 2025. CompTIA currently estimates PT0-003 retirement around 2027; that estimate is not a fixed announced date.
CompTIA recommends three to four years in a penetration-testing role and Network+ and Security+ knowledge or equivalent preparation. These are recommendations, not mandatory prerequisite certifications.
The scaled passing standard cannot be converted into a raw percentage or required number of correct answers. Use practice results to identify gaps, not as a guaranteed exam-score prediction.
Sources: PenTest+ Certification V3 (New Version) | CompTIA — Exam details and objectives summary sections; CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods and payment; CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA) — Test details, domain table, and objectives 1.1–5.4
The five domains and their weights
Cover all five domains. Use the weights alongside your existing knowledge and practice errors to decide where extra work will help.
The CompTIA-authored PT0-003 objective document linked here is hosted by its training-book publisher. The current CompTIA page corroborates the exam specifications. The objective examples are not exhaustive; consult the full document and its supporting resources.
| Domain | Weight | What it covers |
|---|---|---|
| Engagement Management | 13% | Pre-engagement activities, legal and ethical compliance, collaboration, testing frameworks, and report components |
| Reconnaissance and Enumeration | 21% | Active and passive information gathering, enumeration techniques, script modification, and reconnaissance tools |
| Vulnerability Discovery and Analysis | 17% | Scan types including authenticated and unauthenticated, SAST and DAST, result validation, false positives, and physical security concepts |
| Attacks and Exploits | 35% | Network, authentication, host-based, web, cloud, wireless, and social engineering attacks, plus specialized systems and attack scripting |
| Post-exploitation and Lateral Movement | 14% | Persistence, lateral movement, staging and exfiltration concepts, and cleanup |
Sources: PenTest+ Certification V3 (New Version) | CompTIA — Exam details and objectives summary sections; CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA) — Test details, domain table, and objectives 1.1–5.4
Performance-based questions: format and exam-day rules
PenTest+ uses simulation performance-based questions (PBQs), which approximate a tool or environment such as a terminal window or network diagram. You can skip a simulation PBQ and return later; your work is saved as you go.
CompTIA describes PBQs as items testing problem solving in realistic settings, delivered as simulations or virtual environments. Its PBQ overview lists PenTest+ among the certifications that use simulation PBQs. A simulation approximates an environment with restricted functionality, so do not assume every command you know is available inside the item.
Three mechanics matter on exam day. Simulation PBQs have a Reset button that clears only that question, never the rest of the exam. You can skip one and come back, and your work is saved while you move on. There may be several valid paths to a correct answer, and partial credit is possible — but which items offer it is confidential.
Sources: Performance-Based Questions Overview | CompTIA IT Certifications — Simulation descriptions and PBQ tips; Performance-Based Questions FAQs | CompTIA Blog — Q&A on Reset, navigation, scoring
Reading scope documents before you touch a target
Objective 1.1 covers scope, targets, exclusions, testing windows, authorizations and responsibilities. Practise comparing a proposed action with the requirements actually supplied.
The exercise gives its own written-approval rule. Do not infer permission from discovering a link or assume every engagement uses the same terms.
Practice exercise
Original exercise: fictional signed rules authorize non-disruptive testing only on Training-Web-A and Training-Web-B from 14:00 to 16:00. Additional targets require written owner approval before testing. At 15:00 you find a link to Training-Mail-C, which has no approval. A) Test C because it was linked. B) Continue approved tasks on A/B within the window and request written approval before testing C. C) Test all three after 16:00. Which action follows the supplied rules?
Show answer
B
B respects the stated targets, activities and time window, and uses the required approval process for an addition. A adds a target without approval. C adds that target and also exceeds the window. The assets, hours and approval procedure are fictional premises; this is not a statement of universal contract law or CompTIA policy.
Sources: PenTest+ Certification V3 (New Version) | CompTIA — Exam details and objectives summary sections; CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA) — Test details, domain table, and objectives 1.1–5.4
Build practical work around the objectives
Use legitimate labs, supplied findings and relevant technical documentation to practise the skills in each domain.
These are study suggestions. Follow the instructions and authorization for the lab you use, and check what the resulting evidence actually demonstrates.
- Reconnaissance and Enumeration: compare listed information-gathering methods, interpret tool output and practise the scripting tasks in objectives 2.1-2.4.
- Vulnerability Discovery and Analysis: compare scan methods, examine supplied findings and identify what needs validation or remains uncertain.
- Attacks and Exploits: work authorized labs for the listed network, authentication, host, web, cloud, wireless, social-engineering and specialized-system topics, including script modification.
