PT0-003 — CompTIA PenTest+ V3 Exam Blueprint

How to Use This Exam Blueprint

Use this page as an independent readiness map for the CompTIA PenTest+ V3 (PT0-003) exam. It is not a replacement for the official CompTIA objectives, but it helps translate the public exam scope into practical review tasks.

Work through each section and mark whether you can:

• Explain the concept without notes.
• Choose the right tool or technique for a scenario.
• Interpret common command output, logs, findings, and scan results.
• Identify risk, impact, and remediation.
• Communicate findings professionally in a penetration test report.
• Recognize what is allowed, out of scope, unsafe, or legally inappropriate.

For all hands-on review, use only authorized labs, ranges, intentionally vulnerable systems, or environments where you have explicit permission.

Topic-Area Readiness Table

Planning, Scope, and Rules of Engagement

Checklist

• I can explain the purpose of a statement of work, rules of engagement, authorization letter, and scope statement.
• I can distinguish in-scope targets from out-of-scope systems, users, locations, time windows, and techniques.
• I know why written permission matters before testing begins.
• I can identify escalation triggers such as production instability, sensitive data discovery, safety concerns, or scope ambiguity.
• I can explain the difference between black-box, gray-box, and white-box testing approaches.
• I can identify when a test should pause because the activity could cause harm.
• I can describe communication expectations during testing, including status updates and emergency contacts.
• I understand how cleanup, evidence retention, and data handling should be addressed before the test starts.

Scenario cues

Reconnaissance and Information Gathering

Passive reconnaissance

Be ready to use and interpret information from:

• Search engines and advanced search operators.
• Public code repositories.
• DNS records and subdomain data.
• Certificate transparency sources.
• Public breach references and credential exposure indicators.
• Job postings and technology clues.
• Metadata from documents and images.
• Social media and organizational charts.
• Public cloud storage exposure indicators.

Active reconnaissance

• I can explain the difference between passive and active reconnaissance.
• I can identify when active recon may be detected by the target.
• I can select basic discovery methods for hosts, ports, and services.
• I can explain why rate limiting, scan timing, and target exclusions matter.
• I can identify risks of scanning fragile systems, industrial systems, or medical environments.

Common recon artifacts

Scanning, Enumeration, and Vulnerability Discovery

Network scanning readiness

• I can explain host discovery versus port scanning.
• I can distinguish TCP connect scans from SYN scan concepts.
• I can interpret open, closed, and filtered port states at a high level.
• I can explain why UDP scanning is slower and less definitive.
• I can identify common services by port and banner, while remembering ports can be nonstandard.
• I can explain service and version detection.
• I can identify when OS fingerprinting may be unreliable.
• I can explain the difference between a vulnerability scan and a penetration test.

Command recognition checks

You should recognize the purpose of commands like these in an authorized lab context:

nmap -sV -sC -oA scan-results target.example

curl -I https://target.example

dig example.com MX
dig example.com TXT

Vulnerability scanner interpretation

Vulnerability Analysis and Prioritization

Can you do this?

• Given a scan result, I can identify likely false positives and what validation is needed.
• Given multiple findings, I can prioritize based on exposure, impact, exploitability, and asset value.
• I can explain the difference between vulnerability presence and confirmed exploitability.
• I can separate technical severity from business risk.
• I can recommend practical remediation, not just “patch everything.”
• I can identify when compensating controls reduce risk.
• I can explain why internet-facing findings usually require faster attention than internal-only findings, all else equal.
• I can document evidence without exposing unnecessary sensitive data.

Risk reasoning table

Web Application and API Testing

Core web vulnerabilities

HTTP request and response interpretation

Be ready to examine:

• Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS.
• Status codes: success, redirect, client error, server error patterns.
• Cookies: HttpOnly, Secure, SameSite, expiration.
• Authorization headers and bearer token concepts.
• JSON request bodies and parameter tampering.
• Redirect parameters and open redirect risk.
• Error messages that reveal stack traces, paths, SQL errors, or secrets.
• CORS headers and cross-origin trust issues.

