CompTIA PenTest+ PT0-003 — Lesson 2: Reconnaissance, Enumeration, Vulnerability Discovery, and Attack Planning

Learning Objectives

• Explain the roles, prerequisites, dependencies, and decision points shaping reconnaissance, enumeration, vulnerability discovery, and attack planning.
• Complete the workflow and produce validated attack-surface and vulnerability register that another practitioner can review.
• Resolve “an unauthenticated scan misses the highest-risk configuration weakness” through a controlled and evidence-led troubleshooting process.

Detailed Topics

• passive reconnaissance
• active discovery
• service enumeration
• vulnerability scanning
• credential exposure
• attack surface mapping
• false positives
• prioritization
• Security, performance, resilience, rollback, documentation, and support considerations for reconnaissance, enumeration, vulnerability discovery, and attack planning

Instructor Demonstration

The instructor demonstrates the complete reconnaissance, enumeration, vulnerability discovery, and attack planning workflow, records each material checkpoint in validated attack-surface and vulnerability register, and contrasts the accepted state with a controlled condition where an unauthenticated scan misses the highest-risk configuration weakness.

Hands-On Exercise

Implement or analyze Reconnaissance, Enumeration, Vulnerability Discovery, and Attack Planning in a controlled environment. Establish a baseline, reproduce or examine “an unauthenticated scan misses the highest-risk configuration weakness,” isolate the proven cause, apply a reversible correction, and retain the accepted outcome in validated attack-surface and vulnerability register.

1. Confirm scope, access, dependencies, expected behavior, and safety constraints.
2. Execute the planned workflow while preserving configuration and operational checkpoints.
3. Test an expected path, a boundary condition, and the identified failure or exception.
4. Retest after correction and document rollback, ownership, escalation, and preventive action.

Scenario Analysis

• Identify the requirement with the greatest influence on reconnaissance, enumeration, vulnerability discovery, and attack planning.
• Compare two valid implementation or recovery choices using impact and evidence quality.
• Explain how the validated attack-surface and vulnerability register should be retained and transferred to the operational owner.

Troubleshooting Guidance

Start with effective configuration, recent changes, identities, connectivity, health, logs, and timing. Use validated attack-surface and vulnerability register to locate the earliest divergence between intended and observed behavior. Treat “an unauthenticated scan misses the highest-risk configuration weakness” as a hypothesis until the corrected path passes the original test and a relevant boundary test.

Validation Checklist

• The implemented state for reconnaissance, enumeration, vulnerability discovery, and attack planning is traceable to approved requirements and inputs.
• The validated attack-surface and vulnerability register contains baseline, test, exception, correction, and accepted-result evidence.
• Security, data handling, capacity, performance, resilience, downstream impact, and rollback were considered where relevant.
• Monitoring, escalation, recovery, documentation, and support ownership are clear.

Lesson Outcome

Learners can apply Reconnaissance, Enumeration, Vulnerability Discovery, and Attack Planning, explain the decisions made, and defend the result with validated attack-surface and vulnerability register.