PenTest+ study guide · 2026

The 5 PenTest+ domains, explained

5 domains and 26 official objectives. Attacks and Exploits carries the most weight at 35%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
Maximum of 90
Time
165 minutes
Passing score
750 (scale 100–900)
Outline
PT0-003 (V3) exam objectives v3.0, launched 17 December 2024 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 13%
  2. 2 21%
  3. 3 17%
  4. 4 35%
  5. 5 14%
  1. 1 Engagement Management
  2. 2 Reconnaissance and Enumeration
  3. 3 Vulnerability Discovery and Analysis
  4. 4 Attacks and Exploits
  5. 5 Post-exploitation and Lateral Movement

All 5 domains

26 official objectives 115–145 hrs suggested study

  1. Domain 01 13%

    Engagement Management

    Engagement Management covers the professional scaffolding around a penetration test: scoping and authorization, the agreements that make testing legal, the frameworks that guide it, and the report that turns findings into action. In PT0-003 reporting lives here.

    Inside this domain

    • Summarize pre-engagement activities.
    • Explain collaboration and communication activities.
    • Compare and contrast testing frameworks and methodologies.
    • Explain the components of a penetration test report.
    • and 1 more objectives

    Watch for Exploit the bonus target

    Objectives
    5
    Questions est.
    ~12
    Study time est.
    15–20 hrs
  2. Domain 02 21%

    Reconnaissance and Enumeration

    Reconnaissance and Enumeration covers gathering information and mapping the target: passive and active recon, OSINT, service and host enumeration, scripting to automate it, and the tools that do the work. Good recon shapes every attack that follows.

    Inside this domain

    • Given a scenario, apply information gathering techniques.
    • Given a scenario, apply enumeration techniques.
    • Given a scenario, modify scripts for reconnaissance and enumeration.
    • Given a scenario, use the appropriate tools for reconnaissance and enumeration.

    Watch for Scan for stealth

    Objectives
    4
    Questions est.
    ~19
    Study time est.
    25–30 hrs
  3. Domain 03 17%

    Vulnerability Discovery and Analysis

    Vulnerability Discovery and Analysis covers finding weaknesses and confirming they are real: choosing the right scan type, assessing fragile ICS systems carefully, validating results against false positives, selecting exploits, and the physical security tests that bypass technical controls.

    Inside this domain

    • Given a scenario, conduct vulnerability discovery using various techniques.
    • Given a scenario, analyze output from reconnaissance, scanning, and enumeration phases.
    • Explain physical security concepts.

    Watch for Exploit on sight

    Objectives
    3
    Questions est.
    ~15
    Study time est.
    20–25 hrs
  4. Domain 04 35%

    Attacks and Exploits

    Attacks and Exploits is by far the largest PenTest+ domain. It covers prioritizing targets and then executing attacks across networks, authentication, hosts, web applications, the cloud, wireless and people, plus specialized systems and attack automation with scripting.

    Inside this domain

    • Given a scenario, analyze output to prioritize and prepare attacks.
    • Given a scenario, perform network attacks using the appropriate tools.
    • Given a scenario, perform authentication attacks using the appropriate tools.
    • Given a scenario, perform host-based attacks using the appropriate tools.
    • and 6 more objectives

    Watch for Crack before reusing

    Objectives
    10
    Questions est.
    ~31
    Study time est.
    40–50 hrs
  5. Domain 05 14%

    Post-exploitation and Lateral Movement

    Post-exploitation and Lateral Movement covers what happens after the first compromise: establishing persistence, moving through the network, staging and exfiltrating data covertly, and then cleaning up so the environment is returned to its original state.

    Inside this domain

    • Given a scenario, perform tasks to establish and maintain persistence.
    • Given a scenario, perform tasks to move laterally throughout the environment.
    • Summarize concepts related to staging and exfiltration.
    • Explain cleanup and restoration activities.

    Watch for Bind shell behind a firewall

    Objectives
    4
    Questions est.
    ~13
    Study time est.
    15–20 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 115–145 hrs of study.

  1. 4 Attacks and Exploits 35% · 40–50 hrs
  2. 2 Reconnaissance and Enumeration 21% · 25–30 hrs
  3. 3 Vulnerability Discovery and Analysis 17% · 20–25 hrs
  4. 5 Post-exploitation and Lateral Movement 14% · 15–20 hrs
  5. 1 Engagement Management 13% · 15–20 hrs

Try one

Practice questionDomain 4: Attacks and Exploits

A web application running on a cloud virtual machine lets a user supply a URL that the server then fetches. The penetration tester wants to maximize impact. Which action is MOST likely to escalate this into broader cloud compromise?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Exploit the bonus target

    Clue The target is not listed in the scope or CIDR ranges.

  • Domain 2

    Scan for stealth

    Clue The scenario requires avoiding detection.

  • Domain 3

    Exploit on sight

    Clue The banner, version or context suggests the finding may not apply.

  • Domain 4

    Crack before reusing

    Clue The scenario mentions captured hashes and a need for speed or stealth.

  • Domain 5

    Bind shell behind a firewall

    Clue The target is behind a firewall that blocks inbound traffic.

Other Cybersecurity certifications

Study guides for exams that overlap with PenTest+.

Practise what you read

PenTest+ domains: common questions

How many domains are in the PenTest+ exam?

PenTest+ has 5 domains with 26 official objectives between them: Engagement Management, Reconnaissance and Enumeration, Vulnerability Discovery and Analysis, Attacks and Exploits and Post-exploitation and Lateral Movement.

Which PenTest+ domain carries the most weight?

Attacks and Exploits is the heaviest at 35%, followed by Reconnaissance and Enumeration (21%). The lightest is Engagement Management (13%). Weights come from CompTIA's official outline.

What is the PenTest+ exam format?

Questions: Maximum of 90. Time allowed: 165 minutes. Passing score: 750 (scale 100–900).

How long should I study for PenTest+?

Our planning estimate is 115–145 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Attacks and Exploits, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows PT0-003 (V3) exam objectives v3.0, launched 17 December 2024 (current), published by CompTIA. It was last reviewed in October 2026.

Domain names, weights and objectives come from CompTIA's official outline (PT0-003 (V3) exam objectives v3.0, launched 17 December 2024 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.