This roadmap is for individuals who already have Security+ or equivalent knowledge, are currently working, and have about 15 hours per week to study.
If you don't have a security foundation, please revisit Security+ first. PenTest+ assumes you understand networking, operating systems, and basic security concepts.
Principles that Differ Significantly from Security+
This is the most crucial point, and it changes your entire time allocation strategy.
With Security+, a theory/practice ratio of about 70/30 could still pass. With PenTest+, that ratio must be reversed: at least 50% of your time must be hands-on keyboard.
The reason has been clearly stated in the PT0-003 exam experience sharing: questions ask about the same concept in many variations, and only those with real-world experience can answer all of them.
Therefore, the roadmap below always combines theory + lab in the same week, never separating them.
Preparation before Week 1
Schedule your exam date. Approximately 90–100 days from today. Without a real deadline, the roadmap will drift.
Download the PT0-003 objectives from the CompTIA website. It's free. Print it out and use it as a checklist throughout the 12 weeks.
Prepare your lab environment. This must be completed before week 1, not gradually during your study. Two options: use CertMaster Perform PT0-003 which runs in the browser, or set up your own virtual machines with vulnerable target systems. If you set it up yourself, add 1–2 weeks to the roadmap specifically for this task.
Weeks 1–2: Engagement Management (13%)
Planning, scope definition, legal aspects, contracts, rules of engagement, and reporting.
Many people want to skip ahead to the "hacking" part. Don't. This domain accounts for 13% of the exam and, more importantly, it defines what makes a professional pentester instead of just someone who knows how to use tools.
Tasks:
- Clearly understand different types of testing scopes and legal constraints
- Understand the structure of a testing report: executive summary, findings, risk levels, and remediation recommendations
- Try writing a sample report for a simple vulnerability. This might sound redundant, but it helps you understand this domain more deeply than rote memorization
Weeks 3–4: Reconnaissance and Enumeration (21%)
Passive (OSINT) and active information gathering, network scanning, service enumeration.
This is the most important week for practical skills. Most of the tricky questions that test-takers often get wrong are in this section.
Tasks:
- Run all types of scans, not just one. Record the results of each type in a table: what does this type yield, how long does it take, how noisy is it
- Clearly distinguish: scans that only find open ports, scans that identify services and versions, OS detection scans, scans that only detect live hosts, TCP vs. UDP scans
- Practice OSINT on a legitimate public target
- Enumerate services: SMB, DNS, SNMP, web
Tip: create a table mapping "information objective ↔ suitable scan method." This table will help you answer questions no matter how they are phrased.
Weeks 5–6: Vulnerability Discovery and Analysis (17%)
Vulnerability identification, interpreting scan results, analysis, and prioritization.
Tasks:
- Run vulnerability scanning tools on target machines in the lab, carefully read the generated reports
- Learn to distinguish between true findings and false positives — this skill is both tested in the exam and needed in the profession
- Understand how to score severity and prioritize remediation
- Read source code at a basic level to identify common errors
Milestone check Week 6: take domain 1–3 practice tests. If below 70%, dedicate an additional week to reinforce before proceeding.