Audience
CompTIA PenTest+ is a certification for intermediate level cybersecurity professionals who are tasked with hands-on penetration testing to identify, exploit, report, and manage vulnerabilities on a network. It is ideal for:
- Penetration Testers
- Vulnerability Testers
- Security Analysts
- Vulnerability Assessment Analysts
- Network Security Operations Personnel
- Application Security Vulnerability Personnel
Prerequisites
While there are no required prerequisites, the following are recommended:
- CompTIA Network+ Certification
- CompTIA Security+ Certification3-4 years of hands-on information security experienceDuration
5 days. Hands-on.
Course Objectives
CompTIA PenTest+ assesses the most up-to-date penetration testing, and vulnerability assessment and management skills necessary to determine the resiliency of the network against attacks.
The CompTIA PenTest+ certification (Exam PT0-003) verifies that successful candidates have the knowledge and skills required to plan and scope an assessment, understand legal and compliance requirements, perform vulnerability scanning and penetration testing, analyze data, effectively report and communicate results, and provide practical recommendations.
The exam can be taken as part of the course and includes both hands-on, performance-based, questions and multiple-choice, to ensure each candidate possesses the skills, knowledge, and ability to perform tasks on systems. It also includes management skills used to plan, scope, and manage weaknesses, not just exploit them. PenTest+ is unique because candidates are required to demonstrate the ability and knowledge to test devices in new environments such as the cloud and mobile, in addition to traditional desktops and servers.
What skills will you learn?
- Planning and Scoping - Explain the importance of planning and key aspects of compliance-based assessments
- Information Gathering and Vulnerability Identification - Gather information to prepare for exploitation then perform a vulnerability scan and analyze results
- Attacks and Exploits - Exploit network, wireless, application, and RF-based vulnerabilities, summarize physical security attacks, and perform post-exploitation techniques
- Penetration Testing Tools - Conduct information gathering exercises with various tools and analyze output and basic scripts (limited to: Bash, Python, Ruby, PowerShell)
- Reporting and Communication - Utilize report writing and handling best practices explaining recommended mitigation strategies for discovered vulnerabilities
Course Content
Planning and Scoping
- Explain the importance of planning for an engagement
- Explain key legal concepts
- Explain the importance of scoping an engagement properly
- Explain the key aspects of compliance-based assessments
- Information Gathering and Vulnerability Identification
- Conduct information gathering using appropriate techniques
- Perform a vulnerability scan
- Analyze vulnerability scan results
- Explain the process of leveraging information to prepare for exploitation
- Explain weaknesses related to specialized systems
Attacks and Exploits
- Compare and contrast social engineering attacks
- Exploit network-based vulnerabilities
- Exploit wireless and RF-based vulnerabilities
- Exploit application-based vulnerabilities
- Exploit local host vulnerabilities
- Summarize physical security attacks related to facilities
- Perform post-exploitation techniques
Penetration Testing Tools
- Use Nmap to conduct information gathering exercises
- Compare and contrast various use cases of tools
- Analyze tool output or data related to a penetration test
- Analyze a basic script (limited to Bash, Python, Ruby, and PowerShell)
Reporting and Communication
- Use report writing and handling best practices
- Explain post-report delivery activities
- Recommend mitigation strategies for discovered vulnerabilities
- Explain the importance of communication during the penetration testing process