About This Domain
Domain 3 — Attacks and Exploits — accounts for 30% of the PENTEST certification exam. This domain evaluates your understanding of network attacks, application exploits (sqli, xss), wireless attacks, and related concepts. Execution of attacks and exploits. To pass this section you need practical knowledge of how these technologies work together.
What You'll Be Tested On
- Network attacks
- Application exploits (SQLi, XSS)
- Wireless attacks
- Social engineering
- Post-exploitation and pivoting
Key Technologies in This Domain
Study Strategy for Domain 3
At 30% of the exam, this is the highest-weighted domain — invest proportionally more study time here.
Exam Tips for Domain 3
This is 30% — know attack tools (Metasploit, Burp Suite, John the Ripper) and techniques.
Frequently Asked Questions
How many questions come from Domain 3?
Domain 3 (Attacks and Exploits) makes up 30% of the PENTEST exam.
What should I focus on for Domain 3?
Key topics include Attacks & Exploits.
How should I prepare for Attacks and Exploits questions?
Review key topics, then practice with domain-specific questions focusing on real-world scenarios.
What's the best order to study PENTEST domains?
Start with highest-weighted: Planning and Scoping (14%), Information Gathering and Vulnerability Scanning (22%), Attacks and Exploits (30%), Reporting and Communication (18%).
Practice Domain 3 Questions
Test your knowledge of Attacks and Exploits with practice questions from our PENTEST question bank.
Start Practice Quiz →