I recently took the CompTIA PenTest+ PT0-003 exam, and geez... that really was a difficult test to pass. I actually had to take it twice, and on my second attempt, I barely passed.
This is the first Reddit post I've ever written, but I felt like I needed to make it because I was extremely grateful for all the Reddit posts that helped me while I was studying.
Whenever I'm preparing for a certification, I search Reddit and other sites for people who have taken the exam recently. I want to know what they studied, what resources they used, what they wish they had studied more, and generally what their experience was like.
So, I figured I'd return the favor.
First: This Exam Is VERY Hands-On
If there's one thing I would tell someone preparing for PT0-003, it's this:
Get comfortable looking at scripts and commands.
Don't just memorize definitions.
You should be able to look at a script or command and at least understand what it's trying to accomplish. You should also be able to look at a scenario and determine what type of tool, attack, command, or technique would make sense.
Python and Bash are especially important. I would also be comfortable with PowerShell and the general structure of automation scripts.
You don't necessarily need to become a professional programmer, but you shouldn't panic when the exam puts a block of code in front of you.
Scripts & Programming
Python was something I spent a lot of time trying to understand.
Know the basic structure of a Python script and things like arguments, variables, loops, conditions, functions, and modules. Understand what things such as sys.argv and argparse are doing.
The important thing for me wasn't memorizing every possible piece of syntax. It was getting to the point where I could read a script and say:
"Okay, I may not know every line here, but I understand what this script is trying to accomplish."
I'd approach Bash and PowerShell the same way.
If you're using the CompTIA CertMaster labs, pay attention to the scripts they give you. Don't just copy/paste the commands to finish the lab. Look at the structure and try to understand WHY the commands work.
Know Your Tools
There are a ridiculous number of tools associated with PenTest+, and trying to memorize every command for every tool will probably drive you insane.
Instead, I would focus on understanding what each major tool is for and recognizing common syntax.
Some of the tools I spent time studying included:
- Nmap — scanning, service/version detection, ports, scripts, and recognizing common flags
- Netcat — connections, listeners, shells, and basic network interaction
- Burp Suite — intercepting and modifying web requests and understanding how a proxy fits into web application testing
- Gobuster / DirBuster — directory and content discovery
- Impacket — understand that it's a collection of Python tools/scripts used for interacting with Windows/network protocols and common penetration-testing activities
- Evil-WinRM — interacting with Windows systems through WinRM
- BloodHound — Active Directory relationships and attack paths
- Seatbelt — Windows host enumeration
- Aircrack-ng — wireless assessment
- Wireshark / Snort — traffic analysis and recognizing what network activity is telling you
Again, I wouldn't try to memorize the entire manual for every one of these. Know what problem the tool solves, when you would use it, and what its commands generally look like.
Nmap — Spend Some Time Here
I would absolutely make sure you're comfortable with Nmap.
You should understand the difference between discovering hosts, scanning ports, identifying services/versions, and using scripts.
Don't just memorize a bunch of flags independently. Try to understand what the completed command is asking Nmap to do.
That mindset helped me much more than trying to memorize a giant Nmap cheat sheet.
Active Directory / Windows
I would also spend some time understanding the Windows and Active Directory side of penetration testing.
Things like BloodHound, Seatbelt, Evil-WinRM, Kerberos, Windows services, permissions, and common Windows misconfigurations are worth understanding.
For example, know WHY a misconfigured Windows service could potentially be useful to an attacker rather than just memorizing the name of the vulnerability.
Same thing with Kerberos. You don't need to become an Active Directory wizard overnight, but understand the general concepts behind common Kerberos attacks and what tools such as Impacket are being used to accomplish.
Web Attacks
Definitely know your web vulnerabilities.
Understand concepts like:
- LFI vs. RFI
- SQL injection
- XSS
- Command injection
- Directory traversal
- File inclusion
- Authentication/session attacks
- Web proxies and request manipulation
Burp Suite is worth spending time with here.
Again, think in terms of scenarios. If you're given a vulnerable application and some information about what's happening, can you recognize the likely vulnerability and what you would use to investigate or exploit it?
Wireless Attacks
Don't neglect wireless.
Know the general concepts behind Wi-Fi attacks, Bluetooth attacks, rogue access points, evil twins, deauthentication, credential capture, and the wireless tools listed in the objectives.
WiFi-Pumpkin and Aircrack-ng were two tools I made sure I understood.
You should be able to recognize a wireless attack from a scenario and understand both what is happening and what could be done to mitigate it.
OSINT, DNS & Enumeration
This is another area where I think understanding the PURPOSE of a command is more valuable than blindly memorizing syntax.
