PT0-003 · V3165 minutes · maximum 90 questionsRecommended experience is not a registration gate
Choose the learning pace for your starting point
CompTIA recommends Network+ and Security+ or equivalent knowledge plus three to four years in a penetration-tester job role for the exam. That is preparation guidance, not a requirement to buy either earlier credential or a registration gate. Its V3 product comparison describes CertMaster Perform as suitable without prior related job-role experience; course entry does not establish exam or workplace readiness.
Learnerside suggests checking the specific foundation gaps: networking, operating systems, web requests, scripting, written authorization and evidence handling. A compressed review class is a different choice from guided foundation learning. Use this research or prepare a private plan without completing an assessment first.
Keep the exam version and instruction distinct
The October 10 official page identifies V3, PT0-003, launched December 17, 2024: up to 90 multiple-choice and performance-based questions, 165 minutes and 750 on a 100–900 passing scale. It lists English, French, Japanese and Portuguese. Verify the actual appointment language before purchase.
Engagement management · 13% — Plain-English orientation: use this as the topic area to study for Engagement management. The official objectives define the exact vendor tasks.
Reconnaissance and enumeration · 21% — Plain-English orientation: use this as the topic area to study for Reconnaissance and enumeration. The official objectives define the exact vendor tasks.
Vulnerability discovery and analysis · 17% — Plain-English orientation: use this as the topic area to study for Vulnerability discovery and analysis. The official objectives define the exact vendor tasks.
Attacks and exploits · 35% — Plain-English orientation: use this as the topic area to study for Attacks and exploits. The official objectives define the exact vendor tasks.
Post-exploitation and lateral movement · 14% — Plain-English orientation: use this as the topic area to study for Post-exploitation and lateral movement. The official objectives define the exact vendor tasks.
Read CompTIA’s current PenTest+ credential and scope · checked October 10, 2026. The page gives June 17, 2025 for the previous exam’s retirement. Its estimated 2027 retirement for V3 is not a confirmed deadline. Exam topics do not establish a course’s detailed syllabus, and the current detailed objectives PDF was not recovered in this check.
Earlier identity and fee observations
Current study target: CompTIA PenTest+ V3, exam PT0-003. CompTIA lists a December 17, 2024 launch. The page's 2027 retirement estimate is not treated as a confirmed lifecycle date; confirm the current exam before planning around it.
The retained August 23, 2026 en-US single-exam voucher observation was USD 439. The October 10 public product page also lists USD 439, with separate voucher-plus-retake and training products. A dated list amount is not a selected quote, tuition or a tax-inclusive total.
The PT0-003 product, ISBN 978-1-64274-579-5, advertises vulnerability assessment, penetration testing and reporting through lessons, video, guided scenarios, simulated and real-environment labs, assessments, quizzes and platform feedback. These are publisher claims, not proof of your lab rights or instructor-reviewed findings.
The V3 comparison says no prior related job-role experience is needed and estimates 30–60 hours. That estimate is not contact hours or your required effort. The exact product states 12 months of training, redeemable within 12 months of purchase; it does not explicitly identify when the training-access clock starts.
Selected edition, tuition and total, activation, detailed modules and tools, practice permissions, feedback and complete alignment remain unverified. The North American product listing showed USD 709; it is not a selected purchase quote. Practice, Labs, Study, exam vouchers and retake coverage are separate products or bundles unless the selected purchase explicitly includes them.
Inspect instruction, payment and access evidence
Own PT0-003 product description covers vulnerability assessment, penetration testing and reporting through lessons, video, guided scenarios, simulated and real-environment labs, assessments, quizzes and platform feedback. These are publisher claims, not selected lab entitlement or instructor-reviewed findings. PT0-003 and ISBN 978-1-64274-579-5 bind the product. The V3 product comparison advertises 30–60 hours estimated duration, not contact time or personal effort. Product description states 12 months of training, redeemable within 12 months of purchase; it does not explicitly establish the training-access start event. Selected edition, tuition/total, activation, lab rights, feedback and complete alignment need confirmation. The North American product listing showed USD 709 on October 10, 2026; this is not a selected purchase quote or tax-inclusive total. Selected tuition remains unverified. Separate Practice, Labs, Study, exam and retake bundles must not be inferred included.
