EnglishDeutschFrançaisEspañolPortuguês

CompTIA · COMPTIA-PENTEST · Advanced

CompTIA PenTest+ — Practice Questions and Mock Exam

CompTIA PenTest+ (PT0-003) validates the skills required to plan, scope, and perform penetration tests, analyze findings, and communicate results to stakeholders.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing COMPTIA-PENTEST freeBuy COMPTIA-PENTEST access for $29.99
90Questions per Pass-IT mock exam
165minPass-IT mock exam time limit

Official COMPTIA-PENTEST exam: 750 out of 900 points to pass.

Checked against CompTIA · September 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a COMPTIA-PENTEST sample question and read the explanation with its source. Right here, with no sign-up.

Engagement Management1 / 5

Which metric is MOST useful for demonstrating test coverage in the metrics section of a penetration test report?

AlexFull explanation from Alex

Test coverage is the most meaningful metric for demonstrating engagement breadth. It is calculated as (assets tested / total in-scope assets) x 100%. Per PTES Reporting guidelines, this quantifies how thoroughly the engagement scope was addressed. Hours worked measures effort, not coverage. Packet counts reflect scanning volume, not testing completeness. Coffee consumption is irrelevant. Stakeholders rely on coverage percentages to assess whether their attack surface was adequately evaluated and to identify gaps requiring follow-up testing. (Ref: PTES Technical Guidelines--Reporting; CompTIA PenTest+ Objective 5.1)

Sourcecsrc.nist.gov

Reconnaissance and Enumeration2 / 5

A penetration tester needs to assess the security of a Modbus/TCP implementation on an ICS network. Which of the following is a critical security weakness inherent to the Modbus protocol itself?

AlexFull explanation from Alex

Modbus, designed in 1979, transmits commands in cleartext over TCP port 502 with zero authentication, encryption, or authorization. Any client with network access can read input registers (FC 0x04), write coils (FC 0x05), or write holding registers (FC 0x06) without credentials. Per NIST SP 800-82 Rev. 3, compensating controls like network segmentation, protocol-aware firewalls, and VPN tunnels are essential. The other options incorrectly describe Modbus as having TLS, certificate auth, or encrypted transit--none exist in the protocol specification. (Ref: NIST SP 800-82; CISA ICS-CERT Modbus Fact Sheet)

Sourcemodbus.org

Vulnerability Discovery and Analysis3 / 5

A penetration tester is comparing results from an unauthenticated vulnerability scan and an authenticated scan of the same server. The authenticated scan found 47 additional vulnerabilities. Which of the following BEST explains the difference?

AlexFull explanation from Alex

Per NIST SP 800-115, authenticated (credentialed) scans use valid system credentials to inspect hosts internally, revealing installed software versions, patch levels, local configurations, and registry settings not visible to external probes. Unauthenticated scans only see externally exposed services and infer vulnerabilities from banners—a significantly limited perspective. The 47 additional vulnerabilities represent the gap between external visibility and internal system state. Distractor analysis: Misconfiguration wouldn't explain consistent additional findings. Authenticated scans produce fewer false positives (the option “The authenticated scan produced more false positives due…” is incorrect) because they verify exact versions. Firewall blocking would affect both scan types equally. Ref: NIST SP 800-115 §5.2; CompTIA PenTest+ PT0-002 Objective 3.1; CIS Benchmark Guidelines.

Sourcedocs.tenable.com

How to prepare for COMPTIA-PENTEST with Pass-IT.

Currently 301 practice questions for COMPTIA-PENTEST, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · COMPTIA-PENTEST

Reporting test coverage

  1. You

    Do hours worked tell the client how much scope we tested?

  2. Alex · AI tutor

    They describe effort. For asset coverage, compare tested assets with all assets in the agreed scope.

    Read the documentation ↗
  3. You

    Why keep the scope explicit?

  4. Alex · AI tutor

    It makes the denominator clear and shows what the coverage figure actually describes.

    Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

COMPTIA-PENTEST · Question excerpt

Reporting test coverage

View the full question

Which metric is MOST useful for demonstrating test coverage in the metrics section of a penetration test report?

Understand the correct answer.

Percentage of in-scope assets that were successfully tested

Report tested assets relative to the agreed in-scope assets.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your COMPTIA-PENTEST mock exam

Questions
90
Minutes
165

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for COMPTIA-PENTEST.

Exam topics, relevant practice and sources you can check.

Plan and communicate an authorized testSee the guide for weighting89 QuestionsPass-IT questions

Define the engagement and turn findings into clear, useful recommendations.

