What is on the PT0-003 exam?

Up to 90 questions in 165 minutes, 750 to pass on the 100 to 900 scale. Domains: Engagement Management (13%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Attacks and Exploits (35%), Post-exploitation and Lateral Movement (14%).

Which domain is worth the most?

Attacks at 35% and Recon & enum at 21%. Start there, and keep coming back: the heaviest domains decide most pass and fail results.

How long should I plan for?

Set aside five to eight weeks at about five focused hours a week, then let a full practice sitting decide your exam date. If you already work in IT, the first weeks move faster. Do not book until a fresh sitting, with questions you have not seen, lands above the pass mark.

What score do I need to pass?

You need 750 on the 100 to 900 scale. Keep a margin above that in practice, because exam-day stress costs a few points.

Learn scoping first. Rules of engagement, legal constraints, and planning show up before any exploit does.

Do I need hands-on experience?

Helpful, not required. The browser labs let you practise the hands-on tasks without a server or a rack, and each lab grades the end state rather than the exact command you typed.

Are the practice questions the same as the real test?

No. SecLern questions are written originally for this site and mapped to the published objectives. They are never copied from a real exam.

What should I do the week before the exam?

Take one full simulation early in the week and review every miss. Spend the middle of the week on the two domains that scored lowest, then stop adding new material 48 hours out. Confirm your appointment and ID, sleep, and read the goal line twice on every performance task.

Is this page current?

This page is built against Exam Objectives Version 3.0 (3.0), verified 2026-10-18. Exam owners change objectives and retirement dates, so confirm the date for your language before you book.

CertificationsPenTest+

CompTIA · PT0-003

CompTIA PenTest+ PT0-003

CompTIA PenTest+ (PT0-003) is the offensive counterpart to the blue-team exams: scoping engagements, gathering intel, exploiting misconfigurations, and writing the report that gets things fixed. Expect scenario chains, not trivia.

Security+ or CySA+ holders moving into penetration testing, junior testers who need exam structure around their lab time, and defenders who want to think like the other side.

Study PT0-003 free

See labs Check version dates

Version status

CompTIA has not published an exact date. Three years after launch is an estimate.

Retires: Estimated 2027

Where the marks live

Domain weights from the current PT0-003 objectives. Start with the heaviest slice, not the first chapter.

Attacks leads at 35%

35%Attacks

How much study time does PT0-003 need?

Pick the closest starting point. The range below is a planning estimate, not a promise or a pass prediction.

95 to 145 hoursat a steady pace

That is up to 29 weeks at 5 hours a week, or 19 weeks at 8 hours. Some IT background, but the exam material is still new.

Estimate only. Based on the exam level and a study-pace assumption. Your background, exam date and practice scores will move it.

A study plan that works

Order matters

Learn scoping first. Rules of engagement, legal constraints, and planning show up before any exploit does.
Give exploitation double time. At 35% it decides more of your score than any other domain.
Practice the attack chain end to end in labs: recon, exploit, pivot, clean up, report.
Write practice findings. Reporting is scored, and vague writeups lose points.

Try one question

Live demo

Demo questionEngagement management

During a test, you find a way into a production database that was not listed in the scope. What is the correct action?

Written for this page. It is a teaching demo, not an item from the question bank or the real exam.

Try the hands-on shape

About 2 minutes

Try it: change a firewall rule and see the probes change

HTTPS from anywhere
Telnet (block it)
SSH from admins only

HTTPS (port 443): connected
SSH (port 22): connected
Telnet (port 23): refused by the rule
HTTP (port 80): no rule matches, so the default deny drops it

A teaching model of rule order and default deny, not a real firewall.

Demo preview. A teaching model with fixed sample data, not the real lab. Full labs run in the browser with checkable steps.

Practice a performance question

20 performance-based questions are written for CompTIA PenTest+ PT0-003. They ask you to do the task in a simulated console, table or form, and they grade in parts, so a half-right answer still earns credit.

How performance questions are scored

Sample performance questionMatch each task to the control or service

Tailgating at the badge door

A contractor badge still works after the contract ends

Smoke in the server room, and water is not allowed

A teaching demo written for this page. It is not a real exam item, and nothing here is saved.

This matching sample is local and ungraded. The full set is included in practice for this exam.

Common traps

Ways smart people lose points on this exam.

Jumping to exploits before scoping. The exam tests authorization and planning as seriously as technique.
Memorizing tool flags without understanding output. Questions show results and ask what they mean.
Skipping the report. Findings, risk ratings, and remediation advice are part of the job and the exam.

Practise PT0-003, three ways

Every lab is a job task in the tool that job uses, graded on the end state you leave behind. The PBQ pages explain the performance formats this exam uses and open one real scenario in the browser. The practice test gives you fifteen questions with a reason for every option.

Open the PT0-003 labs

Objectives by domain

Every published PT0-003 objective, grouped by the domain that carries it. The wording stays with CompTIA.

26 objectives

Engagement management13% of the exam

1.1Pre-engagement
1.2Collaboration
1.3Test frameworks
1.4Pentest reports
1.5Remediation advice

Recon and enumeration21% of the exam

2.1Info gathering
2.2Enumeration
2.3Recon scripting
2.4Recon tools

Vulnerability discovery17% of the exam

3.1Vuln scanning
3.2Analyse output
3.3Physical security

Attacks35% of the examStart here

4.1Attack prep
4.2Network attacks
4.3Auth attacks
4.4Host attacks
4.5Web attacks
4.6Cloud attacks
4.7Wireless attacks
4.8Social engineering
4.9Specialised targets
4.10Attack scripting

Post-exploitation14% of the exam

5.1Persistence
5.2Lateral movement
5.3Exfiltration
5.4Cleanup

The full entry for each objective (the explainer, key terms, traps and practice questions) lives in the Study Book. One objective per certification is free to read; Pro opens the rest.

Questions about this exam

90 questions in 165 minutes. 750 to pass on the 100 to 900 scale. Domains: Engagement management (13%), Recon and enumeration (21%), Vulnerability discovery (17%), Attacks (35%), Post-exploitation (14%).

Study PT0-003 with your weak spots in view

Daily sessions that aim at your gaps, hands-on labs, and full simulations under the real clock. Free to start.

Start studying free

Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.