Publisher V3 comparison describes Perform as suitable without prior related job-role experience. This course-entry statement differs from the exam recommendation of Network+ and Security+ or equivalent knowledge plus 3–4 years in a penetration-tester job role, exam attendance and personal readiness. It does not require purchasing either earlier certification.
CertMaster via CompTIA Central. Publisher states 12 months of training redeemable within 12 months of purchase; exact access-start event and selected activation/lab/feedback rights need confirmation. Selected tuition and total remain unknown; exam registration, a voucher and retake coverage are separate unless explicitly included in the selected purchase.
The linked pages showed the same information when checked on October 10, 2026. That is one observation, not independent confirmation or a guarantee that the offer is still current.
CompTIA PenTest+ PT0-003 V3 credential and exam — Credential lifecycle reference; Official V3 credential body confirms PT0-003/launch December17,2024/max90 multiple-choice and performance-based questions/165minutes/750of100–900/recommended3–4years plus Network+Security+ or equivalent knowledge/English French Japanese Portuguese. Previous exam retirement June17,2025; estimated2027 retirement is not a confirmed deadline. Exam topics are not a detailed course syllabus.
CompTIA CertMaster Perform platform — Practice environment reference; Official outline or learning resource. Read the owning guide for covered tasks, preparation choices and access limits.
Course packages checked October 13, 2026
Compare self-paced and live PenTest+ training
Choose the instruction and feedback you need, then check the exact PT0-003 package. CompTIA’s standalone Learn and Perform courses exclude the exam; its two instructional bundles add a voucher and retake. New Horizons lists a separate voucher add-on. ONLC advertises conditional voucher coverage and has mixed-version wording to resolve before purchase. These packages have different teaching and practical support; listed tuition is not your final total or a confirmed seat.
6 dated options shown. Prices are in USD; check the date and package before using one in a budget.
Self-paced courses
CompTIA
CompTIA PenTest+
$599 per course
PenTest+ CertMaster Learn — PT0-003
Delivery
on demand
Exam
Separate purchase
Buyer
Commercial
Observed
Standalone interactive self-paced course, SKU 810182702230 / ISBN 978-1-64274-582-5. Lessons, videos, simulated activities, assessments and platform feedback advertised. The separate Perform product provides a different practical package; do not assume identical live-VM entitlement. Exam voucher, retake and separate Practice product are not included. North American public USD list display. Provider advertises 12 months of training, redeemable within 12 months of purchase; the selected access-start event, language, lab rights, taxes, refunds and payable total need confirmation.
Standalone self-paced course, SKU 810182702339 / ISBN 978-1-64274-579-5. Lessons, videos, scenarios, simulated and live-environment tasks advertised; personal lab provisioning and instructor-reviewed work are unverified. Exam voucher, retake and separate Practice product are not included. North American public USD list display. Provider advertises 12 months of training, redeemable within 12 months of purchase; the selected access-start event, language, lab rights, taxes, refunds and payable total need confirmation.
Instructional bundle, SKU 810182707129: CertMaster Perform, CertMaster Practice and an exam voucher with Retake Assurance. All included products must be redeemed within 12 months; confirm each activation/access period and voucher/retake eligibility. This is a different package from standalone Learn or Perform. North American public USD list display. Provider advertises 12 months of training, redeemable within 12 months of purchase; the selected access-start event, language, lab rights, taxes, refunds and payable total need confirmation.
PenTest+ Learn and Exam Bundle with Retake — PT0-003
Delivery
on demand
Exam
Voucher listed — check conditions below
Buyer
Commercial
Observed
Instructional bundle, SKU 810182708966: CertMaster Learn plus an exam voucher with Retake Assurance. Does not list Perform or the separate Practice product. All included products must be redeemed within 12 months; confirm voucher/retake eligibility and deadlines. North American public USD list display. Provider advertises 12 months of training, redeemable within 12 months of purchase; the selected access-start event, language, lab rights, taxes, refunds and payable total need confirmation.
