PT0-003 CompTIA PenTest+ Exam Topics and Questions

Engagement Management sets the legal and operational frame around everything else in the exam. Before a single packet leaves your machine, the exam expects you to know what authorises the test, who needs to be told what, and how findings get turned into something a client can act on. Get this wrong and you fail questions that have nothing to do with technical skill.

– Scoping, authorisation, and the legal baseline

Rules of engagement are the boundary conditions the exam tests most precisely. You need to know what goes into a rules-of-engagement document, how testing windows are defined, and how target selection is constrained by scope. The legal side runs alongside this: authorisation letters are not optional paperwork, they are what separates a lawful test from a criminal act, and the exam treats them accordingly. Mandatory reporting obligations and regulatory requirements sit here too. Candidates who treat the legal material as background reading lose marks on questions where the authorisation status of a specific action is the deciding factor.

– Stakeholder communication and the finished report

Peer reviews, escalation paths, and risk articulation are tested as practical decisions, not as vocabulary. The exam asks you to judge when to escalate a finding, how to frame risk for a non-technical audience, and what a peer review is meant to catch. The penetration test report ties all of this together. You need to know the difference between what goes into an executive summary and what goes into the technical findings section, and you need to understand what a remediation recommendation actually requires: enough detail for the client to act, not just a label. Weak candidates describe findings without tying them to business risk, and that is where marks go.

How Engagement Management is tested

At 13% of the exam, this topic appears often enough that gaps in it will show up in your score. Items here tend to be scenario-based: you are given a situation mid-engagement and asked to make a decision about scope, communication, or documentation. The trap is treating these as common-sense questions. The exam rewards precise knowledge of what authorisation documents must contain, when escalation is required rather than optional, and what a compliant report looks like. Candidates who generalise from experience rather than from the specific requirements of the domain consistently misread the scenarios. Items on reporting reward knowing which section carries which type of content, not just knowing that reports have sections. Items on communication reward knowing who gets what information and when, not just that stakeholders need to be kept informed. Read every scenario carefully for the engagement phase it describes before committing to an answer.

Reconnaissance and Enumeration carries the highest weight of any topic on this exam. Where Engagement Management governed what you are allowed to do, this topic tests how you actually gather information before you exploit anything. The split between passive and active techniques is not just conceptual: the exam uses it to test whether you know which approach is appropriate given a specific scope or detection-risk constraint.

– Passive and active information gathering

OSINT is tested as a set of practical decisions: which sources are appropriate, what they can and cannot reveal, and when using them crosses a scope boundary. Network sniffing and protocol scanning sit on the active side, and the exam expects you to know when each is the right choice and what each produces. The distinction matters because a question that describes a low-noise, pre-authorisation phase is pointing you toward passive techniques, while one that describes an authorised internal engagement is likely pointing you toward active ones. Candidates who conflate the two consistently pick the wrong technique for the scenario described.

– Enumeration and service discovery

DNS enumeration, service discovery, and directory enumeration are tested at the technique level, not just as named concepts. You need to know what each technique reveals, what its limitations are, and which tool or command produces which output. The exam will describe a partial result and ask what it tells you or what you should do next. Items on service discovery reward knowing what open ports and banners actually indicate, not just that you should scan for them. Directory enumeration questions often hinge on what a result means for the next phase of the test rather than on the mechanics of running the tool.

– Tools and script customisation

Nmap, Wireshark, and Shodan each appear in scenarios where you need to know not just what they do but what a specific flag, filter, or query returns. Shodan questions tend to focus on what the tool exposes about internet-facing assets without active scanning. Wireshark questions often turn on reading a capture and identifying what it reveals. Nmap questions regularly test flag combinations and their effects on scan behaviour. Script modification in Python, PowerShell, and Bash is tested as a practical skill: you may be shown a short script and asked what it does or how to adapt it for a specific reconnaissance goal. You do not need to write scripts from scratch, but you do need to read them accurately.

How Reconnaissance and Enumeration is tested

At 21%, this is the topic where the most marks are available and where technical candidates often leave the most on the table. Items here reward precision: the exam distinguishes between tools, between scan types, and between what a technique reveals versus what it conceals. Scenario questions describe a specific engagement phase and a specific constraint, and the right answer depends on matching the technique to both. The most common trap is selecting a technique that would work technically but violates a scope or detection constraint given in the scenario. Script questions reward the ability to trace execution logic, not familiarity with the tool's documentation page. Items on enumeration output reward knowing what a result means for the next phase of the engagement. Candidates who memorise tool names without understanding what each produces under specific conditions will find this topic punishing. Work through varied item types here: the topic is wide and the exam samples across it.

Once reconnaissance has mapped the surface, the next job is finding what is actually exploitable. Vulnerability Discovery and Analysis is where scanning meets judgment: running a tool is the easy part, and the exam knows it. The marks here go to candidates who can interpret results, recognise false positives, and understand what a finding means before anyone tries to exploit it.

