What PT0-003 measures
CompTIA identifies the current PenTest+ V3 exam as PT0-003. The official page lists a launch date of December 17, 2024, a length of 165 minutes, and a maximum of 90 questions including multiple-choice and performance-based questions. CompTIA lists a passing score of 750 on a 100–900 scale and recommends three to four years in a penetration tester role with Network+ and Security+ or equivalent knowledge. Verify the official page for current delivery and retirement information when scheduling.
The public V3 weights are Engagement management 13%, Reconnaissance and enumeration 21%, Vulnerability discovery and analysis 17%, Attacks and exploits 35%, and Post-exploitation and lateral movement 14%. PrepKloud's exact 50-question study allocation is 7, 10, 9, 17, and 7. The integer allocation intentionally totals 50 and is the requested proportional study set, not a claim about the live count or format mix.
The core model: authority before capability
A system being reachable, discoverable, or vulnerable does not authorize testing. Start every engagement by identifying who owns the asset, who can authorize the method, which exact target and account are included, when testing may occur, what impact is accepted, and who can stop or recover the service. Third-party payment, SaaS, cloud, CDN, and shared services require provider-compliant authority or exclusion.
Translate the document into controls: target and tenant allowlists; approved identities; endpoint, protocol, method, payload, rate, and concurrency limits; denied external routes; health monitoring; stop thresholds; encrypted evidence; and automatic teardown. Then follow a consistent lifecycle: map, assess, validate minimally, communicate, remediate, retest, clean up. A penetration test is valuable because it produces defensible risk evidence and control improvement, not because it maximizes access.
Domain 1: Engagement management
Rules of engagement should define parties, objectives, owned assets, third parties, methods, windows, rates, fragile systems, exclusions, permitted account actions, evidence collection, data handling, emergency contacts, stop conditions, rollback, retest, retention, deletion, and final acceptance. A chat message does not safely expand a signed scope; document and approve changes first.
Critical findings may require immediate escalation before the final report. Agree on severity and communication paths during planning. Provide concise evidence, affected scope, uncertainty, immediate containment options, and the next decision. Unexpected regulated, safety, or criminal indicators should go to designated engagement, legal, privacy, or law-enforcement liaison channels according to policy and law. The tester should not self-authorize a broader investigation or public disclosure.
A finding needs affected scope, prerequisites, minimum reproducible evidence, observed and potential impact, likelihood, root condition, remediation, compensating options, limitations, owner, and retest criteria. Protect raw artifacts: they can expose architecture, source, configuration, synthetic secrets, and assessment methods. Encrypt, restrict, track provenance, redact report copies, and delete on the agreed schedule.
Domain 2: Reconnaissance and enumeration
Passive reconnaissance obtains information from approved third-party or public sources without direct target interaction. Active reconnaissance sends traffic to the target. Passive does not mean unrestricted: source terms, privacy, ownership, freshness, and accuracy still matter. Active discovery requires written target scope, safe rates, monitoring, exclusions, and stop conditions.
Build service identity from multiple observations. Port numbers are conventions, banners can be altered, certificates can be shared or stale, and proxies can mask backends. Correlate protocol handshakes, certificate subjects and issuers, response behavior, DNS, application routes, API descriptions, asset inventory, and owner documentation. Record denied and unreachable paths rather than silently dropping them.
Automation should pin target addresses and cloud account or tenant identifiers, validate caller identity, fail closed on mismatches, restrict concurrency and timeouts, log actions, and offer a dry run. Read-only directory or cloud credentials do not authorize following every discovered trust. Packet observation should be limited by interface, filter, fields, duration, access, and retention.
Domain 3: Vulnerability discovery and analysis
Network and host scanners, authenticated checks, source analysis, dependency and image analysis, configuration review, DAST, and API tests cover different evidence. Verify scanner authentication, privilege, policy, platform support, target reachability, and successful check count. A target that could not be checked is unknown, not secure.
Tool output is a starting claim. Validate product and package identity, vendor advisory, build provenance, configuration, reachable path, prerequisite, compensating control, and safe observable behavior. A library can be present but not loaded. A dangerous source path can be absent from the deployed route. An organization-level cloud deny can override a permissive resource template. Keep those distinctions explicit.
Prioritize validation based on feasible path, exposure, controls, target value, business impact, and testing safety. During retest, confirm that the deployed version contains the fix, the root condition is removed, nearby in-scope paths fail safely, required functionality still works, and monitoring remains healthy.
Domain 4: Attacks and exploits
Application and API controls
Broken object-level authorization occurs when a caller can act on another object's identifier without permission. Broken function-level authorization permits an operation beyond the caller's role. In a lab, validate with designated test accounts and synthetic objects, preserve the minimum request and response, and stop. Remediation belongs on the server for every object and operation.
Parameterized queries separate query code from user data. Context-aware output encoding prevents data from becoming executable markup. Canonical server-side path resolution and authorized object mapping prevent traversal. Upload validation should control type, size, content, storage location, execution, retrieval, and authorization. Use inert markers—not executable payloads—to demonstrate errors. Server-side fetch requires destination and scheme allowlists, address validation, internal and metadata blocking, restricted egress, and redirect revalidation.
Identity, cloud, containers, and AI
Use synthetic accounts to evaluate MFA, password reuse defenses, breached-password screening, rate limits, anomaly detection, session invalidation, secure recovery, and privileged access. Do not collect credentials. Cloud testing should focus on effective policy, metadata protection, workload identity, egress, public access, audit coverage, and least privilege. Client-delivered secrets are exposed by design; rotate them and move privileged operations server-side.
