How many questions are on the CompTIA PenTest+ exam?

The CompTIA PenTest+ exam has 90 questions, and the vendor's published description is: Up to 90 questions, 165 minutes.

How long do you have to complete the CompTIA PenTest+ exam?

You get 165 minutes, which is about 110 seconds per question. The published format is: Up to 90 questions, 165 minutes.

What score do you need to pass the CompTIA PenTest+ exam?

The passing score is 83% (750/900 scaled score (scale 100-900)).

What are the domains on the CompTIA PenTest+ exam?

There are 5 domains: Attacks and Exploits, Engagement Management, Reconnaissance and Enumeration, Vulnerability Discovery and Analysis, Post-Exploitation and Lateral Movement. The official weights are Attacks and Exploits 35%, Engagement Management 13%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Post-Exploitation and Lateral Movement 14%.

How should I use the domain weights when revising?

Weight by percentage, not by domain. 35% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the CompTIA PenTest+ exam?

Yes: 90 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

CompTIA PenTest+ Exam Format

PT0-003

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CompTIA PenTest+ certification is a vendor-neutral credential that measures the practical skills needed to plan, scope, and conduct penetration tests. The PT0-002 exam evaluates the ability of a candidate to perform reconnaissance and enumeration, discover vulnerabilities, execute attacks, and move through a compromised network after exploitation. PenTest+ highlights the entire engagement lifecycle, including legal, compliance, and reporting responsibilities. Because the exam includes performance-based questions, candidates must demonstrate hands-on proficiency with tools such as Nmap, Burp Suite, Metasploit, map, and Wireshark. The test is designed for security professionals who are ready to move beyond defensive concepts and think like an attacker while remaining grounded in professional ethics and risk management. Successful candidates gain the confidence to identify, exploit, and report vulnerabilities in a controlled, authorized environment.

90 questions

165 min

83% to pass

5 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	90
Time limit	165 minutes (110s per question)
Passing score	83% — 750/900 scaled score (scale 100-900)
Domains	5
Level	Expert
Question bank here	90 questions
Published format	Up to 90 questions, 165 minutes
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
Attacks and Exploits	35%	Exploiting web application vulnerabilities including injection and XSS Exploiting network services, protocols, and misconfigurations Performing password attacks, credential harvesting, and brute force +5 more	31
Engagement Management	13%	Planning and scoping penetration test engagement objectives Establishing legal, regulatory, and compliance boundaries Defining rules of engagement, permissions, and authorization +5 more	12
Reconnaissance and Enumeration	21%	Passive reconnaissance using open-source intelligence (OSINT) Active reconnaissance techniques and network footprinting Network discovery, host scanning, and port enumeration +5 more	19
Vulnerability Discovery and Analysis	17%	Vulnerability scanning methodologies and scheduling Using Nessus, OpenVAS, and Qualys for automated scanning Manual security assessment and secure code review +5 more	15
Post-Exploitation and Lateral Movement	14%	Maintaining persistent access and covert installations Performing privilege escalation on Windows and Linux Moving laterally across networks and managing sessions +4 more	13

The heaviest domain is Attacks and Exploits at 35%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Voucher Plus Retake Assurance 579 USD; exam version V3 launched 2024-12-17. Official exam page