Web testing decision prompts

Network, Infrastructure, and Service Exploitation Concepts

Infrastructure topics to review

• Common TCP and UDP services and their security implications.
• Misconfigured SMB, NFS, FTP, SSH, RDP, SNMP, LDAP, and database services.
• Weak or default credentials.
• Anonymous or guest access.
• Unnecessary exposed services.
• Outdated services with known vulnerabilities.
• Insecure protocols and lack of encryption.
• Network segmentation and pivoting concepts.
• Firewall and ACL impact on testing.
• VPN and remote access exposure.
• Service account misuse.
• Password spraying versus brute-force concepts.
• Credential stuffing versus password guessing.
• Privilege escalation conditions.

Service clue table

Identity, Password, and Directory Testing

Password attack concepts

• I can distinguish brute force, password spraying, credential stuffing, and dictionary attacks.
• I understand why account lockout policies affect testing strategy.
• I can explain the risk of reused passwords.
• I can identify where password hashes may be encountered during authorized testing.
• I can explain salting, hashing, and cracking concepts at a high level.
• I can describe why offline cracking risk depends on hash type, password quality, and available compute.
• I can recommend MFA, password managers, lockout controls, monitoring, and credential hygiene.

Active Directory and enterprise identity

Can you explain the difference?

Cloud, Container, and Modern Infrastructure Testing

Cloud readiness checklist

• I can explain why cloud penetration testing must follow the provider and customer authorization model.
• I can identify common IAM misconfigurations such as excessive permissions and weak role separation.
• I can recognize public object storage exposure.
• I can explain why exposed access keys, tokens, and secrets are high risk.
• I can identify metadata service risks conceptually.
• I can recognize insecure security groups, firewall rules, or network ACLs.
• I can explain logging and monitoring gaps in cloud environments.
• I can recommend least privilege, key rotation, encryption, private access, and monitoring.
• I can distinguish customer-managed configuration issues from provider-managed infrastructure.

Container and orchestration topics

Cloud scenario cues

Wireless, Mobile, IoT, and OT Awareness

Wireless topics

• I can identify risks of weak Wi-Fi encryption and poor passphrases.
• I can explain rogue access point and evil twin concepts.
• I can identify the role of guest networks and segmentation.
• I can explain why wireless testing requires careful location and scope control.
• I can distinguish discovery, capture, authentication, and encryption concepts.

Mobile, IoT, and OT topics

Social Engineering and Physical Testing

Checklist

• I can explain why social engineering must be explicitly authorized.
• I can distinguish phishing, spear phishing, vishing, smishing, pretexting, and baiting.
• I can identify safe handling of captured credentials or sensitive responses.
• I can explain why physical testing needs location, time, and safety constraints.
• I can identify when a test creates unacceptable legal, privacy, or safety risk.
• I can recommend training, reporting channels, MFA, verification procedures, and physical controls.

Scenario cues

Post-Exploitation, Evidence, and Cleanup

Post-exploitation concepts to understand

• Privilege escalation.
• Lateral movement.
• Credential discovery.
• Data discovery.
• Persistence concepts.
• Pivoting concepts.
• Tunneling and proxying concepts.
• Exfiltration simulation.
• Cleanup and restoration.
• Evidence collection.
• Deconfliction with defenders.

Keep the exam distinction clear

Scripting, Automation, and Data Handling

Skills to be comfortable with

• Reading simple Bash, Python, and PowerShell snippets.
• Understanding loops, conditionals, variables, functions, and command output.
• Parsing text, JSON, and CSV output.
• Using regular expressions for matching IP addresses, domains, emails, or tokens.
• Automating repetitive checks in an authorized lab.
• Avoiding scripts that modify systems unless explicitly approved.
• Handling secrets and sensitive files safely.

Mini script recognition

import json

with open("scan.json") as f:
    data = json.load(f)

for host in data.get("hosts", []):
    for port in host.get("ports", []):
        if port.get("state") == "open":
            print(host["ip"], port["port"], port.get("service", "unknown"))

You should be able to identify that this script:

• Reads JSON-formatted scan data.
• Iterates through hosts and ports.
• Prints open services.
• Does not exploit or modify a target.
• Could support reporting or triage.

Regex readiness

Tool Selection Checklist

You do not need to memorize every flag of every tool, but you should know what tool fits the scenario and what output means.