Five-day virtual instructor-led course, USD 3,295 tuition; exam voucher is a separate USD 425 add-on, not included. Seller names PT0-003 and lists January 11–15, 2027, 08:00–16:00 with a CST label; confirm actual meeting timezone and seat. Provider course-entry recommendations differ from issuer exam-registration rules. Confirm exact syllabus, practice/labs, instructor feedback, courseware/access, voucher version/expiry, tax and cancellation. The add-on price is the seller package price, not a fresh issuer exam fee.
Five-day live online/in-center course; current page lists USD 3,295 per seat and no public dates scheduled. Practice software and conditional exam voucher/Retake Assurance advertised: 85% practice score and evidence submission are required to release the voucher; exam within one year of course completion. Page says PT0-003 but retains a PT0-002 appendix and Data+ wording in its voucher paragraph; confirm delivered syllabus and PenTest+ voucher entitlement. Old USD 404 voucher-value text is not the current issuer fee. Confirm regional enrollment, instructor/lab feedback, recordings, tax and cancellation.
The requirement names PT0-003 or the target is vendor-neutral authorized testing and useful reporting. Performance-based items do not replace performed work.
Compare CEH when
An employer or program names CEH. Check the separate CEH knowledge, Practical and Master paths and their eligibility and package costs in the linked guide.
Identify foundation gaps when
You need more networking, operating-system, authorization or reporting practice. Equivalent knowledge can come from several routes; an earlier certification purchase is not mandatory.
PenTest+ training: verify PT0-003 and the practice you will actually perform
Provider evidence below was checked September 13, 2026; the named official course above was checked October 10. These are dated research observations, not confirmed seats, quotes or a provider ranking.
Compare PT0-003 practice, reporting and the complete purchase package
PenTest+ V3 is an intermediate offensive-security decision, not an entry-level shortcut. Compare current PT0-003 alignment, learner-performed authorized labs, rules-of-engagement and reporting practice, pace, voucher price, seller, delivery organization and terms.
Official baseline
Exam scope: CompTIA identifies PT0-003 as the current PenTest+ V3 exam. It uses up to 90 multiple-choice and performance-based questions in 165 minutes. The five domains are Engagement Management 13%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Attacks and Exploits 35%, and Post-exploitation and Lateral Movement 14%.
Training scope: CompTIA describes the credential across the full penetration-testing lifecycle, including planning and scope, reconnaissance, vulnerability discovery, attacks, post-exploitation and reporting. Performance-based exam items are not proof of unsupervised real-world capability; course evidence should show safe learner-performed practice, feedback and written findings.
How to use it: CompTIA recommends Network+ and Security+ knowledge plus three to four years in a penetration-testing role or related hands-on work. That is guidance, not an exam-registration gate. If networking, Linux, Windows, web requests, scripting, authorization boundaries and report writing are still new, build foundations before compressing PT0-003 into five days.
Format and pace: Five consecutive virtual instructor-led weekdays; private-group delivery is separate.
Published coverage:
scope and rules of engagement
reconnaissance and vulnerability analysis
network, cloud, wireless, mobile, specialized-system and web attacks
pivoting, reporting and remediation
Hands-on evidence: The page says learners work through a simulated penetration test and receive virtual labs, but it does not publish the exact exercises, lab platform, individual access term, resets or feedback on written findings.
Readiness evidence: The provider names Network+ and Security+ or equivalent knowledge and a minimum three to four years of hands-on security or related experience.
Likely fit: A prepared learner who needs a dated live week and can verify the current voucher price, labs, seller, delivery organization and cancellation terms.
Archived provider calendar examples: These dates were observed when the source was checked; some have passed. They are not upcoming class cards, open seats, or a current quote. Use the training finder for its time-checked references, then verify dates and availability with the provider.
2027-01-11 through 2027-01-15 · USD 3,295 published tuition · Etc/GMT+6. Provider labels this January session Guaranteed to Run; that does not establish an available seat or immutable schedule.
