Welcome to this course
for the CompTIA PenTest+ certification.
This certification is considered
to be an intermediate level certification
for technical professionals who conduct penetration testing
and vulnerability management
in an on-premise, cloud, or hybrid environment.
The PenTest+ PT0-003 certification exam
validates your intermediate level competency
in all stages of a penetration test
or vulnerability assessment,
including planning and scoping, reconnaissance,
scanning and enumeration, attacking, exploiting, reporting,
and communicating your findings.
Additionally, this course will introduce you
to many of the different tools
that are going to be used during a penetration test
or vulnerability assessment,
as well as the basics of code analysis
that you may be required to perform in the real world.
As we go through this course
and we prepare you for the certification exam,
you're going to be learning the technical knowledge and skills
required to conceptualize, engineer, integrate,
and implement penetration tests
and vulnerability assessments
inside of your organization's complex environments
in support of a more resilient enterprise.
This certification is designed
for intermediate level security professionals
with at least three to four years
of broad, hands-on information security
or cybersecurity experience.
Before taking the CompTIA PenTest+ exam,
it is recommended that you've already completed
the Security+ and CySA+
or Cybersecurity Analyst+ certification exams.
Now, this is a recommendation from CompTIA
and not a strict requirement,
but it is one I do recommend at least having a Security+
before going into PenTest+ or you will struggle.
Now, on the PenTest+ exam, knowledge from the Security+ exam
will be considered to be assumed knowledge,
so we're not going to cover
and reteach all of that content in this course.
If it's been a while since you reviewed the contents
of the Security+ exam, you may wish to review those
before you start this course,
or go back and take my CompTIA Security+ video course
as a great review
before you start your CompTIA PenTest+ certification.
Now, in this course, we're going to be building
upon your foundational knowledge from Security+,
including that of computer security,
security analysis, and penetration testing
throughout our time together in this course.
But don't worry, I'm also going to go back
and review any area specific to the PenTest+ exam
that you need to know more about
as we go through this course
to ensure you're ready for the certification exam,
even if it's been a while
since you've looked at the Security+ exam.
Now, the CompTIA PenTest+ exam consists of five domains
or areas of knowledge that you're going to receive questions on
when you sit down for the official certification exam.
Domain 1 is known as Engagement Management,
and it makes up 13% of your exam questions.
Engagement Management is centered
around the planning stages of penetration testing,
and it focuses on things like scoping engagements
per regulatory and security standards,
defining responsibilities across hosting providers,
customers, and testers, and emphasizing the need
for clear communication and stakeholder alignment.
It also highlights the differences
between various testing frameworks and methodologies,
and also, it details the sections
of an effective penetration testing report.
Domain 2 is known as Reconnaissance and Enumeration,
and it makes up 21% of your exam questions.
Now, this domain combines the art of gathering information
and systematically probing for weaknesses
across various systems and networks.
It's going to outline techniques for both active
and passive reconnaissance.
It utilizes open source intelligence from social media,
job boards, and domain name system lookups
among many others as well
in order to be able to uncover potential vulnerabilities
in your networks.
Domain 3 is known as Vulnerability Discovery and Analysis.
Now, this section of the exam
makes up 17% of your exam questions,
and it dives into the techniques used for uncovering
and analyzing vulnerabilities across various environments
from software applications to network infrastructures.
Domain 4 is known as Attacks and Exploits,
and it's going to make up 35% of your exam questions,
making it the largest domain on the exam.
Now, this domain is going to cover the application
of techniques and tools
necessary for carrying out the attacks and exploits
after we've discovered the vulnerabilities.
This emphasizes analyzing scan outputs
to prioritize high value targets
using metrics such as CVSS scores
and preparing you to attack them
with the use of tools like Metasploit and Nmap.
Our fifth domain is called Post-exploitation
and Lateral Movement,
and this is going to make up 14% of your exam questions.
Now, this domain is going to be focused on the actions taken
after you get initial access into a system.
