CompTIA · COMPTIA-PENTEST · Advanced

CompTIA PenTest+ — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for COMPTIA-PENTEST with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing COMPTIA-PENTEST free Buy COMPTIA-PENTEST access for $29.99

Buy COMPTIA-PENTEST access for $29.99 Start practicing COMPTIA-PENTEST free

90Mock exam questions

165minTime limit

750/ 900Passing score

Checked against CompTIA · September 2026 · Current exam version

Overview

About the exam

CompTIA PenTest+ (PT0-003) validates the skills required to plan, scope, and perform penetration tests, analyze findings, and communicate results to stakeholders. It covers the full penetration testing lifecycle including reconnaissance, enumeration, vulnerability discovery, exploitation, post-exploitation, and lateral movement across traditional, cloud, hybrid, web application, API, and IoT environments.

The PT0-003 version launched on December 17, 2024, adding coverage for AI-based attacks, expanded cloud and API exploitation, modern post-exploitation techniques, and updated tooling.

CompTIA recommends three to four years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge.

Try the practice preview

Try five COMPTIA-PENTEST questions

Try five practice questions from the app’s current CompTIA PenTest+ question bank, with answers and explanations.

Engagement Management1 / 5

Which metric is MOST useful for demonstrating test coverage in the metrics section of a penetration test report?

AlexFull explanation from Alex

Test coverage is the most meaningful metric for demonstrating engagement breadth. It is calculated as (assets tested / total in-scope assets) x 100%. Per PTES Reporting guidelines, this quantifies how thoroughly the engagement scope was addressed. Hours worked measures effort, not coverage. Packet counts reflect scanning volume, not testing completeness. Coffee consumption is irrelevant. Stakeholders rely on coverage percentages to assess whether their attack surface was adequately evaluated and to identify gaps requiring follow-up testing. (Ref: PTES Technical Guidelines--Reporting; CompTIA PenTest+ Objective 5.1)

Sourcecsrc.nist.gov

Reconnaissance and Enumeration2 / 5

A penetration tester needs to assess the security of a Modbus/TCP implementation on an ICS network. Which of the following is a critical security weakness inherent to the Modbus protocol itself?

AlexFull explanation from Alex

Modbus, designed in 1979, transmits commands in cleartext over TCP port 502 with zero authentication, encryption, or authorization. Any client with network access can read input registers (FC 0x04), write coils (FC 0x05), or write holding registers (FC 0x06) without credentials. Per NIST SP 800-82 Rev. 3, compensating controls like network segmentation, protocol-aware firewalls, and VPN tunnels are essential. The other options incorrectly describe Modbus as having TLS, certificate auth, or encrypted transit--none exist in the protocol specification. (Ref: NIST SP 800-82; CISA ICS-CERT Modbus Fact Sheet)

Sourcemodbus.org

Vulnerability Discovery and Analysis4 / 5

A penetration tester is comparing results from an unauthenticated vulnerability scan and an authenticated scan of the same server. The authenticated scan found 47 additional vulnerabilities. Which of the following BEST explains the difference?

AlexFull explanation from Alex

Per NIST SP 800-115, authenticated (credentialed) scans use valid system credentials to inspect hosts internally, revealing installed software versions, patch levels, local configurations, and registry settings not visible to external probes. Unauthenticated scans only see externally exposed services and infer vulnerabilities from banners—a significantly limited perspective. The 47 additional vulnerabilities represent the gap between external visibility and internal system state. Distractor analysis: Misconfiguration wouldn't explain consistent additional findings. Authenticated scans produce fewer false positives (the option “The authenticated scan produced more false positives due…” is incorrect) because they verify exact versions. Firewall blocking would affect both scan types equally. Ref: NIST SP 800-115 §5.2; CompTIA PenTest+ PT0-002 Objective 3.1; CIS Benchmark Guidelines.

Sourcedocs.tenable.com

Create a free account

Question pool

324 practice questions

Use the Pass-IT question pool to practice for COMPTIA-PENTEST. Mock exams are set to 90 questions in 165 minutes.

Pool details: COMPTIA-PENTEST

Exam details checked against CompTIASeptember 5, 2026

date of the last check against the official CompTIA source

Passing score750 / 900

as published by CompTIA

Objectives in the guide26 objectives listed in the official guide

across 5 domains in the official exam guide

Pool size324 questions

= The pool size is equivalent to 3 sets of 90 questions; this does not mean that each mock exam uses a separate set.

Recorded as checked against sources302 of 324

questions recorded as having their answer, options, and explanation checked against official CompTIA documentation

How questions are made →

Exam domains

What's on the exam

Attacks and Exploits dominates the blueprint at 35% (more than a third of the exam), covering target prioritization and hands-on exploitation that spans networks, web apps, cloud environments, wireless gear, and social-engineering targets. Reconnaissance and Enumeration follows at 21%, then Vulnerability Discovery and Analysis at 17%. Post-exploitation and Lateral Movement (14%) and Engagement Management (13%) are the smallest domains, but Engagement Management sets the legal and scoping foundation every later domain assumes is already in place.

The weighting rewards candidates who can execute an attack chain end to end rather than just recognize its individual stages: reconnaissance, exploitation, and post-exploitation together account for 70% of the exam, and the questions expect one phase to inform the next. Engagement Management's small share is deceptive — get the scoping and legal groundwork wrong, and later technical answers get marked against a rules-of-engagement violation that was set up two domains earlier.

Exam blueprint: COMPTIA-PENTEST

Engagement Management13%

Scope and plan a penetration test including rules of engagement, legal agreements, and testing frameworks such as PTES and MITRE ATT&CK, and manage stakeholder communication throughout the engagement. Also covers structuring a penetration test report and recommending technical, administrative, operational, and physical remediation controls.