Verify before approval:
resolve the page USD 425 voucher against CompTIA’s current USD 439 voucher price
current authorized courseware and instructor
legal seller, delivery organization, seat and source time-zone interpretation
lab exercises, access period, report feedback, retake and cancellation terms
Course: Provider course XPT003, CompTIA PenTest+ Certification Training
Format and pace: Five-day live-online course; no complete current calendar was visible on the exact outline when checked.
Published coverage:
20 lessons from scope through post-report delivery
simulated penetration test for a fictitious company
practice-exam software
conditional exam voucher and retake assurance
Hands-on evidence: The provider describes hands-on labs and a simulated engagement but does not expose the exact lab list, platform, access period, resets or report-feedback rubric.
Readiness evidence: ONLC expects Security+ or equivalent intermediate security knowledge and practical experience securing computing environments.
Likely fit: Do not shortlist a date until ONLC publishes a complete current calendar and resolves its PT0-003 versus PT0-002 appendix conflict.
Dated schedule: No exact calendar is linked in Learnerside’s retained observations. Ask for every meeting date, time and source time zone.
Verify before approval:
delivered PT0-003 materials because the page appendix still names PT0-002
current voucher value and exam code because the page says USD 404
85% practice-score release, one-year deadline and every retake condition
labs, seller eligibility, delivery identity, seat, final total and cancellation terms
Format and pace: Five-day live instructor-led online or in-person course; displayed dates did not establish a complete selectable calendar.
Published coverage:
PT0-003 preparation
penetration-testing methodology
vulnerability assessment
attack and reporting practice
Hands-on evidence: The public catalog describes the course as intermediate PenTest+ preparation. Confirm the exact exercises, sandbox, access period and feedback before treating it as a practical match.
Readiness evidence: Learning Tree labels the course intermediate. Use CompTIA’s three-to-four-year recommendation and Network+/Security+ knowledge as the safer readiness benchmark.
Likely fit: An employer-sponsored learner who can verify the delivered PT0-003 revision, full calendar, labs, voucher and commercial price.
Dated schedule: No exact calendar is linked in Learnerside’s retained observations. Ask for every meeting date, time and source time zone.
Verify before approval:
calendar year, every meeting time, format and seat
exact PT0-003 courseware and labs
voucher inclusion, delivery, expiration and retake terms
commercial eligibility, seller, instructor, final total and cancellation terms
Evidence boundary: This comparison paraphrases public outlines; it does not republish a provider syllabus, verify a seat, or prove that every listed topic receives equal live instruction. A provider-issued proposal should identify the exact course version, schedule, delivery organization, inclusions and terms.
PenTest+ or CEH?
Choose from the requirement and the evidence you need to build. PenTest+ PT0-003 is a vendor-neutral lifecycle exam with performance-based items and explicit engagement-management, attack, post-exploitation and reporting domains. CEH uses official-training or experience-backed eligibility for its knowledge exam, while CEH Practical is a separate assessment and both are required for CEH Master. Neither course substitutes for authorized lab work or useful findings and remediation reports.
If an employer, contract or DoD 8140/DCWF work-role decision names a credential, verify the exact current requirement. Otherwise compare the exam scope, prerequisite fit, practical work, total package and next credential—not brand recognition claims.
Dated provider voucher amounts disagree
The retained official en-US voucher observation is USD 439, separate from tuition. New Horizons lists a USD 425 add-on, while ONLC describes an included voucher as worth USD 404 and its course appendix still names PT0-002. Require the selected provider to name PT0-003, the delivered courseware, voucher SKU and final package total in writing.
A fictional library authorizes a review of its demonstration booking application during an agreed window. The scope excludes its payment service. A supplied fictional finding suggests that a booking token might reveal another patron’s reservation, but no validation evidence is included. Work on paper only: no account, real records, system access, scanning or spending is required.
Write a scope note naming the authorized asset, exclusions, approval owner, stop conditions and evidence-handling limits.
Describe what evidence would be needed to distinguish a confirmed finding from a hypothesis, using only the fictional material. Do not test a live system.
Draft a finding with impact, uncertainty, remediation owner and a proposed verification step requiring separate authorization.