And this aims to deepen
and expand control over the environment.
This is going to include establishing
and maintaining persistence
through methods like reverse shells
and deploying backdoors into a targeted system.
Now, as we move through this course,
we're not going to be covering these domains
and their 26 objectives listed underneath them
in the same order presented
in the official CompTIA exam objectives,
which you can download from Lesson 2 of this course.
What you're going to see instead
is that we're going to cover each objective
in a more logical order for you to learn these concepts
as we go through the course.
For example, some of the objectives in Domain 1
are covered towards the end of the course
because they have to deal with reporting,
and this is typically the last thing you do
in a real world penetration test.
Now, at the beginning of each section of the course,
we're going to state what domain and associate objectives
we're going to be covering in that section of the course
and those particular lessons.
And for each of those lessons, we're going to title them
with the objective listed in parentheses after their name,
so you can easily reference it if you want to go back
and study a particular objective later on
as you're reviewing right before you take your exam.
For example, if you see a lesson called AI Attacks, OBJ 4.9,
this tells you that this lesson
is associated with Domain 4 and Objective 4.9 specifically.
Now in this lesson, you're going to learn all about AI attacks,
and again, this comes from Attacks and Exploits or Domain 4
and specifically Objective 4.9
that states we should be able to explain common attacks
against specialized systems,
and AI attacks are listed as a bullet
underneath that objective.
Now, on test day, when you sit down to take the exam,
you're going to get a mixture of questions
from across all five domains and 26 objectives,
and some exam questions
might even combine multiple objectives
from different domains into a single question
to deeply test your knowledge of that material.
For example, if you receive a question
about using the network mapping tool known as Nmap,
it would actually combine two objectives.
Objective 2.4 states that you need to use appropriate tools
for reconnaissance and enumeration,
and Nmap is listed underneath it
under the Nmap Scripting Engine or NSE.
But we also have Objective 4.2
that states we must perform network attacks
using appropriate tools.
And Nmap's NSE, again, is listed as one of those tools.
So just be aware that the lessons of this course
may build upon themselves
and questions on the exam may not be as straightforward
as what you've seen in previous exams,
like the Security+ exam,
because we're going to combine multiple things
inside of our exam questions.
Here in PenTest+, you are required
to analyze information in more depth,
and sometimes you're going to need to combine concepts
across multiple domains or multiple objectives
in order to get the correct answer.
Now, speaking of the exam, when you sit down
to take the CompTIA PenTest+ certification exam
at your testing center
or online using the web proctoring service,
you're going to have 165 minutes to answer up to 85 questions.
Now, for the most part,
you're going to be answering multiple choice questions,
but you'll also have a few
multiple select questions as well,
and you'll be asked to pick the right one or two
or three answers for a given question.
In addition to this, you're also going to get a handful
of what we call PBQs or performance-based questions.
Now, most of my students like to call these simulations,
and they require you to perform some kind of job function
in a simulated environment.
For example, the exam could present a scenario
where you need to use the social engineering toolkit
to conduct a phishing attack.
You might be given a scenario
with a list of steps on the left side of the screen,
including various templates, email targets,
and phishing message options,
and then you'll need to drag and drop these elements
into the correct sequence on the right panel
in order to set up the phishing campaign effectively.
The exam will test your ability to choose the right elements
and to meet the specified objectives
for that social engineering attack
if you got this type of a question.
Now, rest assured, we're going to thoroughly prepare you
for these type of simulation questions throughout our course
to ensure you're confident and ready for the exam,
and we do this by doing a lot of hands-on demonstrations
throughout the course.
Now, as far as the number of questions
you're going to get on exam day,
you may have noticed I said up to 85 questions,
not 85 questions.
Now, in truth, you're going to get somewhere between 65
and 85 questions, and if you get more simulations or PBQs,
you're going to get less multiple choice questions,
and the same holds true in reverse.
If you have more multiple choice,
you'll have less simulations.
Now, most candidates are going to get three to five simulations
on the exam and roughly 75 to 80 multiple choice questions
when they sit down to take the test.
