Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
Instructor Manual Chapter 1
Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1:
Introduction to Penetration Testing
TABLE OF CONTENTS
Purpose and Perspective of the Chapter......................................................................2
Chapter Objectives........................................................................................................3
Teaching Tips................................................................................................................3
The Ins and Outs of Penetration Testing....................................................................................................3
What Is Penetration Testing?................................................................................................................. 3
Why Do Security Professionals Pen Test?.............................................................................................4
When Do Security Professionals Conduct Pen Tests?...........................................................................4
How Do Security Professionals Pen Test?.............................................................................................4
Who Performs Pen Tests?......................................................................................................................5
CIA, DAD, and the Hacker Mindset..........................................................................................................5
The Hacker Mindset and Ethical Hacking............................................................................................. 5
Ethical Hacking Guidelines...................................................................................................................6
The Pen-Test Teams and Other Stakeholders............................................................................................ 6
Red Team............................................................................................................................................... 7
Blue Team..............................................................................................................................................7
Purple Team........................................................................................................................................... 7
Other Stakeholders.................................................................................................................................7
The Pen-Test Process.................................................................................................................................8
Planning and Scoping............................................................................................................................ 9
Information Gathering and Vulnerability Scanning..............................................................................9
Attacking and Exploiting....................................................................................................................... 9
Reporting and Communicating Results...............................................................................................10
The Cyber Kill Chain...............................................................................................................................10
The Pen-Test Toolkit...............................................................................................................................11
Scanners............................................................................................................................................... 11
Credential Testing Tools......................................................................................................................11
Debuggers............................................................................................................................................ 11
Open Source Intelligence..................................................................................................................... 12
Wireless Tools..................................................................................................................................... 12
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 1
website, in whole or in part.
, Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
Web Application Tools........................................................................................................................ 12
Social Engineering Tools.....................................................................................................................12
Remote Access Tools...........................................................................................................................13
Network Tools..................................................................................................................................... 13
Exploitation Tools................................................................................................................................13
Steganography Tools........................................................................................................................... 14
Cloud Tools..........................................................................................................................................14
Appendix.....................................................................................................................15
Generic Rubrics....................................................................................................................................... 15
Standard Writing Rubric.......................................................................................................................... 15
Standard Discussion Rubric.....................................................................................................................16
PURPOSE AND PERSPECTIVE OF THE CHAPTER
The purpose of this chapter is to introduce students to the foundational concepts of penetration testing
(pen testing) within the context of modern cybersecurity practice and the CompTIA PenTest+ (PT0-003)
exam objectives. Students are introduced to penetration testing as an authorized, methodical approach to
identifying and exploiting vulnerabilities in systems, networks, applications, and physical environments.
The chapter establishes core terminology and frames penetration testing within legal, ethical, and
professional boundaries. High-level models such as the CIA and DAD triads, the hacker mindset,
red/blue/purple team roles, and the CompTIA four-phase pen-test process are presented to provide a
structured understanding of how penetration testing supports organizational security posture.
This chapter also emphasizes that penetration testing is not simply technical hacking but a disciplined
process requiring planning, scope definition, rules of engagement, stakeholder coordination, and
professional reporting. Students gain perspective on how ethical hackers operate within legal constraints,
how penetration testing aligns with compliance requirements such as PCI DSS, and how models like the
Cyber Kill Chain inform both offensive and defensive security strategies. By the end of the chapter,
students should understand the purpose, structure, stakeholders, methodology, and tools of penetration
testing, forming the conceptual foundation for deeper technical exploration in subsequent chapters.
[return to top]
CHAPTER OBJECTIVES
The following objectives are addressed in this Chapter:
1. Describe the penetration testing process and its phases, activities, and team members.
2. Describe the CIA and DAD triads.
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 2
website, in whole or in part.
, Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
3. Describe the ethical hacking mindset.
4. Describe some of the tools used in penetration testing.
[return to top]
TEACHING TIPS
Consider the following teaching tips when assigning this Chapter to your students:
THE INS AND OUTS OF PENETRATION TESTING
1. Explain that this chapter provides a foundational overview of penetration testing concepts that
students will revisit in greater technical depth throughout later chapters and lab activities.
2. Explain that penetration testing, also known as pen testing or ethical hacking, is an authorized
series of security-related, non-malicious attacks against clearly defined targets.
3. Discuss how the CompTIA PT0-003 domains organize penetration testing into structured
engagement phases that help students connect exam objectives to professional testing workflows.
