CompTIA PenTest+ (PT0-002)
Validate hands-on penetration testing and vulnerability management skills, including planning and scoping engagements, network reconnaissance, exploiting vulnerabilities, attacking cloud/web applications, and authoring professional remediation reports.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
CompTIA PenTest+ is an intermediate, hands-on certification assessing offensive security skills, vulnerability assessment, ethical hacking, and management of legal penetration testing engagements.
The exam consists of up to 85 multiple-choice and performance-based questions (PBQs) to be completed within 165 minutes.
The passing scaled score is 750 on a scale of 100 to 900 (approximately 81%).
Domains include: (1) Planning and Scoping (14%), (2) Information Gathering and Vulnerability Identification (22%), (3) Attacks and Exploits (30%), (4) Reporting and Communication (18%), and (5) Tools and Code Analysis (16%).
The SOW outlines the contractual targets, deliverables, and timeline. The RoE defines the operational boundaries (testing windows, forbidden systems, communication paths, emergency contacts, acceptable techniques).
Passive reconnaissance gathers intelligence without directly interacting with target systems (OSINT, DNS records, Shodan). Active reconnaissance directly sends packets to target systems (port scanning, banner grabbing, service enumeration).
Metasploit provides a standardized modular framework for developing, testing, and executing exploits against targets, featuring modules for exploits, payloads (Meterpreter), auxiliary scanners, and post-exploitation.
Vertical privilege escalation moves from a low-privileged account to administrative/root privileges (exploiting SUID binaries, kernel bugs, misconfigured sudo). Horizontal escalation accesses resources belonging to another user of the same privilege level.
PenTest+ tests both hands-on technical exploitation and end-to-end business engagement lifecycle (planning, legal scoping, reporting). CEH is multiple-choice theory-focused. OSCP is a 24-hour practical lab exploitation exam.
Targeting OWASP Top 10 vulnerabilities including SQL injection, Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Cross-Site Request Forgery (CSRF), and Broken Object Level Authorization (BOLA).
Python, Bash, PowerShell, and Ruby scripts for automating reconnaissance, parsing outputs, and modifying exploit payloads.
Penetration testers, vulnerability testers, application security consultants, red teamers, and security analysts wanting comprehensive offensive validation.