100+ Free CompTIA PenTest+ Practice Questions
Pass your CompTIA PenTest+ (Exam PT0-003) exam on the first try — instant access, no signup required.
A tester connects to TCP port 25 with Netcat and issues `VRFY jdoe` to learn whether a username exists. Which service is being enumerated and what is the goal?
Explore More CompTIA Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: CompTIA PenTest+ Exam
$425
Exam Fee (USD)
CompTIA
750/900
Passing Score
CompTIA
165 min
Exam Duration
CompTIA
Max 90
Question Count
CompTIA
35%
Attacks and Exploits domain weight
CompTIA PT0-003 objectives
3 years
Certification Validity
CompTIA (CE renewal)
CompTIA PenTest+ (PT0-003) is an intermediate penetration-testing certification delivered through Pearson VUE for a $425 USD fee, with a 750/900 passing score and up to 90 multiple-choice and performance-based questions in 165 minutes. The five domains are Engagement Management (13%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Attacks and Exploits (35%), and Post-Exploitation and Lateral Movement (14%). The credential is valid for three years and renewable through CompTIA continuing education.
Sample CompTIA PenTest+ Practice Questions
Try these sample questions to test your CompTIA PenTest+ exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1A penetration tester is finalizing the pre-engagement paperwork. Which document specifically defines the targets, timing windows, allowed techniques, exclusions, and the escalation contact for a single test?
2During scoping, a client states that the assessment must validate compliance with the protection of cardholder data. Which regulatory framework most directly drives the requirement for an annual penetration test of the cardholder data environment?
3A tester wants to systematically enumerate potential threats to a web application by walking through Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Which threat modeling methodology is being used?
4While testing a web server, a tester discovers evidence of an active, prior compromise by a real attacker. According to standard rules of engagement, what is the MOST appropriate immediate action?
5A penetration test report assigns a severity to each finding using a 0.0 to 10.0 numeric score derived from base, temporal, and environmental metrics. Which scoring system is being used?
6A client's executive team will receive the penetration test report. Which report component is written specifically for a non-technical audience and summarizes business risk and overall posture without command output?
7A finding recommends "implement parameterized queries and input validation." In remediation terminology, what category of control is this?
8An organization wants the testers to have NO prior knowledge of the environment and to attack as an external adversary would, with no credentials or network diagrams provided. Which test type is this?
9A penetration testing firm and a new client are establishing a multi-year relationship and want one overarching contract that sets the general legal terms for all future engagements. Which document serves this purpose?
10Before any active testing begins, why does a professional penetration tester insist on a signed authorization document (sometimes called a get-out-of-jail-free letter)?
About the CompTIA PenTest+ Exam
CompTIA PenTest+ (PT0-003) is an intermediate cybersecurity certification that validates the hands-on skills required to plan and scope a penetration test, gather information, discover and analyze vulnerabilities, exploit systems, and report findings. The current PT0-003 version launched on 17 December 2024 and replaced PT0-002, retired in June 2025, adding deeper coverage of modern attack surfaces including cloud, web applications, and Active Directory. The exam presents a maximum of 90 multiple-choice and performance-based questions in 165 minutes and requires a score of 750 on a 100-900 scale to pass. Its five domains are Engagement Management (13%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Attacks and Exploits (35%), and Post-Exploitation and Lateral Movement (14%).
Questions
90 scored questions
Time Limit
165 minutes
Passing Score
750 on a scale of 100-900
Exam Fee
$425 (CompTIA)
CompTIA PenTest+ Exam Content Outline
Engagement Management
Plan and scope engagements with rules of engagement, SOW, MSA, and NDA; align testing to compliance drivers such as PCI DSS, GDPR, and HIPAA; apply threat-modeling frameworks (STRIDE, DREAD, OCTAVE); and write reports that score findings with CVSS and recommend technical, administrative, and physical remediation.
Reconnaissance and Enumeration
Perform passive OSINT with theHarvester, Recon-ng, Shodan, Maltego, WHOIS, DNS records, and certificate transparency logs, then move to active scanning and enumeration using Nmap and the NSE, plus SMB, SNMP, LDAP, and SMTP enumeration and web content discovery.
Vulnerability Discovery and Analysis
Run credentialed and non-credentialed scans with Nessus, OpenVAS, and Nikto; map detected services to CVE and CWE records; prioritize with CVSS base, temporal, and environmental metrics; fuzz inputs; and manually validate findings to remove false positives.
Attacks and Exploits
Execute web attacks (SQL injection, XSS, SSRF, CSRF, file inclusion, command injection, insecure deserialization, IDOR), network and on-path attacks, wireless attacks (evil twin, deauth, WPA2 cracking), cloud attacks (metadata SSRF, IAM and storage misconfigurations), password and social-engineering attacks, and AV/EDR evasion using Metasploit, Burp Suite, sqlmap, Hydra, Hashcat, Responder, and Aircrack-ng.
Post-Exploitation and Lateral Movement
Pivot and tunnel with proxychains and SOCKS proxies, harvest credentials with mimikatz and Impacket secretsdump, perform pass-the-hash and Kerberoasting, map attack paths with BloodHound, establish persistence, exfiltrate data over covert channels, clean up artifacts, and automate with Python, Bash, and PowerShell.
How to Pass the CompTIA PenTest+ Exam
What You Need to Know
- Passing score: 750 on a scale of 100-900
- Exam length: 90 questions
- Time limit: 165 minutes
- Exam fee: $425
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
CompTIA PenTest+ Study Tips from Top Performers
Frequently Asked Questions
What are the current exam facts for CompTIA PenTest+ PT0-003?
PT0-003 costs $425 USD, has a maximum of 90 multiple-choice and performance-based questions, runs 165 minutes, and requires a score of 750 on a 100-900 scale to pass. It is delivered through Pearson VUE online or at a test center.
What is the difference between PT0-002 and PT0-003?
PT0-003 launched on 17 December 2024 and replaced PT0-002, which retired in June 2025. PT0-003 restructured the domains and expanded coverage of cloud, web application, and Active Directory attacks, and it separates Vulnerability Discovery and Analysis as its own 17% domain.
Which domain carries the most weight on PT0-003?
Attacks and Exploits is the largest domain at 35%, covering web, network, wireless, and cloud attacks, password cracking, social engineering, and AV/EDR evasion. Reconnaissance and Enumeration is next at 21%.
Are there prerequisites for PenTest+?
There are no mandatory prerequisites. CompTIA recommends Network+ and Security+ certifications plus 3-4 years of hands-on information security or penetration testing experience before attempting PT0-003.
How long is the PenTest+ certification valid?
The PenTest+ certification is valid for three years from the date you pass. You can renew it through CompTIA's Continuing Education (CE) program by earning CEUs or passing a higher-level certification.
What is the best way to prepare for PT0-003?
Get hands-on in a lab with real tools such as Nmap, Metasploit, Burp Suite, sqlmap, Responder, mimikatz, and BloodHound, and practice the performance-based question style. Then drill the heaviest domains, Attacks and Exploits and Reconnaissance, until each tool and technique feels routine.