CompTIA PenTest+ Practice Test
Prepare for the CompTIA PenTest+ (PT0-003) exam with free practice tests aligned to the real exam format. Each test has 20 questions with a proportional timer matching the actual exam pace of approximately 1.8 minutes per question.
Mixed Set — CompTIA PenTest+ Practice Tests
Questions distributed across all 5 domains according to the official CompTIA PT0-003 exam objectives. The highest-weighted domain — Attacks and Exploits — appears most frequently, just like the real exam.
Domain Wise — CompTIA PenTest+ Mock Tests
Target individual PenTest+ domains with focused practice. Each mock test covers 20 questions from a single domain to help you build hands-on mastery across the full penetration testing lifecycle tested in the PT0-003 exam.
About the CompTIA PenTest+ Certification Exam
Everything you need to know about the PT0-003 exam format, who it is for, and why PenTest+ is the leading intermediate credential for penetration testers and offensive security professionals.
What Is CompTIA PenTest+?
CompTIA PenTest+ (exam code PT0-003) is an intermediate-level cybersecurity certification that validates the knowledge and skills required to plan, scope, conduct, and report on penetration testing engagements across networks, systems, web applications, cloud environments, and APIs. The current version — PT0-003 — launched on December 17, 2024, replacing the previous PT0-002 which retired on June 17, 2025. PT0-003 updates coverage to include AI-based attack techniques, expanded cloud and API exploitation, IoT security, and modern post-exploitation methods, making it the most current vendor-neutral penetration testing certification available from CompTIA.
PenTest+ sits at the intermediate tier of CompTIA's cybersecurity pathway, positioned after Security+ and alongside CySA+ as its offensive counterpart. It is the red team credential to CySA+'s blue team focus. PenTest+ is approved under U.S. DoD Directive 8140 (formerly 8570) and aligned with the NICE Framework, making it valued across both government and commercial sectors. Typical roles for PenTest+ holders include Penetration Tester, Ethical Hacker, Vulnerability Analyst, Security Consultant, and Red Team Operator, with salaries commonly ranging from $85,000 to $130,000+ depending on experience and location.
Exam Format (2026)
Exam code: PT0-003 (launched December 17, 2024; PT0-002 retired June 17, 2025).
Testing method: Computer-based at Pearson VUE authorized centers or via OnVUE online proctoring.
Questions: Maximum of 90 questions per exam.
Duration: 165 minutes (approximately 1.8 minutes per question).
Question types: Multiple-choice and performance-based questions (PBQs) simulating real penetration testing tasks.
Passing score: 750 on a scaled score of 100–900.
Exam fee: $404–$425 USD via Pearson VUE (regional pricing variation).
Eligibility Requirements
No formal prerequisites: There are no mandatory prerequisites to register for the PenTest+ exam.
Recommended experience: CompTIA recommends 3 to 4 years of hands-on experience in a penetration tester or information security role before attempting the exam.
Suggested foundation: CompTIA Security+ or equivalent knowledge is widely recommended as a starting point before pursuing PenTest+. Candidates should be comfortable with networking fundamentals, basic security concepts, and command-line interfaces.
Renewal: PenTest+ is valid for 3 years. Renew by earning 60 Continuing Education Units (CEUs), with activities related to the exam objectives. Passing a higher-level CompTIA certification can also satisfy the renewal requirement.
Retakes: No mandatory waiting period between attempts. Each retake requires full payment of the exam fee.
