ISMS LA Batch 23rd, 24th, 29th, 30th, 31st May 2026.
Planning and scoping: defining rules of engagement, testing windows, and target selection.
Legal and ethical compliance: ensuring authorization letters, mandatory reporting, and adherence to regulations.
Collaboration and communication: aligning with stakeholders through peer reviews, escalation paths, and risk articulation.
Penetration test reports: creating reports with executive summaries, findings, and remediation recommendations.
Active and passive reconnaissance: gathering information using open-source intelligence (OSINT), network sniffing, and protocol scanning.
Enumeration techniques: performing DNS enumeration, service discovery, and directory enumeration.
Reconnaissance tools: using tools like Nmap, Wireshark, and Shodan for information gathering.
Script modification: customizing Python, PowerShell, and Bash scripts for reconnaissance and enumeration.
Vulnerability scans: conducting authenticated, unauthenticated, static application security testing (SAST) and dynamic application security testing (DAST).
Result analysis: validating findings, troubleshooting configurations, and identifying false positives.
Discovery tools: using tools like Nessus, Nikto, and OpenVAS for vulnerability discovery.
Network attacks: performing VLAN hopping, on-path attacks, and service exploitation.
Authentication attacks: executing brute-force attacks, pass-the-hash, and credential stuffing.
Host-based attacks: conducting privilege escalation, process injection, and credential dumping.
Web application attacks: performing SQL injection, cross-site scripting (XSS), and directory traversal.
Cloud-based attacks: exploiting container escapes, metadata service attacks, and identity and access management (IAM) misconfiguration.
AI attacks: explaining prompt injection and model manipulation against artificial intelligence systems.
Post-exploitation activities: establishing persistence, performing lateral movement, and cleaning up artifacts.
Documentation: creating attack narratives and providing remediation recommendations.
Exam version: V3
Exam series code: PT0-003
Launch date: December 17, 2024
Number of questions: maximum of 90, including multiple-choice and performance-based questions
Length of test: 165 minutes
Passing score: 750 (on a scale of 100–900)
Recommended experience: 3–4 years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge
Languages: English on release; other languages TBD
Retirement of the previous exam: June 17, 2025
Retirement: Usually three years after launch(estimated 2027)