Now, also, when you take the exam,
those simulations will be the first three to five questions
you're going to get on the exam,
and the rest of the exam will be either multiple choice
or multiple select style questions.
The CompTIA PenTest+ exam is a graded exam,
and you need to score at least 750 out of 900 points
on the scale in order to pass the exam
and earn your certification.
Now, each question is weighted a bit differently on the exam
based on its difficulty and complexity, so not all questions
will be worth the same amount of points.
But if you want a rough estimate of the score
you need to pass on the exam,
if you're scoring 80 to 85% or higher on practice exam,
you should be doing okay on the real exam as well.
Now, as soon as you finish the exam, you will get your score
and whether or not you pass the certification too.
In order to take the exam, you have to pay an exam fee
to cover the cost of testing,
and you do this by buying an exam voucher,
and you can do that by going to store.CompTIA.org
and buying it directly from their web store.
Now, in the web store,
you're going to be seeing all the vouchers
and how much they cost for your area.
Most of the time it's going to be around 380 to $400,
but this does vary depending on where you live in the world.
If you want to save a little bit of money
on the exam voucher though,
you can go over to diontraining.com/vouchers
and purchase your exam voucher directly from us.
Because we're a certified
platinum level CompTIA delivery partner
and we help tens of thousands of students
every year pass their exams,
they give us a discount rate for those exam vouchers,
and we pass our savings onto you, our students.
So if you take that one extra step
of going over to diontraining.com/vouchers
and purchasing your exam voucher from us,
you're going to save an extra 10% or so
off the regular price of the exam voucher,
and we'll also give you access
to our fully searchable library of videos
so you can use those for your last minute studying
based on keywords as you're studying for your exam
as a free bonus to you.
Now, before you begin studying for the exam,
I want to give you my four tips for success in this course
to help you better prepare.
First, we provide closed captions
for every video in this course
that's captioned by real humans
to ensure a higher level of accuracy for you.
Many of my students who speak English
as their second language
really love having those captions available
so they can read along with what I'm teaching.
To turn them on, simply click the CC
in the bottom of the video player.
Now, there's also a transcript available for each video
that you can access and search for a specific keyword
or key phrase to identify things
that you're stuck on as well.
Also, when it comes to speaking,
some people say I speak too fast
and others say I speak too slow,
but either way, you can control the speed of instruction
by adjusting my playback speed.
If I happen to be speaking too fast for you,
simply slow me down by going to a 0.75 or 75%.
If I'm talking too slowly for you,
you can speed me up by going to 1.5 or 150%.
Either way, faster or slower, the choice is yours
so you can learn most efficiently.
Next, I want to point out that all the information
I'm going to teach you in this course is also available
as a downloadable study guide in PDF format.
Over in Lesson 2 of this course,
you're going to be able to download it, print it out,
and then use it to take notes on or highlight
and circle important information
as we go through the videos together.
This PDF becomes a great tool
for your offline studying as well
because you have all your notes in one consolidated place.
Finally, I want you to know
that we have a Facebook group set up
specifically to help you succeed with this
and your other certification exams.
If you have any questions or you get stuck on something
or you just want to talk to other students
who are studying for the same exam,
you can do all of this
by going to facebook.com/groups/diontraining.
If you join the Facebook group,
we have people there ready to answer your questions
anytime of the day or night,
because we have over 50,000 other students in that group too
that are studying for this and other certification exams.
So if you have a question,
I recommend posting it in the Facebook group
because you're going to get an answer really, really quickly.
Now, if you don't have Facebook and you need help,
you can also go to our Discord server to get help there,
and you can find this at diontraining.com/discord,
and both of these are free resources for you to join
and get access to.
If you don't have either Facebook or Discord,
you can also post your questions
in the Q&A section of this course.
All right, with all the basics out of the way,
let's get started learning all about penetration testing
and vulnerability assessments
in this CompTIA PenTest+ certification course.