PenTest+ PT0-003 — CompTIA PenTest+ Preparation Training

About this course map

Five domains, mapped one-for-one to the CompTIA PenTest+ PT0-003 exam objectives and taught in the same order, so nothing on the exam is left uncovered.

PT0-003 is the current version of PenTest+. What separates it from its predecessor is structural: engagement management is now its own domain rather than scaffolding around the technical work, reconnaissance and vulnerability analysis have been pulled apart into separate domains, and post-exploitation and lateral movement stand alone at the end. The attack surface has moved with it — cloud and container exploitation and attacks against AI systems now sit inside the objectives rather than outside them.

Each domain below carries its published weighting, and we give it classroom time in proportion. Better than half the course is hands-on, run against a target estate we have built to be broken, so you are finding genuine weaknesses rather than walking a script to a known answer.

Domain 01 — Engagement Management

The part that separates a penetration test from an unauthorised intrusion. 13% of the exam.

Domain 02 — Reconnaissance and Enumeration

Building a complete picture of the target before you touch anything that matters. 21% of the exam.

Domain 03 — Vulnerability Discovery and Analysis

Turning an attack surface into a prioritised list of things that will actually work. 17% of the exam.

Domain 04 — Attacks and Exploits

The largest domain, and the one where everything before it is put to use. 35% of the exam.

Domain 05 — Post-exploitation and Lateral Movement

What you do once you are in, and how you leave the estate as you found it. 14% of the exam.

Who should take this

Penetration testers, red team operators, security consultants, vulnerability analysts, and application or cloud security engineers who need to test their own systems credibly. It also suits experienced defenders who want to understand offensive work well enough to judge a report rather than take it on trust.

CompTIA recommends Network+ and Security+ or equivalent knowledge, along with three to four years of hands-on experience in a penetration testing role. These are recommendations, not requirements — nothing prevents you from sitting the exam without them, and we regularly teach strong candidates earlier in their careers.

You will need working knowledge of networking, Windows and Linux, and to be genuinely comfortable at a command line. Some scripting ability is a real advantage, because the scripting objectives are examined rather than assumed.

The exam

PenTest+ is set and awarded by CompTIA.

CompTIA does not publish how much of the paper is performance-based, so plan to meet those questions anywhere in it. The exam voucher is purchased separately from CompTIA; we arrange it on your behalf and send you the code, and you book your own exam date.

How we deliver it

Five days, classroom or online live, or at your office for a private group. The majority of the time is hands-on in our lab estate, and the course ends with a scoped engagement run end to end — reconnaissance through to a written report that is marked as a report, not as a list of findings. Domain checkpoints each day, and a full-length mock under exam conditions on the final afternoon.

Mapped to the CompTIA PenTest+ PT0-003 exam objectives. Taught from Hacky Security's own curriculum and lab estate by instructors who test client estates for a living.