CompTIA PenTest+ 001 vs 002
CompTIA PenTest+ addresses the latest trends, techniques and attack surfaces – covering the core and intermediate skills in penetration testing and vulnerability management, ensuring high performance on the job.
CompTIA PenTest+ Exam Domains
The exam domains covered in CompTIA PenTest+ PT0-001 and PT0-002 are not vastly different, as they are still relevant to the job roles.
CompTIA have changed the name of exam domain 2.0 from Information Gathering and Vulnerability Identification to Information Gathering and Vulnerability Scanning.
CompTIA have swapped the order of two domains – what was formerly 5.0 Reporting and Communication is now 4.0, (with the same name), and what was formerly 4.0 Penetration Testing Tools is now 5.0 Tools and Code Analysis.
CompTIA PenTest+ PT0-002 Exam Domains vs CompTIA PenTest+ PT0-001 Equivalency
002 Planning and Scoping (14%) vs 001 Planning and Scoping (15%)
002 Information Gathering and Vulnerability Scanning (22%) vs 001 Information Gathering and Vulnerability Identification (22%)
002 Attacks and Exploits (30%) vs 001 Attacks and Exploits (30%)
002 Reporting and Communication (18%) vs 001 Penetration Testing Tools (17%)
002Tools and Code Analysis (16%) vs 001 Reporting and Communication (16%)
However, the new CompTIA PenTest+ (PT0-002) focuses on the most up to date and current skills needed for the following tasks:
Planning and scoping a penetration testing engagement
Understanding legal and compliance requirements
Performing vulnerability scanning and penetration testing using appropriate tools and techniques, and then analyzing the results
Producing a written report containing proposed remediation techniques, effectively communicating results to the management team and providing practical recommendations
This is equivalent to three to four years of hands-on experience working in a security consultant or penetration tester job role. CompTIA PenTest+ is recommended to follow CompTIA Security+ on the CompTIA cybersecurity career pathway.
CompTIA PenTest+ Exam Objectives
The exam purpose and audience are similar in both CompTIA PenTest+ PT0-001 and PT0-002 with the same number of exam domains, titles and page count. However, we consolidated the exam objectives down from 24 to 21 to improve the instructional design and merge similar topics.
Specifically, these changes have been made from CompTIA PenTest+ PT0-001 to PT0-002:
Newer techniques for pen testing an expanded attack surface
Emphasis on demonstrating an ethical hacking mindset given various scenarios
More focus on the hands-on tasks and automation required for vulnerability management
More focus on code analysis to emphasize the growing need to identify and analyze code during a penetration test (Note: Code development is not included on CompTIA PenTest+)
As you use the exam objectives to prepare for your test, note that they are not exhaustive of everything you may be tested on. Consider the exam objectives stem (the heading) as your item to study and the bulleted lists as examples of some of the things that might be covered. CompTIA is constantly reviewing exam content and updating questions to ensure relevance and exam integrity.
How CompTIA PenTest+ Evolves with the Industry
In a field like cybersecurity, where the job is continually evolving, CompTIA exam domains need to reflect what’s happening in the industry now. The following table explains why we updated the CompTIA PenTest+ exam domains and how they relate to job requirements.
Exam Domain
Description
How It Applies to the Job
1.0 Planning and Scoping
Includes updated techniques emphasizing governance, risk and compliance concepts, scoping and organizational/customer requirements and demonstrating an ethical hacking mindset
Pen testers can be held criminally liable when operating without ethics or proper approvals. Pen testing is required for compliance to regulations such as PCI-DSS and the NIST 800-53 RMF.
2.0 Information Gathering and Vulnerability Scanning
Includes updated skills on performing vulnerability scanning and passive/active reconnaissance, vulnerability management as well as analyzing the results of the reconnaissance exercise
Automation is required for modern vulnerability management to counteract automated attacks. Organizations must efficiently mitigate vulnerabilities, avoiding unnecessary dangers to operations.
3.0 Attacks and Exploits
Includes updated approaches to expanded attack surfaces; researching social engineering techniques; performing network, wireless, cloud and application-based attacks; and post-exploitation techniques
Updated skills are needed to secure multiple attack surfaces; 87% of CompTIA-certified IT pros already work in expansive hybrid environments (both on-premises and in the cloud), and 93% work in multi-cloud environments.
4.0 Reporting and Communication
Expanded to focus on the importance of reporting and communication in an increased regulatory environment during the pen testing process through analysis and appropriate remediation recommendations
Communication is critical for the penetration testing lifecycle because collaboration is essential for identifying and managing vulnerabilities. Reporting is especially important for complying with regulations.
5.0 Tools and Code Analysis
Includes updated concepts of identifying scripts in software deployments, analyzing a script or code sample and explaining use cases of pen test tools (Note: Scripting and coding is not required)
Exposure to different scripts and code samples provides an expanded toolbox to help pen testers progress through their career. Pen testers work with scripting more as they advance in their careers.
Interested in undertaking CompTIA PenTest+ Certification? Choose between instructor led courses or CompTIA CertMaster Self Paced online training. For more information Call 01752 724000.