TL;DR
PenTest+ PT0-003 is a maximum of 90 questions in 165 minutes, pass mark 750 on the 100 to 900 scale, mixing multiple choice with performance questions. Five domains carry the weight: Engagement Management 13%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Attacks and Exploits 35%, Post-Exploitation and Lateral Movement 14%. This plan assumes Security+ level knowledge and 3 to 4 years around systems or networks, which matches the experience CompTIA recommends. Eight weeks, about an hour a day, with a home lab running from week 2. Full detail: PenTest+ cert page.
The exam shape decides the plan
Two facts drive everything below. First, the Attacks and Exploits domain alone is 35%, more than the first two domains combined, so tool fluency is the exam. Second, the performance questions ask you to work through simulated tool output, scan sequencing, and exploitation steps, which means reading about Nmap is not the same as running Nmap. Every week of this plan has a lab line for that reason. The current version is PT0-003, launched December 17 2024; PT0-002 retired June 17 2025. If your materials say PT0-002 on the cover, replace them. The test runs at Pearson VUE centers and online, and the voucher math only works if you pass near the first attempt, so do not book until fresh simulations agree you are ready.
Week 1: Engagement paperwork and legal boundaries
Learn the documents that bound every test: the master service agreement sets the business relationship, the statement of work scopes one engagement, the non-disclosure agreement protects client data, and the rules of engagement define targets, windows, allowed techniques, exclusions, and the escalation contact for the specific test. Exam questions love asking which document answers a situation, so drill them as a set: relationship, scope, secrecy, boundaries. Add compliance drivers: PCI DSS requires penetration testing of the cardholder data environment at least annually and after significant changes, which is why card-data pentests exist as a category. Add threat modeling vocabulary: STRIDE enumerates threat categories (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege), DREAD scores them, OCTAVE structures organizational risk. Lab line: write a one-page rules of engagement for a fake client with an in-scope subnet, an out-of-scope subnet, a testing window, and an escalation phone number. Writing one teaches the document faster than reading five.
Week 2: Reconnaissance and enumeration, passive first
The 21% recon domain splits into passive and active, and the exam tests whether you know which comes first and which is loudest. Passive first: WHOIS and DNS records, certificate transparency logs, Shodan and Censys for exposed services, Maltego for relationship mapping, theHarvester and Recon-ng for emails, names, and subdomains. Nothing you do here touches the target, which is the point the questions probe. Then active: Nmap as the core instrument. Memorize the flags as behaviors, not letters: nmap -sS for stealth SYN scan, -sV for version detection, -O for OS detection, -A for aggressive (OS, version, scripts, traceroute together), -p- for all ports, --top-ports 1000 for speed, -T4 for faster timing against lab targets, --script vuln for vulnerability scripts from the Nmap Scripting Engine. Follow with enumeration of specific services: SMB null sessions and share listing, SNMP community strings, LDAP directory reads, SMTP user enumeration with VRFY and EXPN, DNS zone transfer attempts, web content discovery with gobuster or dirb. Lab line: stand up two lab VMs, run a full quiet-to-loud sequence against one, and keep a log of which command revealed what. That log becomes your week-8 review sheet.
Week 3: Vulnerability discovery and analysis
Scanning tools plus judgment. Nessus and OpenVAS run credentialed and non-credentialed scans; Nikto checks web servers for known issues and misconfigurations. Know what credentialed scanning buys: fewer false positives and visibility into patch state, at the cost of needing valid credentials and client approval. Map findings to identifiers: CVE names the vulnerability, CWE names the weakness class behind it, and the CVSS base score (0.0 to 10.0, from base, temporal, and environmental metric groups) prioritizes it. The exam tests this chain directly: scan output in, validated finding out. Manual validation matters because scanners lie: re-check the banner, reproduce the condition, rule out the false positive before it enters the report. Fuzzing inputs to find injection points belongs here too. Lab line: scan your lab VMs with OpenVAS, pick three findings, and validate each by hand until you can write one sentence of proof per finding. Proof sentences are the raw material of reports.
Weeks 4 to 5: Attacks and exploits, the 35% core
Two full weeks because this domain decides pass or fail. Work through the categories in the order the exam presents them. Web attacks: SQL injection (test with sqlmap after manual confirmation), cross-site scripting reflected, stored, and DOM-based, server-side request forgery against cloud metadata addresses, cross-site request forgery, local and remote file inclusion, command injection, insecure deserialization, insecure direct object references. Network attacks: on-path attacks with ARP spoofing, relay attacks with Responder capturing hashes, pass-the-hash with stolen NTLM material, Kerberoasting service tickets for offline cracking. Password attacks: dictionary and brute force with Hydra against network services, hash cracking with Hashcat, whose modes (straight, combinator, mask, hybrid) the exam can ask about. Wireless: evil twin access points, deauthentication forcing reconnects, WPA2 handshake capture and cracking with Aircrack-ng. Cloud: metadata SSRF, over-permissive IAM roles, public storage buckets. Social engineering: phishing, vishing, pretexting, and physical tailgating as test vectors, with client authorization documented first. Evasion: encoding payloads, living off the land with built-in tools, and understanding what EDR watches for rather than memorizing bypass recipes. Metasploit ties it together: auxiliary modules for scanning, exploit modules with payloads, Meterpreter sessions for post-exploitation. Lab line: exploit one lab VM end to end each week using only the tools named above, and screenshot every step. Screenshots are your evidence habit forming.
