Study guide · Exam overview
The format, passing score, and five published domains of CompTIA PenTest+ PT0-003, plus what changed when PT0-002 retired.
Exam version notice: This overview follows CompTIA PenTest+ exam objectives version 3.0 for PT0-003, reviewed in October 2026. CompTIA calls that series PenTest+ V3. It launched on December 17, 2024. The exam allows a maximum of 90 questions in 165 minutes, and CompTIA publishes a passing score of 750 on a scale of 100 to 900. PT0-002 retired on June 17, 2025. Items tagged Extra are useful context the PT0-003 objective list does not name. Confirm the exam code, fee, and objectives with CompTIA before you register. These pages name techniques and the decisions around them. They are not instructions for testing a system you are not authorized to test.
CompTIA PenTest+ is the practitioner certification for people who plan an authorized test, gather information, check what a scanner reports, recognize the attack that fits a finding, and explain the result in a report the client can act on. PT0-003 also asks what you leave behind: persistence, tester accounts, and cloud resources have to come back out. It assumes you already know the Security+ vocabulary. It is not a substitute for a written authorization, and it does not ask you to publish an exploit.
Figures below come from the PT0-003 objectives version 3.0 and CompTIA's PenTest+ V3 page reviewed in October 2026.
| Specification | PT0-003 (PenTest+ V3) |
|---|---|
| Level | Practitioner. No prior certification is required. CompTIA recommends Network+ and Security+, or equivalent knowledge, plus three to four years in a penetration tester role. |
| Length of test | 165 minutes. |
| Question types | Multiple choice and performance-based questions. The stem says how many answers to choose. |
| Number of questions | Maximum of 90. |
| Passing score | 750 on a scale of 100 to 900. CompTIA does not publish the raw-score conversion. |
| Objectives | Version 3.0. Five domains. Example lists in the objectives are not exhaustive. |
| Languages | English, French, Japanese, and Portuguese, as listed on CompTIA's PenTest+ V3 page. Confirm the language before you book. |
| Exam price | Confirm the current voucher price with CompTIA. Regional pricing changes. |
| Validity | Three years from the pass date. Confirm renewal options with CompTIA. |
| Earlier version | PT0-002 (PenTest+ V2) retired on June 17, 2025. A voucher applies to the exam CompTIA is offering when you book. |
Book the code on your voucher. Use this table only if an older book still uses the retired names.
| PT0-003 domain | V3 weight | Closest V2 domain | V2 weight |
|---|---|---|---|
| 1.0 Engagement Management | 13% | Planning and Scoping, plus Reporting and Communication | 14% and 18% |
| 2.0 Reconnaissance and Enumeration | 21% | Information Gathering and Vulnerability Scanning | 22% |
| 3.0 Vulnerability Discovery and Analysis | 17% | Part of Information Gathering and Vulnerability Scanning | Included in 22% |
| 4.0 Attacks and Exploits | 35% | Attacks and Exploits | 30% |
| 5.0 Post-exploitation and Lateral Movement | 14% | Folded inside Attacks and Exploits on V2 | Included in 30% |
Both exams use 165 minutes and a passing score of 750 on the 100 to 900 scale. V2 allowed a maximum of 85 questions. V3 allows a maximum of 90. The content shift is why a PT0-002 book is the wrong primary source once your voucher says PT0-003.
A certification earned on PT0-002 stays valid for three years from the pass date. It does not let you skip PT0-003 if your booking is for the current exam. Vocabulary both exams assume is on Security+.
CompTIA publishes these PT0-003 weights. The 200 practice questions use the same share.
The agreement, the people, and the report. Nothing else on the exam is in bounds until this is.
What you can learn, and which tool or script does that job.
How you scan, how you decide the finding is real, and what a physical walk-through can show.
The largest domain. Name the technique, the tool's job, and the target you are allowed to touch.
How access continues, how it moves, and how you give the environment back.