CompTIA PenTest+ Domain Weights — PT0-003 Exam Objectives
The PT0-003 exam maps directly to the penetration testing engagement lifecycle across five domains. Domain 4 (Attacks and Exploits) dominates at 35% — more than a third of the entire exam — making it the single most critical area of preparation.
| Domain | Topic | Weight |
|---|---|---|
| Domain 1 | Engagement Management | 13% |
| Domain 2 | Reconnaissance and Enumeration | 21% |
| Domain 3 | Vulnerability Discovery and Analysis | 17% |
| Domain 4 | Attacks and Exploits | 35% |
| Domain 5 | Post-exploitation and Lateral Movement | 14% |
How Our Practice Tests Are Designed
Offensive security question style — Every PenTest+ practice question is written to reflect the scenario-based, applied style used on the real PT0-003 exam. You encounter situations that test your ability to choose the right tool for a given recon phase, identify the correct exploit type for a described vulnerability, interpret tool output from Nmap or Metasploit, or determine the next step in a post-exploitation scenario — the kind of decision-making CompTIA tests throughout the engagement lifecycle.
Blueprint-aligned mixed sets — Mixed practice tests distribute questions proportionally across all 5 PT0-003 domains per the official CompTIA exam objectives. Domain 4 (Attacks and Exploits) at 35% dominates — more than one in three questions in every mixed set reflects the real exam's heavy emphasis on exploitation techniques, consistent with the actual exam distribution.
Proportional timer — The real PenTest+ exam allows 165 minutes for up to 90 questions, approximately 1.8 minutes per question. Each 20-question practice test is timed at about 37 minutes to match this pace and build the time management discipline needed for the full exam session, particularly given the presence of performance-based questions that can consume more time than standard multiple-choice items.
Domain-specific deep dives — Use the five domain-wise tests to concentrate on areas needing the most reinforcement. This approach is particularly effective for candidates who are strong in recon and scanning (Domains 2 and 3) but need additional depth in exploitation techniques and post-exploitation tactics (Domains 4 and 5), which together represent nearly half the exam.
CompTIA PenTest+ Exam Preparation Tips
Study Strategy
Prioritize Domain 4 — it is one-third of the exam: Attacks and Exploits at 35% is the single largest domain on PenTest+. Dedicate at minimum a third of your total study time to mastering network attacks, web application exploitation (OWASP Top 10), wireless attack techniques, cloud and API exploitation, social engineering methods, and the new AI-based attack scenarios added in PT0-003.
Build a hands-on lab: PenTest+ performance-based questions require practical skill — not just theoretical knowledge. Set up a home lab using Kali Linux in a virtualization environment (VMware or VirtualBox) against intentionally vulnerable targets. Platforms like TryHackMe's Offensive Pentesting path and HackTheBox closely align with PenTest+ curriculum. Practice running Nmap, Metasploit, Burp Suite, and Netcat regularly so tool output is instantly recognizable on exam day.
Learn to read and interpret scripts: PT0-003 includes questions where you analyze blocks of Bash, Python, or PowerShell code and determine what they do. You do not need to write code from scratch, but you must understand what common penetration testing scripts accomplish — particularly automation of scanning, exploitation, and exfiltration tasks.
Test-Taking Strategy
Triage performance-based questions at the start: PBQs typically appear at the beginning of the exam and simulate real tasks in virtual environments. Quickly assess each PBQ's objective, apply the correct approach efficiently, and move on. Do not spend more than a few minutes on a single PBQ — you can always flag complex ones and return after completing the multiple-choice questions.
Pace yourself at 1.8 minutes per question: With up to 90 questions in 165 minutes, you have roughly 110 seconds per item. Use our 37-minute timed practice sessions to internalize this pace. Candidates who invest too much time in early PBQs often find themselves rushing through the exploitation and post-exploitation questions where they know the material well.
Follow the pen testing methodology in scenario questions: When a scenario asks "what should the tester do next?" or "what is the most appropriate action?" — always answer based on the correct phase sequence: scoping → recon → scanning → exploitation → post-exploitation → reporting. CompTIA consistently rewards answers that follow proper methodology, even when shortcuts seem more technically appealing.
Frequently Asked Questions
Ready to Test Your PenTest+ Knowledge?
Start with a mixed set to benchmark your readiness across all five domains, then use domain-wise tests to sharpen your weakest areas before exam day.
Start PenTest+ Practice Test 1 →