Changed condition: a redirect points to the excluded payment service. Explain why the reviewer stops, preserves the observation and seeks a scope decision rather than following it.
This original exercise identifies learning and feedback needs. It is not an issuer item, an exam prediction or proof of readiness. Real testing requires explicit authorization and appropriate supervision.
Connect training to defensible work
Authorized testing, vulnerability assessment and security consulting can use these skills. The badge alone does not establish suitability for every security role, permission to test or a salary premium. Occupational pay is not PenTest+ earnings.
Related occupation wage context
Learnerside role association: Penetration Tester.
Occupation wage provenance is not recorded; no pay estimate is shown.
These are occupation wages across credentials and experience levels, not certification-holder pay or a certification salary premium.
Optional: twelve fictional foundation questions
Original practice prompts, options, suggested answers and explanations are retained below. They do not predict a pass or score workplace readiness.
1. A tester finds an out-of-scope system that appears vulnerable while conducting an assessment. What should they do?
Follow the rules of engagement and obtain authorization before testing anything outside scope.
Run a quick non-intrusive scan against it to confirm the weakness before mentioning it to anyone.
Exploit it immediately, since any vulnerable system reachable during a test is fair game.
Note it silently and continue, since out-of-scope observations never belong in the report.
Suggested answer and explanation
Follow the rules of engagement and obtain authorization before testing anything outside scope.
PenTest+ engagement management includes authorization, scope, rules of engagement, and professional conduct.
2. A client needs proof of exploitation risk without unnecessary business disruption. What should the tester plan for?
Evidence collection and reporting that demonstrates impact while respecting scope and safety constraints.
A full-impact demonstration on production, since clients only believe findings that cause visible downtime.
Exploit screenshots alone with no narrative, since raw output is sufficient documentation.
A verbal debrief only, since written exploitation detail is too sensitive to record.
Suggested answer and explanation
Evidence collection and reporting that demonstrates impact while respecting scope and safety constraints.
PenTest+ readiness includes planning evidence, reporting, constraints, and client communication during an engagement.
3. A tester gathers public DNS records and employee naming patterns before touching client systems. What type of activity is this?
Passive reconnaissance used to build target understanding with minimal direct interaction.
Active scanning, since resolving public DNS records sends packets that touch client systems.
Vulnerability exploitation, since employee naming patterns expose credentials directly.
Post-exploitation, since public records only become available after a compromise.
Suggested answer and explanation
Passive reconnaissance used to build target understanding with minimal direct interaction.
PenTest+ reconnaissance includes gathering target information through passive and active techniques within scope.
4. An authorized scan identifies open ports, service banners, and versions on in-scope hosts. What should the tester do with this data?
Use it to prioritize likely attack paths, validate exposure, and guide vulnerability analysis.
Report every open port as a confirmed critical finding, since network exposure equals exploitability.
Discard the banner data, since modern services always spoof their version strings.
Move straight to exploitation of each port without analysis or prioritization.
Suggested answer and explanation
Use it to prioritize likely attack paths, validate exposure, and guide vulnerability analysis.
Enumeration converts discovered services and versions into actionable test planning and vulnerability analysis.
5. A scanner flags a critical CVE on a service, but the service version may be backported by the vendor. What should the tester do?
Validate the finding through version, configuration, vendor context, and safe proof before reporting it as exploitable.
Report it as confirmed critical, since scanner severity scores are authoritative and vendors rarely backport security fixes.
Drop the finding entirely, since backported versions make scanner output unusable.
Rescan repeatedly until the CVE stops appearing, since duplicate results self-validate.
Suggested answer and explanation
Validate the finding through version, configuration, vendor context, and safe proof before reporting it as exploitable.
PenTest+ vulnerability analysis includes validating findings and avoiding unsupported claims.
6. Individually, weak passwords and overly broad file permissions are medium risk, but together they expose sensitive data. What analysis skill is being tested?
Chaining vulnerabilities to understand realistic attack paths and business impact.
Scoring each finding strictly in isolation, since combining risks would inflate the report.