Learn the unmarked rows first. The same map is in the core notes and flashcards.
| Pair | How to separate them |
|---|---|
| NDA and statement of work | An NDA protects confidentiality. A statement of work defines the targets, the work, and the deliverable. Signing one does not replace the other. |
| Provider and customer | In the shared responsibility model, the provider secures the platform it operates. The customer secures data, identity, and configuration. The tester stays inside the agreement. |
| Passive and active recon | Passive uses information that is already public. Active sends traffic, such as a probe or a query, to learn about the target. |
| SAST and DAST | SAST reads code or infrastructure templates without running the app. DAST tests the running app from the outside. SCA checks third-party components. IAST instruments the running app. |
| False positive and false negative | A false positive is a finding that is not real. A false negative is a real flaw the tool missed. The miss is the dangerous one. |
| CVSS and EPSS | CVSS is technical severity. EPSS estimates the chance the issue will be exploited. A 9.8 on an isolated lab host can wait behind a lower score on the billing API. |
| Spraying and stuffing | Spraying tries a few passwords across many accounts. Stuffing tries username and password pairs taken from another breach. Brute force spends many guesses on one account. |
| SSRF and CSRF | SSRF makes the server request a URL the attacker chose. CSRF makes the victim's browser send a request they did not intend. |
| Bind shell and reverse shell | A bind shell listens on the target. A reverse shell makes the target connect outward. Outbound is the path that still works when inbound ports are closed. |
| Clean up and preserve | Remove tester accounts, tools, and persistence. Preserve the artifacts the report needs before you destroy them. Leaving a shell in place is not a favor. |
| Tools as their own domain Extra | PT0-002 tested tools and code analysis as a separate domain. PT0-003 does not. Learn scripting where V3 puts it: reconnaissance and attack automation. |
Most items are multiple choice. Some ask you to choose two answers, and the stem says so. Performance-based items ask you to match a tool or a framework to a job, or to put scoping, testing, and cleanup in order. Read FIRST, NEXT, and BEST as ordering words: a useful technique outside the agreement is still the wrong answer.
CompTIA says the example lists in the objectives are not exhaustive. A question can use a technology that fits an objective even when the PDF did not print that product name. Do not expect a lab that asks you to build an exploit.
A practical sequence if scope, scan types, and attack names still blur together.
Say what an NDA, a master service agreement, a statement of work, and a terms-of-service page each do. Then name an exclusion, a testing window, and the person you call when a finding is critical.
Job posts, certificate logs, and Shodan are passive. A port probe, a DNS query you send, and a crawl are active. Enumeration names users, shares, and secrets. Reconnaissance is the wider search.
SAST, DAST, IAST, and SCA answer different questions. An unauthenticated scan that looks clean can be a false negative. Treat industrial systems as fragile and follow the method in the agreement.
Spraying, stuffing, pass-the-hash, SSRF, and an evil twin are different problems. The report recommends a control from the objectives: parameterization, multifactor authentication, segmentation, patching, or a secrets manager.
A scheduled task, a new account, and a reverse shell are persistence. Pivoting reaches a network you could not route to. Cleanup removes what you added and keeps the evidence the client asked to retain.
Use the five flashcard decks until you answer before the card flips. Then take original questions and return to any domain under 75 percent. The live exam gives you 165 minutes and up to 90 questions. Treat the 100 to 900 estimate as a personal trend, not a prediction.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 750 passing score, five domain weights, and the PT0-002 retirement date.
Reference notes for scope, reconnaissance, scans, attack names, and cleanup.
40 recall cards in five decks, plus memory notes for agreements, scan types, and cleanup.
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
CompTIA allows a maximum of 90 questions and 165 minutes. Questions are multiple choice and performance-based. Confirm the current details with CompTIA before you book.
CompTIA publishes a passing score of 750 on a scale of 100 to 900 for PT0-003. This site converts a practice percentage linearly onto that scale and labels the result unofficial, because CompTIA does not publish the real conversion.
Study the exam code on your voucher. PT0-003 is PenTest+ V3. CompTIA launched it on December 17, 2024. PT0-002 retired on June 17, 2025. V3 uses five different domains, allows up to 90 questions, and keeps the 165-minute limit and the 750 passing score.
Yes. CompTIA certifications are valid for three years from the date you pass. Renewal options change, so confirm the current policy with CompTIA.
No prior certification is required. CompTIA recommends Network+ and Security+, or equivalent knowledge, plus three to four years in a penetration tester role.
No. The practice questions on this site are original. They are not CompTIA exam items, and a practice score does not predict a result.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Convert structured data between JSON and YAML with formatting and validation.
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the CompTIA certification page before you register.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and PenTest+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.
Certi