Reporting and Communication

Finding structure checklist

A strong technical finding should include:

• Title that clearly names the issue.
• Affected asset or application area.
• Severity or risk rating with rationale.
• Business impact.
• Technical description.
• Evidence, such as request/response snippets, screenshots, command output, or logs.
• Reproduction steps that are safe and concise.
• Scope and assumptions.
• Remediation guidance.
• References when useful.
• Retest recommendation.
• Limitations or conditions that affect confidence.

Executive versus technical communication

Remediation mapping

Legal, Ethical, and Professional Judgment

Must-know boundaries

• Authorization must be explicit and documented.
• Scope limits testing activities.
• Sensitive data should be minimized, protected, and reported appropriately.
• Testing should avoid unnecessary disruption.
• Findings should be accurate, reproducible, and defensible.
• Client confidentiality applies to tools, data, screenshots, and reports.
• Public disclosure is not appropriate unless coordinated and authorized.
• Third-party systems require separate authorization.
• Safety-critical systems require heightened caution.

Judgment checks

Common Weak Areas and Exam Traps

“Can You Do This?” Final Skills Checklist

Planning and scope

• Identify whether an action is authorized.
• Choose a test type based on client goals and knowledge level.
• Recognize when to stop, pause, or escalate.
• Explain how scope affects tools and techniques.

Recon and enumeration

• Build a basic target profile from OSINT.
• Distinguish passive from active collection.
• Interpret DNS, HTTP header, and certificate clues.
• Select a scan approach for host, port, and service discovery.
• Explain scanner noise, false positives, and validation.

Exploitation and validation

• Map common findings to likely attack paths.
• Identify safe proof for a vulnerability.
• Explain privilege escalation and lateral movement concepts.
• Recognize identity, web, API, cloud, and network weaknesses.
• Avoid destructive or out-of-scope actions.

Reporting and remediation

• Write a finding with risk, evidence, impact, and remediation.
• Prioritize multiple findings.
• Communicate differently to executives and engineers.
• Recommend practical controls for common vulnerability classes.
• Explain retesting and remediation validation.

Tools and artifacts

• Recognize common command-line tools and their purpose.
• Interpret basic network, web, and scan output.
• Read simple scripts used for parsing or automation.
• Identify logs, screenshots, requests, and responses that support evidence.
• Protect sensitive artifacts.

Scenario Decision Matrix

Final-Week Review Checklist

Seven to five days before exam

• Re-read the official CompTIA exam objectives for CompTIA PenTest+ V3 (PT0-003).
• Identify your weakest three topic areas from practice results.
• Review scope, authorization, and rules-of-engagement scenarios.
• Drill web/API vulnerability identification.
• Review identity and password attack terminology.
• Practice interpreting scan outputs and HTTP evidence.
• Write at least a few sample findings from lab results.

Four to two days before exam

• Review cloud, container, and modern infrastructure misconfiguration patterns.
• Review tool-purpose matching.
• Review common ports, services, and vulnerability clues.
• Review remediation mapping for common findings.
• Practice prioritizing findings with business context.
• Revisit scripting basics and output parsing.
• Review ethical, legal, and data handling boundaries.

Day before exam

• Do a light review of notes, not a full content cram.
• Recheck confusing terms: spraying, stuffing, brute force, cracking, exploitation, validation.
• Review your most common practice-test mistakes.
• Skim report structure and remediation examples.
• Rest and avoid late-night tool rabbit holes.

Exam-day mindset

• Read every scenario for scope, authorization, and business context.
• Do not choose the most aggressive technical answer if a safer authorized step is required.
• Prefer validation over blind trust in tool output.
• Match remediation to root cause.
• Watch for wording that changes the best answer: public-facing, production, out of scope, unauthenticated, critical asset, sensitive data.
• Eliminate answers that violate permission, safety, confidentiality, or scope.

Practical Next Step

Use this checklist to mark weak areas, then move into targeted practice. For each missed practice question, write down the topic, the decision point, and the safer or more professional action the scenario was testing. That habit builds the judgment needed for CompTIA PenTest+ V3 (PT0-003), not just memorization.