Plain-English definitions of the terms that come up most often in CompTIA PenTest+ (PT0-003) study, grouped loosely by the five official domains. Definitions are simplified for learning and describe concepts rather than operational steps; the official exam objectives are authoritative.
| Term | Definition |
|---|---|
| Penetration test | An authorised, scoped simulation of an attack that finds and reports weaknesses so an organisation can fix them. |
| Rules of engagement (RoE) | The written agreement that defines what may be tested, when, from where, by whom, and what is off-limits. |
| Scoping | Deciding which addresses, applications, cloud tenants or sites are in and out, and which techniques are permitted. |
| Scope creep | Testing beyond the agreed targets or techniques; the correct response is to stop and get written authorisation. |
| Statement of work (SOW) | The document that defines deliverables, timeline and commercial terms for an engagement. |
| Master service agreement (MSA) | The standing contract that sets the ongoing legal relationship between tester and client. |
| Non-disclosure agreement (NDA) | A contract that protects the confidential information a tester learns during an engagement. |
| Authorisation | Written permission from someone empowered to grant it, obtained before any testing begins. |
| Third-party authorisation | Extra approval needed when assets are hosted or managed by another provider whose own policy applies. |
| De-confliction | Coordinating with the defensive team so testing traffic is not mistaken for a real incident. |
| Stop condition | A pre-agreed trigger that pauses or halts a test, such as an outage or evidence of a prior breach. |
| Known-environment testing | Testing where the client shares full information (formerly “white box”); more coverage, less realism. |
| Unknown-environment testing | Testing with little or no shared information (formerly “black box”); more realistic, less thorough. |
| Threat model | The attacker being simulated (external, insider, compromised employee) that sets the starting position. |
| Attestation of findings | A short signed statement of what was tested and when, often passed by a client to an auditor. |
| Executive summary | The non-technical opening of a report that states business risk for leadership. |
| Retest | A follow-up check confirming that reported findings were actually fixed. |
| Passive reconnaissance | Gathering information without sending traffic to the target, using public and third-party sources. |
| Active reconnaissance | Sending traffic to the target to see what responds; detectable and legitimate only in scope. |
| OSINT | Open-source intelligence: information collected from public records, documents, code and social media. |
| Enumeration | Building out detail on a discovered system: services, versions, shares, users, domains and cloud assets. |
| Service enumeration | Identifying listening services and their software versions on a host. |
| Attack surface | Everything exposed that an attacker could interact with; the map that guides the next phase. |
| Vulnerability scan | An automated check that compares a system against a database of known weaknesses. |
| Credentialed scan | A scan that authenticates, seeing patch and configuration state with far fewer false positives. |
| Non-credentialed scan | A scan run without login, seeing only what an unauthenticated attacker would. |
| False positive | A reported weakness that is not actually exploitable; wastes client time and hurts credibility. |
| False negative | A real weakness the scan missed; leaves a genuine hole out of the report. |
| Validation | Manually confirming a scanner finding is real before it goes in the report. |
| CVE | Common Vulnerabilities and Exposures: a catalogue identifier for a specific known vulnerability. |
| CVSS | Common Vulnerability Scoring System: a 0-10 severity score used as one input to prioritisation. |
| Prioritisation | Ranking findings by exposure, asset value and real exploitability, not by CVSS score alone. |
| On-path attack | Intercepting communication between two parties (formerly “man-in-the-middle”). |
| Injection | A class of web flaw where untrusted input is processed as a command by the application. |
| Cross-site scripting (XSS) | A web flaw that lets an attacker run script in another user’s browser session. |
| Broken access control | A flaw where users can reach data or actions that should be restricted to others. |
| Server-side request forgery (SSRF) | A flaw where a server can be induced to make requests to systems the attacker cannot reach directly. |
| BOLA | Broken Object Level Authorisation: an API flaw exposing objects a user should not be able to see. |
| Evil twin | A rogue wireless access point that imitates a legitimate one to intercept connections. |
| Social engineering | Manipulating people to bypass controls; in a test it must be explicitly authorised in writing. |
| Phishing | A social-engineering technique using fake messages to obtain credentials or access. |
| Privilege escalation | Gaining higher access than granted: vertical (higher level) or horizontal (another account, same level). |
| Lateral movement | Reaching further systems after an initial foothold by reusing trust relationships. |
| Pivoting | Routing through a compromised host to reach a network segment not directly accessible. |
| Persistence | A mechanism that keeps access after a reboot; in a test it must be agreed and removed at cleanup. |
| Data exfiltration | Moving data out of the target; in a test it is minimised, evidenced and handled under agreed rules. |
| Detection avoidance | Behaving so activity blends into normal administration; the client learns whether monitoring noticed. |
| Cleanup | Removing accounts, tools, files and changes made during a test and restoring the original state. |
| Performance-based question (PBQ) | An exam item that asks you to complete or interpret a task rather than pick a definition. |
| CompTIA CE program | The continuing-education scheme that keeps the certification valid for its three-year term. |