Know the different ways information can be gathered before and during a penetration test.
Understand DNS enumeration, subdomains, public information gathering, directory enumeration, service enumeration, and the difference between passive and active reconnaissance.
Ask yourself:
"What information am I trying to obtain, and which tool or technique would give me that information?"
That question helped me organize a lot of the tools in my head.
My Favorite Resource — Hank Hackerson
I have to give a shout-out to Hank Hackerson's YouTube channel.
His PenTest+ material was extremely helpful.
For me, Module 6 was PARAMOUNT, and Module 7 was pretty great as well.
If you have time, I would go through all of his PenTest+ material. I didn't have enough time to watch everything, but after taking the actual exam, I can say that Modules 6 and 7 were definitely on the money in terms of the knowledge I needed.
Jason Dion's Udemy Practice Tests
I also had access to Jason Dion's six PenTest+ practice tests on Udemy, and I thought they were pretty great.
I didn't make it through all six because this was my second attempt and I had a deadline to meet. If I'd had more time, I absolutely would have completed all of them.
One thing I would recommend with ANY practice test:
Don't just memorize the correct answer.
If you get something wrong, figure out:
- Why your answer was wrong.
- Why the correct answer was right.
- What the other answer choices actually mean.
That turns one missed question into four things you've learned.
CertMaster & Labs
The CertMaster material was decent, but personally, it wasn't my favorite resource.
The labs, however, were useful.
Actually typing commands and working through scenarios helped me much more than simply reading about them.
If you have access to the CompTIA labs, I would try to complete as many as possible. More importantly, pay attention to the baseline scripts and commands you're using.
Don't just:
Copy → Paste → Lab Complete → Next
Stop and ask yourself what the command actually did.
That tactile/hands-on learning made a difference for me.
How I Would Study If I Had to Do It Again
If I were starting over, I would probably structure my studying something like this:
1. Learn the concepts first.
Go through the course material and make sure you understand the major attacks, penetration-testing methodology, vulnerabilities, and terminology.
2. Learn what the major tools actually do.
Instead of immediately memorizing syntax, learn which problem each tool solves.
3. Get hands-on.
Do the labs. Type the commands yourself. Break things. Get commands wrong. Figure out why they didn't work.
4. Learn to read scripts.
Practice Python, Bash, and PowerShell enough that code doesn't look like hieroglyphics when it's put in front of you.
5. Practice recognizing commands.
Nmap, Netcat, Aircrack-ng, Impacket, and the other major tools should start looking familiar.
6. Take practice exams.
Then study EVERY answer you got wrong.
7. Go back to your weak areas.
Don't spend five hours reviewing something you already know because it feels good to get the questions right. Spend that time on the stuff you hate seeing on a practice test.
There Really Isn't a Shortcut
Usually, I'm the guy trying to figure out the fastest and most efficient way to get through something.
For PenTest+, I really don't think there's a way around putting in the work.
Study. Do the labs. Take a practice test. Fail. Figure out why. Study again. Take another one. Repeat.
It can be a headache.
This was easily the hardest certification exam I've taken so far.
For context, I have certifications including A+, Network+, Security+, CySA+, Project+, SSCP, Cloud+, and a few others, and I am a HORRIBLE test taker. I've barely passed more certification exams than I'd like to admit 😂.
So take everything I'm saying with a grain of salt. I'm definitely not claiming to be some PenTest+ guru.
I'm just a guy who failed it, studied some more, went back, and managed to pass it.
Final Advice
If you're preparing for PT0-003, these would be my biggest takeaways:
Know your attacks.
Know your tools.
Get comfortable with Nmap.
Get comfortable reading scripts and commands.
Understand Python, Bash, and PowerShell at a basic level.
Understand what tools like Impacket, Burp Suite, BloodHound, Netcat, Aircrack-ng, etc. are actually used for.
Do hands-on labs.
Don't ignore wireless, Active Directory, web attacks, OSINT, or enumeration.
And most importantly, don't get discouraged if you fail.
I failed my first attempt. I barely passed my second.
A pass is a pass.
If you're a terrible test taker like me, don't let your practice scores or even a failed first attempt convince you that you can't do it. Figure out where you're weak, hammer those areas, and go back at it.
Hank Hackerson was legit. Jason Dion's practice tests were on point. The CertMaster labs were useful for getting hands-on experience.
And Reddit helped me tremendously, which is why I'm writing this ridiculously long first post in the first place.
Hopefully this helps at least one person preparing for PenTest+ PT0-003.
Good luck. You got this. 🤙