PenTest+ (PT0-003) — Coverage Map
This page is Step 2 of the repo's how to prepare a certification
method: the contract between you and the exam. The official objectives document lists
everything CompTIA can ask; this map lists everything this hub teaches. Lining the two up
tells you, before you study, what is covered, what is thin, and what is missing.
The rows are the section headings that exist in this hub's five domain pages — nothing
more. The official objective numbers are not reproduced here (the hub does not carry
CompTIA's numbering, and this page will not invent it), so the first column is yours to fill.
How to fill it in:
- Download the official PT0-003 exam objectives PDF — the steps are in
exam & objectives → how to get the official exam objectives.
- Walk the PDF objective by objective. For each one, find the matching row below and write the
official number (as printed in the PDF) in the first column. One objective may span several
rows, and one row may cover several objectives — record all of them.
- Any objective with no matching row goes in the gaps table at the end,
marked "gap", with a note on where you will learn it. Expect gaps here: PenTest+ lists
many named tools and script constructs, and this hub teaches tools by purpose and attacks
conceptually (countermeasures first, never weaponised how-tos).
- Then score every row 0–3 (the scale is in
Step 3 of the method) and tick
Practised? only after you have done the hands-on item for that topic in an authorised lab.
The numbered sections in the Domain 4 and Domain 5 pages (1. … 9.) are the hub's
numbering, not CompTIA's. Domain weights in the group headings are the ones the hub records
from CompTIA's page (verify on CompTIA — weightings change per exam version).
How to use
- Before studying: fill the first column and the self-score column; the zeros and ones are
your syllabus. Domain 4 alone is 35% — the hub's plan spends the most weeks there.
- During the study loop: after each domain page, revisit its rows — raise the score, tick
Practised? (in the CEH lab or on a
practice platform, never on systems you are not authorised
to test), and use Notes for the weak-area log entry.
- Before booking: the readiness gate (Step 6 of the method) needs every row at 2 or 3 and
the gaps table empty or answered.
- Where a row has a
↳, it is a subsection of the row above it; score it separately only if
the PDF treats it as its own objective.
- Rows link straight to the section, so this page doubles as the hub's fastest index.
Coverage map
Domain 1 — Engagement Management (13%)
| Official objective # (record from the PDF) |
Topic area (as covered here) |
Where |
Self-score 0–3 |
Practised? |
Notes |
| ____ |
The engagement lifecycle |
D1 → section |
__ |
☐ |
|
| ____ |
Pre-engagement activities |
D1 → section |
__ |
☐ |
|
| ____ |
↳ Scope definition |
D1 → subsection |
__ |
☐ |
|
| ____ |
↳ Rules of Engagement (RoE) |
D1 → subsection |
__ |
☐ |
|
| ____ |
↳ Contracts and agreements (SOW, MSA, NDA, and authorisation) |
D1 → subsection |
__ |
☐ |
|
| ____ |
↳ Target audience and assessment types |
D1 → subsection |
__ |
☐ |
|
| ____ |
↳ Regulatory and compliance considerations |
D1 → subsection |
__ |
☐ |
|
| ____ |
Collaboration and communication during the engagement |
D1 → section |
__ |
☐ |
|
| ____ |
Testing methodology and standards |
D1 → section |
__ |
☐ |
|
| ____ |
Reporting and findings |
D1 → section |
__ |
☐ |
|
| ____ |
↳ Risk ratings with CVSS |
D1 → subsection |
__ |
☐ |
|
| ____ |
↳ Communication and de-escalation in delivery |
D1 → subsection |
__ |
☐ |
|
| ____ |
Professionalism, ethics, and governance/risk/compliance (GRC) |
D1 → section |
__ |
☐ |
|
Domain 2 — Reconnaissance and Enumeration (21%)
| Official objective # (record from the PDF) |
Topic area (as covered here) |
Where |
Self-score 0–3 |
Practised? |
Notes |
| ____ |
Passive vs active reconnaissance |
D2 → section |
__ |
☐ |
|
| ____ |
