CompTIA PenTest+ — Practice Questions and Mock Exam

CompTIA PenTest+ (PT0-003) validates the skills required to plan, scope, and perform penetration tests, analyze findings, and communicate results to stakeholders. It covers the full penetration testing lifecycle including reconnaissance, enumeration, vulnerability discovery, exploitation, post-exploitation, and lateral movement across traditional, cloud, hybrid, web application, API, and IoT environments.

The PT0-003 version launched on December 17, 2024, adding coverage for AI-based attacks, expanded cloud and API exploitation, modern post-exploitation techniques, and updated tooling.

CompTIA recommends three to four years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge.

Attacks and Exploits dominates the blueprint at 35% (more than a third of the exam), covering target prioritization and hands-on exploitation that spans networks, web apps, cloud environments, wireless gear, and social-engineering targets. Reconnaissance and Enumeration follows at 21%, then Vulnerability Discovery and Analysis at 17%. Post-exploitation and Lateral Movement (14%) and Engagement Management (13%) are the smallest domains, but Engagement Management sets the legal and scoping foundation every later domain assumes is already in place.

The weighting rewards candidates who can execute an attack chain end to end rather than just recognize its individual stages: reconnaissance, exploitation, and post-exploitation together account for 70% of the exam, and the questions expect one phase to inform the next. Engagement Management's small share is deceptive — get the scoping and legal groundwork wrong, and later technical answers get marked against a rules-of-engagement violation that was set up two domains earlier.

The exam draws up to 90 questions across a 165-minute window, longer than most CompTIA exams to accommodate performance-based items that run through live command execution, tool-output analysis, and exploit configuration inside simulated environments. Multiple-choice questions come in both single-answer and multiple-response form, often built around a network diagram, log excerpt, or tool output you have to interpret rather than a fact you recall directly. Drag-and-drop items test whether you can sequence an attack chain or match a technique to the phase it belongs in. The passing score is 750 on a scale of 100 to 900.

The COMPTIA-PENTEST pool covers every exam domain and keeps growing with new questions. A mock exam asks 90 questions in one sitting, on the same 165-minute clock as the real thing.

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

CompTIA PenTest+ PT0-003 is delivered at Pearson VUE testing centers worldwide or online with a proctor. The exam is available in English, French, Japanese, and Portuguese. The certification is valid for three years and renews with 60 CEUs plus the annual CE fee, or by earning a higher-level CompTIA certification.

Engagement management gets underweighted by candidates who focus on exploitation and treat scoping, rules of engagement, and legal considerations as paperwork rather than tested material — Engagement Management is a full domain, not a preamble. Knowing a tool's name isn't the same as knowing what its output means: the exam expects candidates to read Nmap, Burp Suite, or Metasploit results and decide the next step, not just recognize the tool. Jumping straight to exploitation without proper reconnaissance and enumeration is a methodology error the exam penalizes directly, and reporting weaknesses compound it further — a technically correct engagement with a weak executive summary or missing remediation guidance still loses points. PT0-003 also expanded cloud, API, and specialized-system coverage, so candidates who only prepared for traditional network penetration testing lose ground on Attacks and Exploits, the largest domain at 35%.