I've been taking a lot of notes for PenTest+. Unfortunately, having something written down and being able to remember it are two different things. The notes keep growing, too.
So, flashcards! The final course notes now have 602 cards here, after adding the missing concepts and pruning trivial or repeated questions. I broke the material into short questions because I want to practice a concept, not memorize a paragraph. I'll be studying with these myself and revising them as I go.
How to study this deck
Have a go before revealing the answer. Again means you missed it, Hard means it took some work, Good means you knew it, and Easy means you barely had to think. Again brings the card back in ten minutes. The others give you longer before you see it again.
Cards due for review come first, then new ones. You can pick a single topic or use Browse all to look something up without affecting your schedule.
You can start without signing in. Those reviews stay in this browser. If you're going to be moving between devices (I am), sign in with an email code to save progress to your account. Guest progress doesn't transfer when you sign in.
There's also an optional checkbox for emails when I add resources. Getting a sign-in code doesn't put you on the mailing list. You can unsubscribe or delete your account in the study settings.
What is in the deck?
The 31 topics cover scope and agreements, ethics, evidence, risk, frameworks, reporting, reconnaissance, network evidence, vulnerability assessment, wireless and physical security, cryptography, web security, scripting, and credential defenses. The newer cards also cover network, cloud, authentication and host-based threats, social engineering, specialized systems, persistence and lateral movement awareness, data protection, cleanup, remediation, and post-exploitation evidence interpretation.
Some of the questions are definitions. Others are about the little distinctions that matter:
- Authentication versus authorization: knowing who made a request does not establish permission to read an object or change it.
- CVE versus CWE: one identifies a specific disclosed vulnerability; the other describes a class of weakness.
- A banner versus a verified version: software identification is evidence to corroborate, not automatic proof of a vulnerability.
- A scan result versus business risk: technical severity needs context before it determines remediation order.
Listen hands free
Choose Listen hands free and press Start listening once. The page reads each question, pauses, reads its answer, then moves to the next pair. Pick a topic or search to narrow the queue. Voice & pacing lets you choose a device voice, speed, answer pause, and whether to loop the cards.
Pause or resume whenever you need; the arrow buttons skip pairs. Listening does not grade cards or change your review schedule. Keep the page open and the device unlocked. The page keeps the screen awake where supported; background and lock-screen speech depend on your browser.
Your study progress
Study the deck here with spaced review and visible intervals. Under Deck tools, you can export a backup of your review progress. This backup contains your schedule and review history, not the card questions and answers.
About the source material
These come from my PenTest+ PT0-003 notes, reviewed through October 4, 2026. The questions and explanations were written for this deck. Each answer names its source note so I can find the relevant material when something needs a correction.
This isn't an official CompTIA deck or a complete exam checklist. It also doesn't contain practice-exam questions or lab answer keys. The attack-related cards cover concepts, evidence and defenses; you'll still need an authorized lab for hands-on practice.
Some lessons refer to older material, and a few claims in the notes needed checking. I've left those out or qualified them. For the exam scope, check CompTIA; for the classifications that keep changing, there's OWASP and MITRE ATT&CK. The source audit includes the final course notes, with personal lab details and answer keys excluded.