4. Clarify the difference between vulnerability analysis and active exploitation so students
understand why identifying weaknesses and proving exploitability are related but distinct
activities.
5. Emphasize that written authorization and clearly defined scope are mandatory before testing
begins because penetration testing without permission can become illegal hacking activity.
6. Use Table 1-1 to explain how the PT0-003 exam reorganizes penetration-testing responsibilities
into broader operational domains that integrate reconnaissance, exploitation, reporting, and post-
exploitation activities throughout the engagement lifecycle.
What Is Penetration Testing?
1. Define key terms such as vulnerability, exploit, threat actor, and authorized attacker so students
can accurately distinguish weaknesses, attack methods, adversaries, and approved testers.
2. Explain that pen testers use many of the same tools and techniques as malicious attackers, but
they operate under authorization for defensive improvement purposes.
3. Reinforce that the goal of penetration testing is to improve an organization’s security posture by
identifying vulnerabilities before malicious threat actors can exploit them.
4. Highlight that exploitation during penetration testing is controlled, documented, and limited by
scope so students understand that proof of weakness must not become unnecessary harm.
5. Use practical examples to demonstrate the difference between a vulnerability and an exploit,
emphasizing how a weakness becomes actionable only when someone can take advantage of it.
Why Do Security Professionals Pen Test?
1. Explain that penetration testing helps organizations eliminate or mitigate vulnerabilities before
malicious actors exploit them to damage systems, compromise data, or disrupt authorized access.
2. Discuss how penetration testing supports compliance requirements such as PCI DSS while also
improving operational risk management and overall security posture beyond checklist
obligations.
3. Reinforce that vulnerability discovery and exploitation validation are interconnected processes
because testers must identify weaknesses before responsibly confirming their potential business
impact.
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 3
website, in whole or in part.
, Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
4. Emphasize the value of regular and event-driven penetration testing, especially after major
system, software, application, or infrastructure changes that may introduce new vulnerabilities.
When Do Security Professionals Conduct Pen Tests?
1. Explain that penetration testing should occur after major infrastructure or software changes
because new systems, updates, and applications can introduce previously unknown security
weaknesses.
2. Discuss how scheduled testing helps maintain compliance and risk management standards by
verifying that security controls continue working as environments and threats change.
3. Reinforce that security is dynamic and periodic testing ensures continued protection by
identifying unknown changes, misconfigurations, or weaknesses before attackers exploit them.
How Do Security Professionals Pen Test?
1. Explain that penetration testers follow established methodologies that break security testing into
defined phases so assessments remain systematic, repeatable, ethical, and legally authorized.
2. Emphasize that the CompTIA pen-testing methodology includes planning and scoping,
information gathering and vulnerability scanning, attacking and exploiting, and reporting and
communication.
Who Performs Pen Tests?
1. Explain that penetration tests are conducted by authorized attackers who simulate real-world
threats to evaluate whether an organization’s security controls can resist meaningful attack
attempts.
2. Clarify that these testers may be internal employees from IT or security departments or external
third-party consultants hired to perform independent security assessments.
3. Discuss that penetration testers typically possess specialized cybersecurity knowledge and
technical skills, including vulnerability analysis, network security, system administration, and
exploitation techniques.
4. Emphasize that penetration testers conduct controlled tests on systems, networks, web
applications, and physical environments to identify weaknesses before malicious attackers can
exploit them.
5. Reinforce that testers must document findings and provide recommendations to management and
technical teams so organizations can remediate vulnerabilities and improve security posture.
6. Use Activity 1-1 to demonstrate that organizations seek penetration testers who possess both
technical offensive-security skills and professional communication abilities needed to document
findings and collaborate with stakeholders.
CIA, DAD, AND THE HACKER MINDSET
1. Draw the CIA and DAD triads on the board and visually map how confidentiality, integrity, and
availability are opposed by disclosure, alteration, and destruction.
2. Use relatable analogies such as confidentiality as keeping secrets, integrity as preserving an
unchanged message, and availability as ensuring services remain accessible when needed.
3. Explain how the DAD triad represents adversarial objectives by showing students how attackers
attempt to undermine each protective goal represented by the CIA triad.
4. Reinforce that effective penetration testers must understand attacker goals so they can anticipate
likely weaknesses, attack paths, and consequences during authorized assessments.
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 4
website, in whole or in part.