- Post-exploitation and Lateral Movement: review the persistence, lateral-movement, staging and cleanup objectives against a supplied engagement's permissions.
- Engagement Management: practise explaining scope decisions and writing findings, limitations and next steps.
Writing findings for an executive and an engineer
Objective 1.4 lists report components including an executive summary, methodology, findings, attack narrative, risk scoring, limitations and assumptions.
For practice, explain the same supplied finding to a decision-maker and a technical reader. Keep observations separate from interpretations and avoid claiming more than the evidence establishes. Objective 1.5 covers recommending remediation for given findings.
For the scope exercise, an original planning note could state: "Testing is authorized on Training-Web-A/B from 14:00 to 16:00. Training-Mail-C was linked but has no written approval. Request approval before adding it to the work." This records the supplied scope and pending decision; it does not assert that the mail server was tested or vulnerable.
Sources: PenTest+ Certification V3 (New Version) | CompTIA — Exam details and objectives summary sections; CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA) — Test details, domain table, and objectives 1.1–5.4
Script-reading exercise: a result is not a vulnerability
Check whether a script's output says more than its input establishes. A connection result alone does not identify a vulnerable web service.
The objectives include scripting and interpretation of tool output. Python's socket documentation states that connect_ex returns zero when the connection operation succeeds and otherwise an error indicator from the operating system; some other problems can still raise exceptions.
This original reading exercise uses two supplied return values. It makes no connection. Treat 111 only as the nonzero error value provided here, without assuming a platform-specific cause. The labels in the code are deliberately wrong.
def label_result(result):
if result == 0:
return "Vulnerable web service"
return "Filtered"
for result in [0, 111]:
print(label_result(result))Practice exercise
Assume 0 and 111 are the return values from two completed connect_ex calls. The code above prints "Vulnerable web service" and "Filtered". Explain why each label exceeds the supplied evidence and propose a more accurate label for each.
Show answer
For 0: "Connection succeeded". For 111: "Connection error 111; cause not established here".
Zero establishes successful completion of the connection operation; it does not identify the application, its version or a vulnerability. A nonzero value is an error indicator, so calling every such result "Filtered" assigns a cause the supplied facts do not establish. Preserve the actual error value and interpret it using the relevant platform documentation. This two-result exercise does not show every behavior of connect_ex, including exceptions.
Sources: CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA) — Test details, domain table, and objectives 1.1–5.4; socket — Low-level networking interface — Python 3.14.7 documentation — connect ( address )
Retakes and booking details
After your first failed attempt, no wait is required before a second. Before a third or later attempt, wait at least 14 calendar days from your last attempt.
The retake policy requires payment for each attempt. Some CompTIA bundles include a retake under their own terms, so check your voucher. Once you have passed and achieved the certification, retaking the same code requires CompTIA's prior consent.
Confirm current regional pricing, taxes, delivery, language and identification requirements with CompTIA before booking.
Sources: PenTest+ Certification V3 (New Version) | CompTIA — Exam details and objectives summary sections; CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods and payment
Final checklist and official documents
Cover the matching objectives, practise applied tasks and check your exam arrangements.
Use practice errors to guide your next session and explain why an answer fits the supplied facts. No fixed study schedule or practice score guarantees a pass.
- Match your booked exam and objective map to PT0-003.
- Cover all five domains and revisit weaknesses, including smaller domains.
- Practise scope reading, legitimate lab tasks, script interpretation and report writing.
- Check the evidence behind a conclusion before labeling a finding.
- Learn simulation skip, return and reset controls.
- Confirm current prices, voucher terms, dates and booking requirements.
Sources: PenTest+ Certification V3 (New Version) | CompTIA — Exam details and objectives summary sections; Performance-Based Questions Overview | CompTIA IT Certifications — Simulation descriptions and PBQ tips; Performance-Based Questions FAQs | CompTIA Blog — Q&A on Reset, navigation, scoring; CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods and payment; CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA) — Test details, domain table, and objectives 1.1–5.4
Sources
Facts checked against official sources on September 14, 2026:
- PenTest+ Certification V3 (New Version) | CompTIA
- Performance-Based Questions Overview | CompTIA IT Certifications
- Performance-Based Questions FAQs | CompTIA Blog
- CompTIA Certification Retake Policy | CompTIA IT Certifications
- CompTIA PenTest+ PT0-003 Certification Exam: Exam Objectives, Version 3.0 (publisher-hosted copy via PacktPublishing repository; © 2023 CompTIA)
- socket — Low-level networking interface — Python 3.14.7 documentation