Here’s my study guide for the CompTIA PenTest+ beta exam. I have yet to take the test, but have been following the random public comments shared by others.

All of these topics are from the exam objectives, but some things are mentioned more often online than others. I’m focusing my studies on what people are talking about the most.

Must Know for the CompTIA PenTest+

Or, what to study hardest…

• NMAP options and output. Nice cheat sheet here.
• Netcat options and output.
  • also: How to create a reverse shell. How to transfer a file.
• SQL injection types and mitigations
• XSS types and mitigations
• ARP Spoofing

What to Review Quickly

• Python syntax
• Ruby syntax
• BASH syntax
• PowerShell syntax
• Nessus
• OpenVAS
• POS system attacks
• Aircrack-ng suite
• Linux permissions
• Basic ports and services
• Tools from the exam objectives (at least know what each one is used for in general)
• Wireshark filters and how to analyze a PCAP
• Password crackers and what platform they run on

General Topics

These should be easy enough if you have a little bit of security experience:

• Classifying priorities of vulnerabilities (eg: outdated software with public exploits available vs a potential DDoS vulnerability)
• Types of documents involved in penetration testing (can probably guess their use by the name)
• Physical security
• Social engineering attacks (eg: phishing, spear phishing, whaling)
• Types of attackers (eg: insiders, script kiddies)
• Basic WiFi concerns (eg: Rogue AP)
• Basic networking (eg: hub, switch, router, gateway)
• Identify false positives

Everything Else

I printed out the exam objectives and underlined anything that I wasn’t sure of. This will be my first CompTIA test, but from what I’ve heard, they stick to the content of the objectives.

CompTIA PenTest+ Exam Format

• Mostly multiple choice with 1 answer only
• Maybe a dozen “choose two or more”
• ~5 drag-and-drop simulations

CEH vs CompTIA PenTest+

Most people are saying this test is much more challenging than the CEH. That may be true, and I found the CEH exam to be surprisingly straight-forward. But it does look like much of the content in the PenTest+ exam objectives is shared with the topics of the CEH (the general topics, if not always the actual tools used.)

The practice questions on the free version of Skillset.com for the CEH also covered much of the same content. That should give me a good enough foundation that I can mainly focus on refreshing my knowledge in the “must know” section above.

The higher challenge of the CompTIA PenTest+ is likely due to the greater depth in the specifics of the tools being tested. Those answers would come easier from real, hands-on pen testing work.

Update

I passed! My study process above worked just fine. It was indeed fairly similar to the CEH test, but maybe 20% harder, and with better quality control in the content.

CEH had a couple straight up broken questions on my test. There wasn’t anything like that on the PenTest+.