  • Set scope, targets, rules, responsibilities and agreements, accounting for authorization, legal duties and ethical limits.
  • Coordinate with stakeholders, escalate issues and explain risk, severity and business impact through secure communication.
  • Compare penetration-testing and threat-modeling frameworks for the engagement.
  • Prepare reports with methods, evidence, attack narratives, limitations and recommendations, selecting suitable technical, administrative, operational or physical remedies.
Official certification objectives
Discover and enumerate the environmentSee the guide for weighting44 QuestionsPass-IT questions

Gather information that reveals exposed systems and possible test paths.

  • Use active and passive reconnaissance to collect public, network, certificate and application information within scope.
  • Enumerate hosts, services, identities, permissions, secrets and application paths to understand the target environment.
  • Adapt Bash, Python or PowerShell scripts using logic and data manipulation for information gathering.
  • Choose reconnaissance tools for source research, DNS, scanning, packet inspection and wireless discovery.
Official certification objectives
Find and validate vulnerabilitiesSee the guide for weighting33 QuestionsPass-IT questions

Use scanning and analysis to establish which weaknesses need further testing.

  • Choose suitable application, host, cloud, container, wireless or network scans, with appropriate authentication and industrial-system assessment methods.
  • Validate reconnaissance and scan results for errors, omissions and configuration problems, using scripts and selecting relevant public exploits.
  • Explain physical-security assessment concepts such as site surveys, tailgating, badge cloning and lock testing.
Official certification objectives
Select and perform scoped attack techniquesSee the guide for weighting120 QuestionsPass-IT questions

Match authorized test techniques to the target, its defenses and the evidence collected.

  • Prioritize targets and prepare tools or exploits within scope, using scripts and breach simulations to automate suitable tests.
  • Test network, authentication and host weaknesses, including credential attacks, privilege escalation and security-control bypasses.
  • Test web applications and APIs for injection, access-control, session, request-handling and file-related flaws.
  • Test cloud identities, resources, trust relationships, containers and software supply chains for exploitable misconfigurations.
  • Apply wireless test techniques and explain attacks on specialized mobile, AI, industrial and short-range radio systems.
  • Use appropriate techniques and tools for authorized social-engineering tests, including phishing, impersonation and physical observation.
Official certification objectives
Assess impact and restore the environmentSee the guide for weighting15 QuestionsPass-IT questions

Evaluate post-exploitation paths and remove the changes made during testing.

  • Establish and assess persistence through accounts, services, scheduled tasks or other approved mechanisms.
  • Explore lateral movement through discovery, credential access, remote services and pivoting tools.
  • Explain staging and data-exfiltration methods, including compression, encryption, covert channels and cloud transfers.
  • Remove test access, tools and configuration changes, shut down test infrastructure and preserve or securely destroy artifacts as required.
Official certification objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
Drag & Drop
Match items to the appropriate targets.
Performance-based
Complete a practical task in a simulated environment, following the stated requirements.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

Frequently asked questions

Your preparation

How much study time should I plan for COMPTIA-PENTEST?

For planning, Pass-IT estimates roughly 70–180 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from CompTIA or a promise that you will be exam-ready within that time.

What do you need before PenTest+?

Nothing formally. CompTIA recommends Security+ or Network+ plus three to four years of security work, and the catalog budget is 120 hours. That is the same budget as Linux+ and for the same reason: the exam expects tool fluency you can only build by running the tools.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with CompTIA for the languages available for the official exam.

How long does my COMPTIA-PENTEST access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the COMPTIA-PENTEST exam

Where can I take the COMPTIA-PENTEST exam?

Pearson VUE (testing center or online proctored).

How long is the CompTIA PenTest+ exam?

The CompTIA PenTest+ exam has 90 questions and a 165-minute time limit.

PenTest+ or CySA+ — which one should you take?

They are the two halves of the same job. CySA+ is defensive: detection, vulnerability management and incident response from inside the SOC. PenTest+ is offensive: scoping an engagement, finding the way in and reporting it. Take the one your role actually does, since neither is a prerequisite for the other.

How long is PenTest+ valid?

Three years, renewed with 60 continuing-education units inside the cycle. Passing a higher-level CompTIA certification renews it instead, which is the route most people take after SecurityX.

What happens if you fail PenTest+?

The second attempt can be booked with no wait. After a second failure CompTIA requires 14 days before each further attempt.

Your preparation for COMPTIA-PENTEST

$29.99one-time

12 months of access for COMPTIA-PENTEST · No automatic renewal

Buy COMPTIA-PENTEST access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

CompTIA A+ Core 1CompTIA A+ Core 2CompTIA Cloud+CompTIA CySA+All CompTIA certifications →