Open-Source Intelligence (OSINT) |
D2 → section |
__ |
☐ |
|
| ____ |
Enumeration by target type |
D2 → section |
__ |
☐ |
|
| ____ |
↳ Notes on selected targets |
D2 → subsection |
__ |
☐ |
|
| ____ |
Active reconnaissance and scanning concepts |
D2 → section |
__ |
☐ |
|
| ____ |
Reconnaissance and enumeration tools (purpose only) |
D2 → section |
__ |
☐ |
|
| ____ |
Scripting and automation for recon (conceptual) |
D2 → section |
__ |
☐ |
|
| ____ |
Countermeasures / Defense |
D2 → section |
__ |
☐ |
|
Domain 3 — Vulnerability Discovery and Analysis (17%)
| Official objective # (record from the PDF) |
Topic area (as covered here) |
Where |
Self-score 0–3 |
Practised? |
Notes |
| ____ |
Vulnerability assessment vs penetration test |
D3 → section |
__ |
☐ |
|
| ____ |
Vulnerability discovery: methods and targets |
D3 → section |
__ |
☐ |
|
| ____ |
↳ Automated vs manual discovery |
D3 → subsection |
__ |
☐ |
|
| ____ |
↳ Scanning types and considerations |
D3 → subsection |
__ |
☐ |
|
| ____ |
↳ Discovery by target type |
D3 → subsection |
__ |
☐ |
|
| ____ |
↳ Static vs dynamic analysis (applications) |
D3 → subsection |
__ |
☐ |
|
| ____ |
Analyzing scan output |
D3 → section |
__ |
☐ |
|
| ____ |
Prioritizing vulnerabilities |
D3 → section |
__ |
☐ |
|
| ____ |
↳ CVSS metric groups |
D3 → subsection |
__ |
☐ |
|
| ____ |
Validating findings: true vs false positives |
D3 → section |
__ |
☐ |
|
| ____ |
Preparing for exploitation (conceptual) |
D3 → section |
__ |
☐ |
|
| ____ |
Countermeasures / Defense |
D3 → section |
__ |
☐ |
|
Domain 4 — Attacks and Exploits (35%)
| Official objective # (record from the PDF) |
Topic area (as covered here) |
Where |
Self-score 0–3 |
Practised? |
Notes |
| ____ |
The attack-category taxonomy (defense-oriented) |
D4 → section |
__ |
☐ |
|
| ____ |
1. Network attacks |
D4 → section |
__ |
☐ |
|
| ____ |
2. Authentication and credential attacks |
D4 → section |
__ |
☐ |
|
| ____ |
3. Host-based attacks |
D4 → section |
__ |
☐ |
|
| ____ |
4. Web-application attacks (OWASP Top 10) |
D4 → section |
__ |
☐ |
|
| ____ |
5. Wireless attacks |
D4 → section |
__ |
☐ |
|
| ____ |
6. Cloud attacks |
D4 → section |
__ |
☐ |
|
| ____ |
7. Social engineering |
D4 → section |
__ |
☐ |
|
| ____ |
8. Physical attacks |
D4 → section |
__ |
☐ |
|
| ____ |
9. Attacks on specialized systems (mobile, IoT, OT/ICS) |
D4 → section |
__ |
☐ |
|
Domain 5 — Post-exploitation and Lateral Movement (14%)
| Official objective # (record from the PDF) |
Topic area (as covered here) |
Where |
Self-score 0–3 |
Practised? |
Notes |
| ____ |
The post-exploitation chain with defensive controls overlaid |
D5 → section |
__ |
☐ |
|
| ____ |
1. Enumeration of the compromised host and network |
D5 → section |
__ |
☐ |
|
| ____ |
2. Privilege escalation |
D5 → section |
__ |
☐ |
|
| ____ |
3. Persistence (concept) |
D5 → section |
__ |
☐ |
|
| ____ |
4. Lateral movement and pivoting (concept) |
D5 → section |
__ |
☐ |
|
| ____ |
5. Data collection and exfiltration (concept) |
D5 → section |
__ |
☐ |
|
| ____ |
6. Covering tracks / anti-forensics (concept) |
D5 → section |
__ |
☐ |
|
| ____ |
Why PAM is central to this whole domain |
D5 → section |
__ |
☐ |
|
Cross-cutting exam skills
| Official objective # (record from the PDF) |
Topic area (as covered here) |
Where |
Self-score 0–3 |
Practised? |
Notes |
| ____ |
Performance-based questions (PBQs) — what they are and how to pace them |
Exam & objectives |
__ |
☐ |
|
| ____ |
Mixed practice set (all five domains) |
Practice questions |
__ |
☐ |
|
| ____ |
Last-week recall: tool-to-purpose pairs, acronyms |
Cheat sheet |
__ |
☐ |
|
Gaps you found
One row per official objective that has no matching row above. Decide where you will learn it (another page in this repo, the exam body's own material, a lab) and add that source to your plan.
| Official objective |
What is missing |
Where you will learn it |
|
|
|
|
|
|
|
|
|
Sources