CompTIA PenTest+ Independent Study

CompTIA PenTest+ proves you have the skills to find, reduce, and report security weaknesses in computer systems.

This certification covers every stage of penetration testing. You will learn how to test systems in the cloud, web apps, APIs, and IoT devices. It focuses on hands-on skills like managing vulnerabilities and moving through systems to find hidden risks.

PenTest+ helps you build the skills you need to grow your career as a penetration tester or security consultant.

Engagement Management (13%)

• Planning and scoping: Set the rules for the test, choose targets, and decide when testing will happen.
• Legal and ethical compliance: Make sure you have written permission and follow all laws and rules.
• Collaboration and communication: Work with team members and leaders, review findings, and clearly explain risks.
• Penetration test reports: Write reports with a summary for leaders, detailed findings, and steps to fix problems.

Reconnaissance and Enumeration (21%)

• Active and passive reconnaissance: Gather information using public sources (OSINT), network traffic tools, and scans.
• Enumeration techniques: Collect details about DNS, services, and directories.
• Reconnaissance tools: Use tools like Nmap, Wireshark, and Shodan to gather information.
• Script modification: Edit Python, PowerShell, and Bash scripts to support testing.

Vulnerability Discovery and Analysis (17%)

• Vulnerability scans: Run scans with and without login access. Use tools for testing application security (SAST and DAST).
• Result analysis: Review scan results, confirm real issues, and remove false alarms.
• Discovery tools: Use tools like Nessus, Nikto, and OpenVAS to find security weaknesses.

Attacks and Exploits (35%)

• Network attacks: Test methods like VLAN hopping, on-path attacks, and service exploits.
• Authentication attacks: Perform brute-force attacks, pass-the-hash, and credential stuffing.
• Host-based attacks: Test privilege escalation, process injection, and credential dumping.
• Web application attacks: Perform SQL injection, cross-site scripting (XSS), and directory traversal.
• Cloud-based attacks: Test container escapes, metadata service attacks, and IAM misconfigurations.
• AI attacks: Understand risks like prompt injection and manipulation of AI systems.
• Get exam-ready—Find training options and explore bundle packages.

Post-Exploitation and Lateral Movement (14%)

• Post-exploitation activities: Maintain access, move between systems, and remove testing traces when finished.
• Documentation: Write clear attack summaries and give steps to fix the issues found.

Course Level: Advanced

This course is offered in one of two ways:

• Virtual independent study: You complete the course online on your own schedule.
• Virtual independent study on demand: You complete the course online on your own schedule with support from a CompTIA instructor.

This course is delivered through the CompTIA virtual learning platform.

This course is available all year. You can start your course when your enrollment is complete.

When this course is posted on CareerForce, we are required to enter a start date. The date shown on CareerForce is only for the job posting. It is not the date your course starts.

• Complete the course: Within three months of receiving your course materials.
• Take the exam: Within one month after completing the course.
• Retake the exam, if needed: Within two months of your last exam.

Your course materials and exam vouchers have expiration dates. These dates cannot be extended.

You must have at least CompTIA A+–level knowledge before taking this course. This knowledge may come from a CompTIA A+ certification, education, or similar training.

Your certification must be renewed every three years from the date you take the exam.

After you complete the course and pass the exam, we offer career exploration and job support through our MTFS Gather Program.