How Vulnerability Discovery and Analysis is tested

At 17%, this topic rewards candidates who treat scan output as evidence to be evaluated rather than a list to be acted on immediately. Items on scan types test whether you know when an authenticated scan is required versus when an unauthenticated scan is appropriate, and what each type can and cannot detect. SAST and DAST questions turn on understanding what each approach covers and where each has blind spots. Result analysis is where candidates lose the most marks: items present a finding and ask whether it is valid, misconfigured, or a false positive, and the answer depends on reading the scenario details carefully. Tool questions on Nessus, Nikto, and OpenVAS test what each tool is best suited for, not just that all three perform scanning. Troubleshooting questions reward knowing what a scan configuration error looks like in the output. The trap throughout is acting on a finding before validating it, which the exam tests directly in scenario format.

Attacks and Exploits is the largest topic on the exam by a significant margin. It covers the full width of what a penetration tester can do once a foothold is available: network-layer attacks, authentication abuse, host compromise, web application exploitation, cloud-specific techniques, and AI-targeted attacks. The breadth is the point. You will not get away with being strong in one area and thin in the others.

– Network and authentication attacks

VLAN hopping, on-path attacks, and service exploitation are tested as technique-level decisions: which technique applies to which network condition, and what a successful execution produces. On-path attack questions often hinge on what position in the network is required before the technique is viable. Service exploitation questions test whether you can match a discovered service to the class of attack it exposes. Authentication attacks cover brute-force, pass-the-hash, and credential stuffing. The exam distinguishes between them on the basis of what credential material each requires and what defensive control each bypasses. Pass-the-hash questions in particular reward knowing what the technique requires from the host and what it does not need, which is where candidates who have only surface-level familiarity with the concept go wrong.

– Host-based attacks

Privilege escalation, process injection, and credential dumping are each tested at a level of detail that requires knowing the mechanism, not just the name. Privilege escalation questions describe a starting permission level and ask what technique or condition enables elevation: the answer depends on the specific OS context the scenario provides. Process injection questions test what the technique achieves and under what conditions it is detectable. Credential dumping questions reward knowing where credentials are stored, what tool or technique retrieves them, and what access level is required before the technique is available. Candidates who treat these as interchangeable post-access techniques rather than as distinct methods with distinct prerequisites will consistently pick the wrong option.

– Web application attacks

SQL injection, cross-site scripting, and directory traversal are tested with enough specificity that knowing the category is not enough. SQL injection questions distinguish between error-based, blind, and time-based variants and ask which applies to the scenario described. XSS questions turn on the difference between stored, reflected, and DOM-based variants and what each requires from the target application. Directory traversal questions test what the technique can reach and what server-side controls prevent it. Web application attack items reward candidates who can read a short snippet of application behaviour and identify the vulnerability class it represents, not candidates who can define the terms in the abstract.

– Cloud and AI attacks

Cloud-based attack questions cover container escapes, metadata service attacks, and IAM misconfiguration. Container escape questions test what the technique requires from the container configuration and what it achieves. Metadata service attack questions reward knowing what the endpoint exposes and why that matters in a cloud environment. IAM misconfiguration questions are scenario-based: you are given a permission set or policy and asked to identify what an attacker can do with it. AI attack coverage is narrower: prompt injection and model manipulation are tested as concepts you need to be able to recognise and describe in context. The exam does not go deep into AI security mechanics, but it does expect you to identify when an AI system is the target and what class of attack applies.

How Attacks and Exploits is tested

At 35%, this topic decides the exam for most candidates. Items here are almost always scenario-based and require you to select the right technique for a described situation, not just name the technique in the abstract. The most consistent trap is selecting an attack that is plausible but requires a precondition the scenario has not established. Read every scenario for what access, position, or credential material has already been obtained before selecting a technique. Items on web application attacks reward identifying the specific variant of a vulnerability class rather than the class itself. Items on cloud attacks reward knowing what each misconfiguration exposes rather than just knowing the category name. Items on authentication attacks reward knowing what each technique requires from the environment. Candidates who have worked through a wide range of attack scenarios perform better here than those who have read about the techniques without practising the decision-making the items demand.

After Attacks and Exploits has tested the full range of initial compromise techniques, Post-exploitation and Lateral Movement picks up where a successful exploit leaves off. This topic tests what a tester does with access once they have it: how they deepen it, how they move through the environment, and how they leave it clean. The documentation side of this topic connects directly back to Engagement Management, closing the loop on the full engagement lifecycle.

How Post-exploitation and Lateral Movement is tested

At 14%, this topic is smaller than Attacks and Exploits but requires the same scenario-reading discipline. Items on persistence reward knowing which techniques leave detectable artefacts and which do not, and the scenario will often give you a detection-risk constraint that determines the right choice. Lateral movement questions test the specific techniques available from a given foothold and what credential or trust material each requires. The exam distinguishes between moving laterally using stolen credentials, exploiting trust relationships, and pivoting through a compromised host, and the scenario details tell you which applies. Cleanup questions reward knowing what artefacts a specific activity leaves and what must be removed to restore the environment to its pre-test state. Documentation items test the attack narrative: what it must contain, who it is for, and how remediation recommendations are framed. Candidates who treat cleanup and documentation as afterthoughts lose marks that are straightforward to earn.