Week 6: Post-exploitation and lateral movement
Getting in is half the engagement; the exam wants the other half. Pivoting and tunneling traffic through a compromised host with proxychains and SOCKS proxies, credential harvesting with Mimikatz from memory and Impacket secretsdump from domain controllers, mapping Active Directory attack paths with BloodHound (shortest path to domain admin is the classic question shape), establishing persistence through scheduled tasks and registry run keys, exfiltrating data over covert channels like DNS tunneling, and then the part testers forget: cleanup. Revert configuration changes, remove tester-created credentials and tools, spin down infrastructure, destroy test data securely. Scripting glues it together: Python for parsing and automation, Bash for Linux targets, PowerShell for Windows enumeration, with input and output handling as the tested skill, not clever one-liners. Lab line: from your week-5 shell, dump one credential, move to the second VM, map the path you took, then clean both machines back to baseline and verify the cleanup.
Week 7: Reporting and communication
Reports are scored content, not admin. Structure: executive summary written for leadership (business risk, overall posture, strategic recommendations, no command output), methodology (scope, approach, limitations), technical findings each with severity, CVSS score, proof, affected systems, and remediation, then appendices with raw output. Severity must track impact and exploitability, not fear: a critical finding needs both a path and a consequence. Remediation recommendations come in control types: technical controls like parameterized queries and patches, administrative controls like policies and training, physical controls where access is the issue. Communication scenarios matter too: discovering evidence of a real prior compromise means stopping and following the engagement escalation path immediately, never freelancing forensics or quietly continuing. Lab line: write the full report for your week-5 and week-6 lab engagement, executive summary first, under 800 words. If the summary needs jargon, rewrite it.
Week 8: Simulate, patch, book
Two full sittings under the 165-minute clock, three days apart, mixing multiple choice with hands-on simulation items. The exam gives roughly 110 seconds per question on average, which means slow tool-output questions must be answered from fluency, not derivation. After each sitting, study only the missed domains for two days, then re-simulate. Book at Pearson VUE when a fresh simulation with unseen questions lands comfortably above your target. Re-read the performance-question strategy before the first sitting: attempt everything, secure certain elements first, flag and return rather than freeze. Keep the ports reference warm all week, since service-to-port mapping underlies half the recon questions: 21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 and 8080 HTTP, 110 POP3, 135 and 139 and 445 Windows services, 143 IMAP, 443 HTTPS, 1433 MSSQL, 1521 Oracle, 3306 MySQL, 3389 RDP, 5432 PostgreSQL, 5900 VNC. If subnet math wobbles under time pressure, run the subnet drills for two evenings. Then stop studying new material 48 hours out and sleep.
Practise with labs and PBQs
Pentest work is done at a keyboard, so reading about scoping is not practice. The PT0-003 pack holds 20 performance-based questions and 30 labs, and the honest description is that they rehearse the analyst's judgment rather than a live exploit chain: scope a target set, prioritise findings with evidence, argue a CVSS score, and write the report a client can act on (counts from the live catalogue).
Put a lab at the end of each week in this plan, on the day you study that topic. Week 1 gets the scoping and rules-of-engagement tasks. Weeks 2 and 3 get the discovery and analysis tasks. Weeks 4 to 5 get the prioritisation ones, which is where most points are lost to plausible-but-wrong severity. Week 7 gets the reporting tasks, and week 8 gets mixed tasks under the clock.
The PT0-003 lab catalogue sorts by objective, and the labs hub shows what the same model looks like on the defensive certifications.
Sources
- CompTIA PenTest+ certification page, exam details: PT0-003, max 90 questions, 165 minutes, 750 pass, Dec 17 2024 launch
- CompTIA PT0-003 exam objectives PDF, domains and percentages
- PCI Security Standards Council, PCI DSS penetration testing guidance
- Nmap reference guide, port scanning and NSE documentation
Who wrote this
SecLern Editorial. Exam numbers were read from the CompTIA PenTest+ certification page and the PT0-003 objectives document on 2026-10-18. Tool flags and commands were checked against the tools own documentation. Study pacing reflects our own simulation data: students who lab from week 2 pass faster than students who read for six weeks and lab in week 7.