CertificationsCompTIA PenTest+ PT0-003Labs
CompTIA PenTest+ PT0-003 hands-on labs
Scoping and reporting rather than attack payloads: rules of engagement, evidence review, CVSS scoring and remediation advice.
30 labs you run in the browser: 1 guided, 29 assisted. About 8 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
30
labs
1
guided
steps in order
0
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- Assessment workspace· you click29 labs
- Risk register and control sheets· you click1 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Decline the out-of-scope partner address
ProGuided · Quick · 8 min · Assessment workspace
Ticket: Dana from Marlow Dental Group asks you to test 198.51.100.40 because it appears on the client's network diagram. Check the signed scope…
written authorizationrules of engagementexclusionsthird-party systems
Build a two-host service inventory
ProAssisted · Quick · 12 min · Assessment workspace
Ticket: Use the saved scan report to mark the open services on both Tern Logistics hosts before the team plans its next authorized tests.
service inventoryopen portclosed portfiltered port
Find the host the client forgot in a certificate log
ProAssisted · Quick · 12 min · Assessment workspace
Ticket: Public certificate-log results for *.tern.example include a name missing from the client's host list. Identify it, then decide what must be confirmed before anyone probes it.
certificate transparencysubdomain discoveryscope confirmationOSINT
Keep testing within the web-only SOW
ProAssisted · Quick · 12 min · Assessment workspace
Ticket: The signed SOW covers the patient portal web application on 192.0.2.20 over TCP 80 and 443. The saved scan also lists port 445…
statement of workhost scopeport restrictionsscope change
Prioritize the Marlow Dental admin console
ProAssisted · Quick · 12 min · Assessment workspace
Marlow Dental Group supplied a scan summary for forty in-scope hosts. Choose the single service that merits a focused follow-up test based on its version and the supplied vendor notice…
service inventorybanner reviewvulnerability prioritization
Test only the hosts in the signed schedule
ProAssisted · Quick · 12 min · Assessment workspace
Ticket: Test the 198.51.100.0/25 range tonight. The schedule excludes 198.51.100.30 because month-end close is running. Review the saved inventory, report the supported finding on files-01…
scopeexclusionsrules of engagementsaved scan output
The appliance belongs to the service provider
ProAssisted · Quick · 12 min · Assessment workspace
Ticket: The edge firewall at 203.0.113.2 is managed by NorthLink. A client-supplied scan shows its admin page on the internet…
third-party authorizationrules of engagementwritten consentevidence handling
A sign-in page that answers honestly
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: The client supplied two saved sign-in exchanges. One used a real username and one used a made-up name…
user enumerationauthentication responsesgeneric error messages
Check a draft test plan against the rules of engagement
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: Your teammate drafted tonight's test plan. Check every item against the signed rules before the engagement begins and return a safe, corrected set of allowed steps.
rules of engagementtesting windowdenial of servicesocial engineering
Check what the scanner template actually found
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: A scanner template flagged a mail relay on 198.51.100.25 because it saw a response on TCP 25. Review the saved banner and decide whether the finding describes the service that…
scanner templateservice identificationbannerfalse positive
Close out the Tern Logistics test window
ProAssisted · Quick · 14 min · Assessment workspace
Tern Logistics sent a six-line inventory of server changes before the engagement is closed. Match it against the saved test log, identify only the test artifacts…
cleanuppersistenceengagement closeoutchange attribution
Read 200 failed sign-ins that never locked
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: The client's administrator tested webmail authentication and saved the response log. Review what happened through 200 failed sign-ins…
authenticationaccount lockoutrate limitingpassword guessing
Read what a zone transfer handed out
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: The client-supplied DNS output shows that the name server returned a full zone. Summarize what the records reveal…
DNS zone transferDNS enumerationinternal address disclosureCVSS 3.1
Review a teammate's recon loop before it touches the client
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: A teammate left a host-discovery loop in the shared notes. Review its bounds before anyone runs it. The signed scope is 192.0.2.0/24…
reconnaissancescope boundariesaddress rangesscript review
Score the anonymous file service
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: Write up the file service on 192.0.2.40. The saved scan says anyone can log in and read the patient-forms directory…
anonymous FTPCVSS 3.1confidentialityevidence-based reporting
Search results that repeat what was typed
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: The client supplied a portal search capture. Review the harmless test string in the response, identify the issue and score only what the capture demonstrates.
reflected cross-site scriptingoutput encodingCVSS 3.1user interaction
Stop and escalate when the folder holds someone else's data
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: During a file-share review, the client-supplied listing shows a folder that appears to hold another company's payroll exports. Decide what to do before inspecting any contents…
third-party datadata minimizationescalationevidence handling
The export called a host down. Is it?