Testing
Instructor Manual Chapter 1
Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1:
Introduction to Penetration Testing
TABLE OF CONTENTS
Purpose and Perspective of the Chapter......................................................................2
Chapter Objectives........................................................................................................3
Teaching Tips................................................................................................................3
The Ins and Outs of Penetration Testing....................................................................................................3
What Is Penetration Testing?................................................................................................................. 3
Why Do Security Professionals Pen Test?.............................................................................................4
When Do Security Professionals Conduct Pen Tests?...........................................................................4
How Do Security Professionals Pen Test?.............................................................................................4
Who Performs Pen Tests?......................................................................................................................5
CIA, DAD, and the Hacker Mindset..........................................................................................................5
The Hacker Mindset and Ethical Hacking............................................................................................. 5
Ethical Hacking Guidelines...................................................................................................................6
The Pen-Test Teams and Other Stakeholders............................................................................................ 6
Red Team............................................................................................................................................... 7
Blue Team..............................................................................................................................................7
Purple Team........................................................................................................................................... 7
Other Stakeholders.................................................................................................................................7
The Pen-Test Process.................................................................................................................................8
Planning and Scoping............................................................................................................................ 9
Information Gathering and Vulnerability Scanning..............................................................................9
Attacking and Exploiting....................................................................................................................... 9
Reporting and Communicating Results...............................................................................................10
The Cyber Kill Chain...............................................................................................................................10
The Pen-Test Toolkit...............................................................................................................................11
Scanners............................................................................................................................................... 11
Credential Testing Tools......................................................................................................................11
Debuggers............................................................................................................................................ 11
Open Source Intelligence..................................................................................................................... 12
Wireless Tools..................................................................................................................................... 12
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 1
website, in whole or in part.
, Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
Web Application Tools........................................................................................................................ 12
Social Engineering Tools.....................................................................................................................12
Remote Access Tools...........................................................................................................................13
Network Tools..................................................................................................................................... 13
Exploitation Tools................................................................................................................................13
Steganography Tools........................................................................................................................... 14
Cloud Tools..........................................................................................................................................14
Appendix.....................................................................................................................15
Generic Rubrics....................................................................................................................................... 15
Standard Writing Rubric.......................................................................................................................... 15
Standard Discussion Rubric.....................................................................................................................16
PURPOSE AND PERSPECTIVE OF THE CHAPTER
The purpose of this chapter is to introduce students to the foundational concepts of penetration testing
(pen testing) within the context of modern cybersecurity practice and the CompTIA PenTest+ (PT0-003)
exam objectives. Students are introduced to penetration testing as an authorized, methodical approach to
identifying and exploiting vulnerabilities in systems, networks, applications, and physical environments.
The chapter establishes core terminology and frames penetration testing within legal, ethical, and
professional boundaries. High-level models such as the CIA and DAD triads, the hacker mindset,
red/blue/purple team roles, and the CompTIA four-phase pen-test process are presented to provide a
structured understanding of how penetration testing supports organizational security posture.
This chapter also emphasizes that penetration testing is not simply technical hacking but a disciplined
process requiring planning, scope definition, rules of engagement, stakeholder coordination, and
professional reporting. Students gain perspective on how ethical hackers operate within legal constraints,
how penetration testing aligns with compliance requirements such as PCI DSS, and how models like the
Cyber Kill Chain inform both offensive and defensive security strategies. By the end of the chapter,
students should understand the purpose, structure, stakeholders, methodology, and tools of penetration
testing, forming the conceptual foundation for deeper technical exploration in subsequent chapters.
[return to top]
CHAPTER OBJECTIVES
The following objectives are addressed in this Chapter:
1. Describe the penetration testing process and its phases, activities, and team members.
2. Describe the CIA and DAD triads.
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 2
website, in whole or in part.
, Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
3. Describe the ethical hacking mindset.
4. Describe some of the tools used in penetration testing.
[return to top]
TEACHING TIPS
Consider the following teaching tips when assigning this Chapter to your students:
THE INS AND OUTS OF PENETRATION TESTING
1. Explain that this chapter provides a foundational overview of penetration testing concepts that
students will revisit in greater technical depth throughout later chapters and lab activities.
2. Explain that penetration testing, also known as pen testing or ethical hacking, is an authorized
series of security-related, non-malicious attacks against clearly defined targets.
3. Discuss how the CompTIA PT0-003 domains organize penetration testing into structured
engagement phases that help students connect exam objectives to professional testing workflows.
4. Clarify the difference between vulnerability analysis and active exploitation so students
understand why identifying weaknesses and proving exploitability are related but distinct
activities.