Counting findings by volume, since more findings always means more risk.
Suppressing medium findings, since only criticals shape the attack narrative.
Suggested answer and explanation
Chaining vulnerabilities to understand realistic attack paths and business impact.
PenTest+ candidates should analyze how vulnerabilities interact, not only evaluate isolated findings.
7. A web form appears to concatenate user input into a database query. Which safe testing concept should the candidate understand?
Injection testing within scope, using controlled payloads to validate whether input handling is vulnerable.
Fuzzing the form with destructive payloads in production, since real damage is the only reliable proof of injection.
Testing only with the browser's developer tools, since injection requires client-side access.
Reporting the concatenation pattern as safe, since databases reject unexpected input.
Suggested answer and explanation
Injection testing within scope, using controlled payloads to validate whether input handling is vulnerable.
PenTest+ attacks and exploits include web application attack classes such as injection while staying within authorized scope.
8. A tester discovers that changing an object ID in a request exposes another user's record. What category should they recognize?
Broken access control or authorization weakness that allows unauthorized data access.
A session fixation flaw, since predictable object IDs are session tokens in disguise.
A cryptographic weakness, since sequential IDs mean the hashing algorithm is broken.
An availability issue, since enumerating IDs mainly threatens server load.
Suggested answer and explanation
Broken access control or authorization weakness that allows unauthorized data access.
PenTest+ exploit scenarios include authorization and access-control weaknesses in applications and services.
9. The rules of engagement permit credential testing but require avoiding account lockouts. Which attack technique and control should be considered?
Password spraying with strict rate limits, test accounts, and authorization controls.
Unrestricted brute force per account, since faster testing shortens the exposure window.
Credential stuffing with leaked lists and no throttle, since real attackers ignore lockouts.
Requesting the lockout policy be disabled for the test, since controls skew results.
Suggested answer and explanation
Password spraying with strict rate limits, test accounts, and authorization controls.
PenTest+ attacks and exploits include credential attacks, but engagement constraints and safety controls still apply.
10. A client authorizes a phishing simulation but requires pre-approved templates and no credential collection. What should the tester do?
Follow the approved social engineering scope, payload constraints, and reporting requirements.
Improve the templates mid-campaign without approval, since realistic pretexts change constantly.
Collect a small sample of real passwords anyway, since simulations need proof of capture.
Extend targeting to personal email addresses, since employees blend work and home accounts.
Suggested answer and explanation
Follow the approved social engineering scope, payload constraints, and reporting requirements.
PenTest+ includes social engineering scenarios, but they must remain authorized, scoped, and controlled.
11. After gaining a limited test account on an in-scope host, the tester checks misconfigurations that could raise privileges without causing disruption. What phase is being tested?
Post-exploitation privilege escalation analysis within the authorized rules of engagement.
Initial access, since any activity using a limited account still counts as gaining the foothold.
Passive reconnaissance, since configuration review never touches the target system.
Vulnerability scanning, since privilege checks are automated scanner findings.
Suggested answer and explanation
Post-exploitation privilege escalation analysis within the authorized rules of engagement.
PenTest+ post-exploitation includes safely evaluating privilege escalation paths after access is obtained.
12. A tester proves that one compromised host can reach a sensitive file server using reused credentials. What should be captured?
Evidence of the lateral movement path, business impact, and remediation guidance without unnecessary data exposure.
A complete copy of the file server's sensitive directories, since bulk exfiltration is the strongest possible proof of impact.
Only the reused credential pair, since passwords alone demonstrate the movement path.
A memo written after cleanup with no artifacts, since retained evidence creates liability.
Suggested answer and explanation
Evidence of the lateral movement path, business impact, and remediation guidance without unnecessary data exposure.
Post-exploitation and lateral movement readiness includes demonstrating impact safely and documenting remediation paths.
Choose the support you need
Research, practice questions, the fictional handoff and a private brief are optional. A short request needs your stated need, name, email and affirmative reply permission; schedule, budget, experience and delivery preferences are optional. Reply permission is not provider sharing; later sharing requires separate consent naming the recipient.