TL;DR
PenTest+ PT0-003 launched 17 December 2024 and is a live, generally available exam, not a beta: max 90 questions in 165 minutes, pass at 750 on a 100 to 900 scale, across five domains led by Attacks and Exploits at 35%. It supersedes PT0-002, which retired 17 June 2025. Budget over a third of prep for hands-on attacking technique, and practice inside legal labs only.
By SecLern Editorial. Published 2026-10-18. Exam facts checked 2026-10-17 against the CompTIA PenTest+ page and the official objectives PDF version 3.0. Anything CompTIA does not publish (question-type split, price) is marked unverified below.
Status: live, not beta, since December 2024
PT0-003 launched 17 December 2024 and is the current, generally available PenTest+ exam. Saying so explicitly matters because stale pages still describe it as new or imply beta terms; neither is true anymore. The objectives PDF version 3.0 is free on the CompTIA CDN, which makes this one of the cheaper exams to scope: download the PDF, map your plan to its five domains, and ignore any prep book that still teaches PT0-002 numbering. PT0-002 retired 17 June 2025 per the CompTIA page, so second-hand materials older than that date teach the wrong test. CompTIA estimates its own retirements at roughly three years after launch, which points this exam at 2027, but that is an owner estimate, not a firm date, so book without retirement pressure. Start from the PenTest+ study hub.
Format: 90 questions, 165 minutes, 750 to pass
Owner-verified figures: a maximum of 90 questions, 165 minutes on the clock, passing scaled score 750 on the 100 to 900 scale. That clock is generous next to Security+: nearly two minutes per question, which fits an exam where scenarios describe engagements, show tool output, and ask for the next action. Two things CompTIA does not publish stay out of this post as facts. The multiple-choice to performance split is described only as a mix, so any 85/5-style split you see is a simulator default, not a CompTIA figure. Price has no machine-readable USD figure on the owner page; third-party ranges float around the low four hundreds, which is shopping noise, not a fact. Pace your mocks at 90 questions in 165 minutes and confirm fees on the CompTIA page at booking time.
The five domains, and the 35% center
Weights 13/21/17/35/14, in lifecycle order, which is itself a study hint: the exam follows an engagement from scoping to reporting.
- D1 Engagement Management: 13%. Scoping, rules of engagement, legal and compliance constraints, planning, and reporting. Smallest domain, easiest points for anyone who reads carefully, because these questions test professional judgment rather than tool flags.
- D2 Reconnaissance and Enumeration: 21%. OSINT, scanning, enumeration, information gathering. The second Heaviest area and the foundation every later question assumes; weak recon knowledge leaks points into D3 and D4.
- D3 Vulnerability Discovery and Analysis: 17%. Scanning, analysis, prioritization, vulnerability handling. Learn to rank findings by exploitability and impact, not just to name them.
- D4 Attacks and Exploits: 35%. More than a third of the exam. Network, wireless, application, cloud, and social attacks plus post-attack handling within the objective scope. This domain decides passes and fails; schedule it proportionally.
- D5 Post-exploitation and Lateral Movement: 14%. Persistence, lateral movement, cleanup, covering tracks within authorized scope, and pivoting technique. Pairs naturally with D4 study sessions.
Allocate hours near 13/21/17/35/14 and you cannot go far wrong. The exam rewards people who think in engagement order: scope it, find it, rank it, exploit it within scope, report it.
How to study the 35% without breaking the law
Every technique in D4 and D5 must be practiced in environments you own or that explicitly permit testing: home labs, rented lab platforms, and capture-the-flag rooms built for training. Never practice against systems you do not own or lack written permission to test; unauthorized access is a crime in most jurisdictions, and the exam's own D1 content tests exactly that boundary. The study loop that works: read the technique, run it in the lab the same day, write the one-line lesson (what it proves, what it needs, what stops it), then drill it as a scenario. Tool output questions reward pattern recognition: scan output, error strings, and ticket wording you have actually seen beat memorized flag lists every time. Pair each attack with its countermeasure and its reporting line, because the exam asks all three angles and lab-only learners drop the reporting third. Our study labs cover the procedure-first habit this exam demands.
Exam-day behavior for long scenarios
Long stems with tool output tempt you to read everything twice. Instead, read the last line first to learn what is asked, then read the output for that answer only. Eliminate options that violate scope or rules of engagement before comparing techniques; the exam plants attractive out-of-scope answers as traps. Flag output-heavy items past the four-minute mark and return with banked time, per the exam-day checklist. Management and reporting questions near the end deserve fresh eyes, not leftover seconds: they are the cheapest points on the form and the easiest to fumble tired. Answer everything, since blanks never score. Finish with the readiness booking rule: two fresh full sittings in your comfort zone, a week apart, before paying the fee.
Reporting: the domain inside every domain
Every engagement ends in a report, and the exam tests reporting from several angles, so treat it as its own study block. A solid finding has five parts: title, severity with business-readable justification, evidence (affected host, output excerpt, timestamp), remediation with effort estimate, and retest expectation. Severity ratings must tie to exploitability and impact, not to drama; practice rating three sample findings and defending each rating aloud, because the exam offers inflated ratings as distractors. The executive summary deserves separate reps: three paragraphs covering what was tested, what matters most, and what to do first, with no tool jargon. Also drill the handling rules: reports go to the authorized client contact only, findings stay confidential, and retesting happens on schedule rather than on attacker timelines. Time-box reporting study to two days; it is 13% of D1 plus fragments elsewhere, and clean templates convert it into reliable points. Keep one template page and reuse it for every lab write-up until the structure is muscle memory.
Sources
- CompTIA PenTest+ certification page (code, launch, format, weights, retirement of PT0-002)
- CompTIA PT0-003 objectives PDF version 3.0.pdf) (domains, objectives)
Read next
Compare analyst tracks in the Network+ study plan for the networking base this exam assumes, borrow scenario method from weak-spot training, and drill pacing with PBQ time management. Hands-on reps live under study. Two logistics notes close out prep. First, the exam assumes you know the engagement lifecycle in order, so rehearse it as a spoken sequence (scope, plan, gather, analyze, attack within scope, report) until reciting it takes under a minute. Second, schedule only after a full timed mock at the 90-in-165 pace with tool-output questions included; output reading speed is the hidden variable, and mocks without exhibits overstate readiness. Passes come from procedure plus pace, and both are trainable in weeks. Book when two fresh full sittings clear your comfort zone a week apart, with output-heavy items included.