5. Emphasize that written authorization and clearly defined scope are mandatory before testing
begins because penetration testing without permission can become illegal hacking activity.
6. Use Table 1-1 to explain how the PT0-003 exam reorganizes penetration-testing responsibilities
into broader operational domains that integrate reconnaissance, exploitation, reporting, and post-
exploitation activities throughout the engagement lifecycle.
What Is Penetration Testing?
1. Define key terms such as vulnerability, exploit, threat actor, and authorized attacker so students
can accurately distinguish weaknesses, attack methods, adversaries, and approved testers.
2. Explain that pen testers use many of the same tools and techniques as malicious attackers, but
they operate under authorization for defensive improvement purposes.
3. Reinforce that the goal of penetration testing is to improve an organization’s security posture by
identifying vulnerabilities before malicious threat actors can exploit them.
4. Highlight that exploitation during penetration testing is controlled, documented, and limited by
scope so students understand that proof of weakness must not become unnecessary harm.
5. Use practical examples to demonstrate the difference between a vulnerability and an exploit,
emphasizing how a weakness becomes actionable only when someone can take advantage of it.
Why Do Security Professionals Pen Test?
1. Explain that penetration testing helps organizations eliminate or mitigate vulnerabilities before
malicious actors exploit them to damage systems, compromise data, or disrupt authorized access.
2. Discuss how penetration testing supports compliance requirements such as PCI DSS while also
improving operational risk management and overall security posture beyond checklist
obligations.
3. Reinforce that vulnerability discovery and exploitation validation are interconnected processes
because testers must identify weaknesses before responsibly confirming their potential business
impact.
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 3
website, in whole or in part.
, Instructor Manual: Wilson, CompTIA PenTest+ Guide to Penetration Testing, 2027, 9798214410111; Chapter 1: Introduction to Penetration
Testing
4. Emphasize the value of regular and event-driven penetration testing, especially after major
system, software, application, or infrastructure changes that may introduce new vulnerabilities.
When Do Security Professionals Conduct Pen Tests?
1. Explain that penetration testing should occur after major infrastructure or software changes
because new systems, updates, and applications can introduce previously unknown security
weaknesses.
2. Discuss how scheduled testing helps maintain compliance and risk management standards by
verifying that security controls continue working as environments and threats change.
3. Reinforce that security is dynamic and periodic testing ensures continued protection by
identifying unknown changes, misconfigurations, or weaknesses before attackers exploit them.
How Do Security Professionals Pen Test?
1. Explain that penetration testers follow established methodologies that break security testing into
defined phases so assessments remain systematic, repeatable, ethical, and legally authorized.
2. Emphasize that the CompTIA pen-testing methodology includes planning and scoping,
information gathering and vulnerability scanning, attacking and exploiting, and reporting and
communication.
Who Performs Pen Tests?
1. Explain that penetration tests are conducted by authorized attackers who simulate real-world
threats to evaluate whether an organization’s security controls can resist meaningful attack
attempts.
2. Clarify that these testers may be internal employees from IT or security departments or external
third-party consultants hired to perform independent security assessments.
3. Discuss that penetration testers typically possess specialized cybersecurity knowledge and
technical skills, including vulnerability analysis, network security, system administration, and
exploitation techniques.
4. Emphasize that penetration testers conduct controlled tests on systems, networks, web
applications, and physical environments to identify weaknesses before malicious attackers can
exploit them.
5. Reinforce that testers must document findings and provide recommendations to management and
technical teams so organizations can remediate vulnerabilities and improve security posture.
6. Use Activity 1-1 to demonstrate that organizations seek penetration testers who possess both
technical offensive-security skills and professional communication abilities needed to document
findings and collaborate with stakeholders.
CIA, DAD, AND THE HACKER MINDSET
1. Draw the CIA and DAD triads on the board and visually map how confidentiality, integrity, and
availability are opposed by disclosure, alteration, and destruction.
2. Use relatable analogies such as confidentiality as keeping secrets, integrity as preserving an
unchanged message, and availability as ensuring services remain accessible when needed.
3. Explain how the DAD triad represents adversarial objectives by showing students how attackers
attempt to undermine each protective goal represented by the CIA triad.
4. Reinforce that effective penetration testers must understand attacker goals so they can anticipate
likely weaknesses, attack paths, and consequences during authorized assessments.
© 2027 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible 4
website, in whole or in part.
