Study guide
1.3 Recertification, CEUs, and Career Fit
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
1.3 Recertification, CEUs, and Career Fit
Key Takeaways Explain This Topic AI
PenTest+ certification is valid for three years from the award date.
PenTest+ V3 requires 60 Continuing Education Units if you renew by uploading CEUs.
The total Continuing Education fee is $150 for the three-year period when you renew by uploading CEUs.
You do not pay CE fees if you renew by passing the latest exam, earning a higher-level CompTIA certification that fully renews PenTest+, or completing CertMaster CE.
CompTIA associates PenTest+ with penetration tester, vulnerability analyst, and security consultant work; it is a vendor-neutral intermediate credential that includes performance-based questions.
Last updated: August 2026
1.3 Recertification, CEUs, and Career Fit
Quick Answer: A PenTest+ certification is valid for three years . PenTest+ V3 requires 60 CEUs if you renew by uploading continuing education. The Continuing Education (CE) fee for that path is $150 for the three-year period. You do not pay CE fees if you pass the latest exam, earn a higher-level CompTIA certification that fully renews PenTest+ , or complete CertMaster CE . CompTIA associates the credential with penetration tester , vulnerability analyst , and security consultant work.
Passing PT0-003 is not a lifetime stamp. CompTIA certifications expire, and PenTest+ is built for a field where tools, cloud platforms, and web stacks move faster than a static score report. Recertification is part of the same professional story as Domain 1 reporting: you keep the credential current, or it lapses.
The Three-Year Cycle
PenTest+ is valid for three years . The clock starts from CompTIA's certification award date, not from the day you began studying. CompTIA sends reminder email as expiration approaches; you can also check the date in your CompTIA account. Do not wait until the last week. Uploading Continuing Education Units (CEUs) , paying CE fees when they apply, and waiting for review all take calendar time.
If the certification lapses, you no longer hold a current PenTest+. Re-earning it then means using a live exam series and current CompTIA rules—not assuming the PT0-003 sitting you already passed can be replayed. After you have passed an exam and achieved certification, CompTIA's retake policy says you cannot take the same exam code again without prior consent. Plan renewal before expiration rather than trying to sit PT0-003 a second time as a shortcut.
60 CEUs and the $150 CE Fee
CompTIA's PenTest+ V3 renewal documentation states that 60 CEUs are required for certification renewal when you use the multiple-activity / CEU-upload path. That 60-CEU figure is specific to PenTest+ V3 . Do not import a different CompTIA certification's CEU total and assume it applies.
If you renew by uploading CEUs , CompTIA's continuing education renewal-fees page lists CompTIA PenTest+ ce at a total CE fee of $150 for the three-year period . You are not required to pay CE fees annually on a calendar-year schedule. Fees are due if you are renewing by uploading CEUs, and they must be paid by the certification expiration date.
CE tokens are how many candidates pay that fee:
- Token fact CompTIA rule
- Denominations $25 and $50 per token
- Expiration Tokens do not expire
- Refunds Tokens are non-refundable once uploaded
- PenTest+ CE fee if renewing by CEUs $150 for the three-year period
Buy tokens with the upload path in mind. Because they do not expire until uploaded, unused tokens can sit in reserve—but once uploaded they are not refundable. If you later choose a no-fee renewal path, you cannot treat uploaded tokens as a voucher for something else.
CompTIA also publishes tables of other industry certifications and training that can award CEUs toward PenTest+ V3. Those tables change as exams update. Use CompTIA's current PenTest+ V3 CEU list rather than an old screenshot. This study guide does not host third-party certification pages for bodies outside ExamFinch's catalog; look up CEU credit on CompTIA's renewal site.
Renewal Paths That Do Not Require CE Fees
CompTIA's renewal-fees page states you do not need to pay CE fees if you choose one of these options:
Pass the latest release of your CompTIA exam. For PenTest+, that means passing the live series—currently PT0-003—when it is a valid renewal activity for your cycle. Remember the retake-consent rule if you already passed this same code to get certified; passing "the latest release" is a renewal path CompTIA documents, not a casual second attempt on a code you just passed last month.
Earn a higher-level CompTIA certification that fully renews PenTest+. CompTIA's stack can renew lower credentials when the higher certification is mapped to do so. CE fees are not waived if the higher-level certification does not fully renew the lower one. Confirm the current renewal map on CompTIA's CE site instead of assuming every CompTIA exam above PenTest+ automatically resets it.
