CompTIA PenTest+ proves you have the skills to find, reduce, and report security weaknesses in computer systems.

This certification covers every stage of penetration testing. You will learn how to test systems in the cloud, web apps, APIs, and IoT devices. It focuses on hands-on skills like managing vulnerabilities and moving through systems to find hidden risks.

PenTest+ helps you build the skills you need to grow your career as a penetration tester or security consultant.

Engagement Management (13%)

• Planning and scoping: Set the rules for the test, choose targets, and decide when testing will happen.
• Legal and ethical compliance: Make sure you have written permission and follow all laws and rules.
• Collaboration and communication: Work with team members and leaders, review findings, and clearly explain risks.
• Penetration test reports: Write reports with a summary for leaders, detailed findings, and steps to fix problems.

Reconnaissance and Enumeration (21%)

• Active and passive reconnaissance: Gather information using public sources (OSINT), network traffic tools, and scans.
• Enumeration techniques: Collect details about DNS, services, and directories.
• Reconnaissance tools: Use tools like Nmap, Wireshark, and Shodan to gather information.
• Script modification: Edit Python, PowerShell, and Bash scripts to support testing.

Vulnerability Discovery and Analysis (17%)

• Vulnerability scans: Run scans with and without login access. Use tools for testing application security (SAST and DAST).
• Result analysis: Review scan results, confirm real issues, and remove false alarms.
• Discovery tools: Use tools like Nessus, Nikto, and OpenVAS to find security weaknesses.

Attacks and Exploits (35%)

• Network attacks: Test methods like VLAN hopping, on-path attacks, and service exploits.
• Authentication attacks: Perform brute-force attacks, pass-the-hash, and credential stuffing.
• Host-based attacks: Test privilege escalation, process injection, and credential dumping.
• Web application attacks: Perform SQL injection, cross-site scripting (XSS), and directory traversal.
• Cloud-based attacks: Test container escapes, metadata service attacks, and IAM misconfigurations.
• AI attacks: Understand risks like prompt injection and manipulation of AI systems.
• Get exam-ready—Find training options and explore bundle packages.

Post-Exploitation and Lateral Movement (14%)

• Post-exploitation activities: Maintain access, move between systems, and remove testing traces when finished.
• Documentation: Write clear attack summaries and give steps to fix the issues found.

Course is offered as a virtual independent study or virtual independent study on demand (includes a CompTIA instructor). 

For our independent study and on-demand CompTIA courses, there is no set start date. These courses are offered all year long. Students can begin as soon as their enrollment is complete.

When we post these courses on CareerForce, we are required to enter a start date. This date is only for the posting and does not mean the class starts on that day.

Course must be completed within three months of receiving materials and the exam is to be completed a month after completing the course. If an exam retake is needed, it must be taken within two months of the previous exam. Both the course materials and exam vouchers have expiration dates with no extensions.

Certification renewal every three years from date of the exam.

Must have a minimum of CompTIA A+–level knowledge through certification, education, or similar training is required.

Level: Advanced

After you complete our course and pass the exam, we offer career exploration and job support through our MTFS Gather Program.