Container risk grows with privileged mode, host mounts, broad capabilities, shared namespaces, root identity, vulnerable runtime, and open egress. Remove unnecessary authority and enforce policy. For AI systems, retrieved documents and user prompts are untrusted. Keep secrets and unrestricted tools away from the model, require source-linked constrained output, filter retrieval by access and freshness, and enforce authorization outside probabilistic generation.
Safe proof selection
A public proof-of-concept may contain destructive, expansive, or concealed behavior. Do not run it merely because the target is a lab. Review code and vendor information, identify the minimal safety property to observe, and replace harmful behavior with approved inert validation. Monitor target health, snapshot before change, define rollback, and stop after proof.
Domain 5: Post-exploitation and lateral movement
Post-exploitation demonstrates why the initial weakness matters, but the objective is not to collect everything available. Use synthetic identities and designated canary files, records, shares, or services. Access the smallest proof, record the path, and stop. Compare effective rights with documented business need. Do not dump credentials, search for real secrets, disable sensors, hide activity, or install durable access.
A lateral path finding should identify source, destination, identity, protocol, expected policy, minimum observed connection, business roles, impact, and remediation. One path does not prove total compromise. Break paths through default-deny segmentation, explicit required flows, administrative tiering, just-in-time authority, hardened management origins, service minimization, and privileged-session monitoring.
If an objective requires understanding persistence conceptually, simulate it only through a pre-approved visible marker with an automatic expiry and immediate cleanup. The test is not complete until inventories show no test identities, tokens, canaries, files, tasks, processes, rules, listeners, routes, snapshots, schedules, raw artifacts beyond retention, or active charges.
Three projects that integrate the domains
The Authorized Hybrid Penetration Test builds a private range with network, application, API, identity, and cloud-like boundaries. It maps the attack surface, combines safe assessment methods, validates findings with inert canaries, creates an evidence-linked narrative, remediates, retests, and proves teardown.
The secure web, API, and AI assessment lab combines source and runtime analysis with synthetic object authorization, upload, path, fetch, session, secret, container, and prompt-injection fixtures. It adds regression tests so that the deliverable is not a one-time report but a prevention control.
The segmentation and identity path project creates guest, user, server, and management zones with synthetic identities and canary shares. It demonstrates selected unintended paths visibly, replaces standing privilege with time-bound authority and tiering, retests access and detection, and removes every simulation artifact.
A ten-week preparation plan
| Weeks | Focus | Evidence of mastery |
|---|---|---|
| 1–2 | Authorization, rules, third parties, safety, evidence, reports, isolated range design | Signed scope, allowlists, threat model, cleanup acceptance |
| 3–4 | Passive and active reconnaissance, services, DNS, certificates, applications, directories, cloud | Source-linked attack-surface map and coverage log |
| 5–6 | Network, host, source, dependency, image, configuration, DAST, API, validation, retest | Normalized finding register and safe proof plan |
| 7–8 | Application, identity, cloud, container, wireless, AI control failures and remediation | Inert canary evidence and defensive regression tests |
| 9–10+ | Post-exploitation narratives, segmentation, JIT identity, three projects, 40 cards, 50 questions | Retest, detections, architecture, cost, evidence, cleanup attestation |
Use the five-phase PT0-003 roadmap as the checklist. Review 40 flashcards by explaining the control consequence. Complete the 50 original questions and explain why each distractor exceeds authority, trusts incomplete evidence, uses unnecessary impact, overclaims, or omits retest and cleanup.
Scenario and performance reasoning
First find the authority boundary: exact target, owner, method, time, identity, and stop condition. Then identify the lifecycle stage: plan, discover, enumerate, analyze, validate, report, remediate, retest, or clean up. The best answer usually performs the next necessary stage without skipping evidence or expanding scope.
Separate tool output from confirmed finding; component presence from runtime path; authentication from authorization; demonstrated access from hypothetical impact; and remediation deployment from validated closure. Choose the least harmful proof that distinguishes the condition. Use synthetic objects and canaries, preserve evidence, stop after proof, and connect every result to a root-cause control.
Be suspicious of options that imply permission from reachability, use public or unrelated targets, collect credentials or real data, disable monitoring, conceal activity, execute destructive code, leave access behind, or skip cleanup. Those choices weaken both professional ethics and technical assurance.
Official references
Continue preparation
- PT0-003 V3 roadmap
- 50 PT0-003 questions
- 40 PT0-003 flashcards
- Three PT0-003 projects
- CySA+ CS0-004 roadmap
- All roadmaps
- Editorial policy
Frequently asked questions
What is the current PenTest+ exam code?
The current CompTIA PenTest+ V3 exam is PT0-003.
How long is PT0-003 and which formats can appear?
CompTIA lists 165 minutes and a maximum of 90 questions, including multiple-choice and performance-based questions.
What are the official domain weights?
Engagement management 13%, Reconnaissance and enumeration 21%, Vulnerability discovery and analysis 17%, Attacks and exploits 35%, and Post-exploitation and lateral movement 14%.
How are PrepKloud's 50 questions allocated?
Exactly 7, 10, 9, 17, and 7 across the five domains, split into two files of 25.
What experience does CompTIA recommend?
CompTIA recommends three to four years in a penetration tester role with Network+ and Security+ or equivalent knowledge.
Are these labs safe and are the questions exam dumps?
The questions are independently authored, not dumps. Labs require written authorization, isolated owned systems, synthetic data, inert proof, visible reversible activity, and cleanup; they prohibit real targets, credential theft, stealth, destructive payloads, and durable persistence.