Complete CompTIA CertMaster CE for the certification, when CompTIA offers that product as a single-activity renewal.
If you hold multiple CompTIA certifications, CompTIA's rule is that you pay CE fees for your highest-level CompTIA certification when you renew by CEUs, and renewing a higher certification can automatically renew lower ones when that higher certification fully renews them . Again: if it does not fully renew, the fee is not waived. Check the mapping, then pay once for the correct tier.
Career Roles CompTIA Associates With PenTest+
CompTIA describes PenTest+ as validating the ability to identify, mitigate, and report system vulnerabilities across stages of penetration testing, including cloud, web applications, APIs, and Internet of Things (IoT), with emphasis on vulnerability management and lateral movement. The product page frames the credential as expertise to advance as a penetration tester or security consultant . In this guide we also treat vulnerability analyst as a CompTIA-associated fit because Version 3 spends 17% on discovery and analysis and 21% on recon—work many analysts do even when their title is not "pentester."
Typical day-job overlap:
Penetration tester / ethical hacker: scoping, recon, exploitation, post-exploitation, and reporting inside an authorization letter.
Vulnerability analyst: scanning, validation, false-positive handling, and prioritized remediation—without always chaining a full exploit.
Security consultant: translating findings into stakeholder language, risk, and fixes, which is why Domain 1 still exists at 13%.
CompTIA's February 10, 2025 PenTest+ V3 blog states that PenTest+ V3 continues to be approved for the same U.S. Department of Defense (DoD) Directive 8140.03M work roles as Version 2. CompTIA does not ask you to memorize a homemade list of work-role codes for this exam. If you need DoD qualification mapping, use CompTIA's current framework-alignment publications and your component's authorized list—not an unofficial blog table.
Vendor-Neutral Intermediate With PBQs
PenTest+ is vendor-neutral . It is not a Cisco, Microsoft, or cloud-provider product exam. That is a feature for consultants who test mixed environments and a limitation if an employer wants a platform badge. It is also intermediate . CompTIA's recommended 3-4 years in a penetration tester role is the signal: this is not CompTIA's first security exam.
The other design choice is PBQs plus multiple-choice , not multiple-choice alone. Many security certifications test what you can recognize in a paragraph. PT0-003 also tests what you can do in a simulated task. That is why candidates who only read books get surprised, and why hands-on lab practice is essential . Build or use labs for scanning, enumeration, web attacks, cloud IAM mistakes, and post-exploitation notes until those workflows are boring. Then use /practice/pentest-plus to connect the workflow to exam-style decisions.
Next-Step Certifications Are Options, Not Requirements
CompTIA does not require a locked ladder after PenTest+. Common neighboring credentials, as career options:
Credential How it usually relates
CompTIA Security+ Foundation many PenTest+ candidates already have; recommended equivalent knowledge, not a mandatory pre-test
CompTIA Network+ Recommended equivalent knowledge for protocol and infrastructure fluency
CompTIA CySA+ Defensive analytics and detection path that pairs with offensive testing; a higher CompTIA cybersecurity credential for some stacks
EC-Council Certified Ethical Hacker (CEH) Another offensive certification often listed in job postings; different body, different blueprint
ISC2 Certified Information Systems Security Professional (CISSP) Broader security architecture and governance for people moving from testing into leadership
Do not collect logos instead of lab hours. A second certification does not replace PT0-003 PBQ skills. If your goal is a testing seat, PenTest+ plus documented engagements and labs usually beats a stack of unread badges. If your goal is a DoD or consulting posting that lists several certs, map the job description to CompTIA's current documents and then choose CySA+, CEH, or CISSP as a next project.
How To Use This Guide From Here
You now have the live facts (PT0-003, 165 minutes, maximum 90, 750/900, five domain weights), the session rules (MCQ plus PBQ, scaled scoring, OnVUE versus center, retake clock), and the three-year CE story (60 CEUs, $150 CE fee when uploading, other no-fee paths). The rest of the PenTest+ study guide follows the blueprint in that order: engagement management first so you do not test out of scope, then recon, discovery, attacks, and post-exploitation. Keep Attacks and Exploits and Reconnaissance at the center of the calendar, and keep a lab open while you read. PenTest+ V3 is an applied exam. Study it that way.