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: Last week's export marked 198.51.100.61 down and the range clean. A fresh saved check shows the host answering on HTTP with an unauthenticated backup listing…
stale scan outputservice availabilityunauthenticated directory listingevidence validation
Use the threat model to pick where to test first
ProAssisted · Quick · 14 min · Assessment workspace
Ticket: Tern Logistics shared the data-flow note for its invoice API. Use the trust boundaries and missing sender check to prioritize the first authorized assessment and name the relevant…
data flow diagramtrust boundarySTRIDEspoofing
A plant gateway that takes orders from the office
ProAssisted · Quick · 15 min · Assessment workspace
Ticket: The plant gateway at 203.0.113.10 accepts write commands from the office network. The rules say OT is passive evidence only. Review the engineer-supplied capture…
operational technologyModbuspassive evidenceCVSS 3.1
One afternoon, three hosts, one ordered list
ProAssisted · Quick · 15 min · Assessment workspace
Tern Logistics authorized an afternoon review of three hosts in its staging subnet. The supplied evidence includes an old admin console banner with a matching vendor remote-flaw notice…
finding validationCVSS prioritizationevidence-based reporting
Rate what the web team left behind
ProAssisted · Quick · 15 min · Assessment workspace
Marlow Dental Group approved a review of three saved web captures from its staging site. One exposes repository metadata, one redirects to a supplied external address…
web exposuresource metadatacredential remediation
Turn findings into a remediation plan the client can own
ProAssisted · In-depth · 24 min · Risk register and control sheets
Marlow Dental Group has five findings to remediate. The working date is 26 October 2026. Read the client's policy, assign each finding an owner and severity band…
remediation ownershipseverity-based deadlinesretest verification
Halden Foods management-plane exposure review
ProAssisted · In-depth · 25 min · Assessment workspace
Halden Foods supplied saved management-plane evidence for a core switch, a printer and a wireless access point. Review the captures without sending new requests…
SNMP community stringsTelnet cleartextdefault credentialsmanagement plane
Retest the Tern Logistics payment range
ProAssisted · In-depth · 25 min · Assessment workspace
Tern Logistics has returned its payment range for a retest. Compare the previous report with the new client-supplied scan. Mark each old item fixed or open…
retest evidencefixed findingspartial remediationreport prioritization
Assemble the findings into a client report
ProAssisted · In-depth · 28 min · Assessment workspace
Halden Foods needs a client-ready report today. Three findings are already saved from the authorized evidence review. Prepare a short management summary, put the findings in risk order…
executive reportingevidence-backed risk orderremediation timingreport export
Draw the path from the findings
ProAssisted · In-depth · 28 min · Assessment workspace
The client supplied a workstation review, a share-access record, an identity audit and a firewall summary after an internal review…
attack-path analysisfinding relationshipsevidence mappingremediation leverage
Tern Logistics exposed staging services
ProAssisted · In-depth · 28 min · Assessment workspace
Tern Logistics approved review of its staging environment. The client supplied a proxy configuration, a public object listing and an anonymous registry catalog…
cloud responsibilitypublic object storageanonymous registry
Trace the assumed-breach path without crossing scope
ProAssisted · In-depth · 30 min · Assessment workspace
Tern Logistics authorized a simulated assumed-breach review. The client supplied evidence from a lost workstation, guest Wi-Fi configuration and a database trust relationship…
assumed breachcredential reusewireless key reusescope exclusions
Halden Foods retail security assessment
ProAssisted · In-depth · 40 min · Assessment workspace
Halden Foods' retail arm has authorized a one-afternoon assessment. Confirm the POS exclusion and passive-only OT rule, review the supplied scan and captures…
scope confirmationpassive OT reviewfalse-positive validationfinding prioritization
Where to go next
Every certification with labsPT0-003 lab questions
There are 30 labs: 1 guided, 29 assisted. Together they carry about 8 hours of authored lab time, and none of them is a free taster yet.
Practise PT0-003 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.