≈ 16 h

Reconnaissance and Enumeration21%

Apply active and passive information-gathering techniques such as OSINT and network reconnaissance, enumerate hosts, services, and shares, and write or modify scripts to automate reconnaissance using tools such as Nmap, Shodan, and theHarvester.

≈ 25 h

Vulnerability Discovery and Analysis17%

Conduct vulnerability discovery using application, network, host, and wireless scanning techniques, analyze and validate results from reconnaissance and scanning tools, and explain physical security concepts such as tailgating and badge cloning.

≈ 20 h

Attacks and Exploits35%

Prioritize targets and select attack tooling based on vulnerability scoring and exploitability, and execute network, authentication, host-based, web application, cloud, wireless, and social engineering attacks with tools such as Metasploit, Hydra, Burp Suite, and Mimikatz. Also covers attacks against specialized systems like mobile, AI, and OT environments, and scripting to automate attack chains.

≈ 42 h

Post-exploitation and Lateral Movement14%

Establish and maintain persistence on compromised systems, move laterally through an environment using pivoting and credential reuse, stage and exfiltrate data through covert channels, and perform cleanup and restoration activities after testing.

≈ 17 h

Format

Exam format and question types

The exam draws up to 90 questions across a 165-minute window, longer than most CompTIA exams to accommodate performance-based items that run through live command execution, tool-output analysis, and exploit configuration inside simulated environments. Multiple-choice questions come in both single-answer and multiple-response form, often built around a network diagram, log excerpt, or tool output you have to interpret rather than a fact you recall directly. Drag-and-drop items test whether you can sequence an attack chain or match a technique to the phase it belongs in. The passing score is 750 on a scale of 100 to 900.

Question types: COMPTIA-PENTEST

Multiple Choice71%

Select the single answer that best meets the question’s requirements.

Multiple Response13%

Select multiple answers. Follow the question’s instructions on how many to choose.

Drag & Drop9%

Move items into the slots, groups, or sequence specified by the task.

Performance-based7%

Complete a practical task in a simulated environment, following the stated requirements.

See CompTIA for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for COMPTIA-PENTEST

CompTIA PenTest+ PT0-003 is delivered at Pearson VUE testing centers worldwide or online with a proctor. The exam is available in English, French, Japanese, and Portuguese. The certification is valid for three years and renews with 60 CEUs plus the annual CE fee, or by earning a higher-level CompTIA certification.

Preparation and logistics: COMPTIA-PENTEST

Preparation

Illustrative study time70–180 h

illustrative planning range: 70 h with relevant experience to 180 h when starting out; your needs may fall outside this range

LevelAdvanced

Recommended backgroundNo formal prerequisites. CompTIA Security+ or Network+ and 3-4 years of security experience recommended.

Taking and maintaining the certification

DeliveryPearson VUE (testing center or online proctored)

Retake policyNo wait after first failure. 14-day wait required after second and subsequent failures. Full exam fee required each attempt.

Certification validity3 years

60 CEUs within 3-year cycle plus annual CE fee, or pass a higher-level CompTIA certification

Continuing education credits60

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: COMPTIA-PENTEST

01Engagement Scoping
Underestimating rules of engagement, legal requirements, and proper scoping documentation
02Tool Output Analysis
Knowing tool names but not understanding how to interpret their output or when to use them
03Methodology Shortcuts
Jumping to exploitation without proper reconnaissance and enumeration phases
04Vuln Scan vs Pentest
Confusing automated vulnerability scanning with manual penetration testing
05Reporting Skills
Weak executive summaries, missing remediation recommendations, poor finding communication
06Cloud and API Testing
Only preparing for traditional network pentesting and neglecting cloud, API, and IoT attack surfaces
07Post-exploitation
Not understanding lateral movement, persistence, and data exfiltration techniques

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the CompTIA PenTest+ exam?

The CompTIA PenTest+ exam has 90 questions and a 165-minute time limit.

What is the passing score for CompTIA PenTest+?

The passing score for the CompTIA PenTest+ exam is 750 / 900.

Which pitfalls should I review when preparing for CompTIA PenTest+?

Topics to review include Engagement Scoping, Tool Output Analysis, Methodology Shortcuts, Vuln Scan vs Pentest, Reporting Skills, Cloud and API Testing, Post-exploitation. Work through examples to check that you understand the distinctions and can explain your answer.

Which PenTest+ domains carry the most weight?

Attacks and exploits is by far the largest domain at 35%, followed by reconnaissance and enumeration at 21% and vulnerability discovery and analysis at 17%. Post-exploitation and lateral movement takes 14% and engagement management 13%. More than half the exam is therefore reconnaissance and exploitation.

What do you need before PenTest+?

Nothing formally. CompTIA recommends Security+ or Network+ plus three to four years of security work, and the catalog budget is 120 hours. That is the same budget as Linux+ and for the same reason: the exam expects tool fluency you can only build by running the tools.

PenTest+ or CySA+ — which one should you take?

They are the two halves of the same job. CySA+ is defensive: detection, vulnerability management and incident response from inside the SOC. PenTest+ is offensive: scoping an engagement, finding the way in and reporting it. Take the one your role actually does, since neither is a prerequisite for the other.

How long is PenTest+ valid?

Three years, renewed with 60 continuing-education units inside the cycle. Passing a higher-level CompTIA certification renews it instead, which is the route most people take after SecurityX.

What happens if you fail PenTest+?

The second attempt can be booked with no wait. After a second failure CompTIA requires 14 days before each further attempt.

One certification, 12 months

Practice for COMPTIA-PENTEST

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy COMPTIA-PENTEST access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →