Chapter 5 of 5 · CompTIA PenTest+ PT0-003
Post-Exploitation and Lateral Movement
Persistence, pivoting, cleanup and documenting attack paths with remediation.
- 5topics
- 24 minfast track
- 1diagrams and exhibits
- 14%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Persistence ConceptsUnderstand how attackers and testers keep access after exploitation: persistence on Windows, Linux and cloud systems, plus how to…5 min
- 2Lateral Movement and PivotingUnderstand lateral movement and pivoting after a foothold: remote services, credential reuse, tunnelling concepts, detection and…Diagram6 min
- 3Cleanup and RestorationLearn how testers clean up after a penetration test: removing tools and accounts, restoring settings, handling data and…4 min
- 4Documentation and Attack NarrativesDocument a penetration test as you go, write an attack narrative with MITRE ATT&CK mapping, and turn evidence into prioritised…5 min
- 5Staging and ExfiltrationUnderstand staging and exfiltration: covert channels over DNS, ICMP and HTTPS, alternate data streams, cloud paths and the…4 min
About this chapter
What this chapter covers
Post-exploitation is what happens once a tester has a foothold. It shows what an attacker could do next, and it ends with a clean environment and a clear record.
The chapter follows the fifth domain of the CompTIA PenTest+ PT0-003 outline. It covers how access is kept and extended, how the tester removes what was added, and how the whole story is documented with advice for fixing it.
It has two outline topics, and they are spread across four pages: three for post-exploitation activities and one for documentation.
How the topics fit together
The pages follow the order of the work after a foothold.
- Persistence shows how access could survive restarts and password changes.
- Lateral movement and pivoting show how one host leads to many.
- Cleanup removes tools, accounts and changes, and returns systems to their original state.
- Documentation turns the work into an attack narrative and prioritised remediation.
Persistence and pivoting change the client's systems, so they happen only when the rules of engagement allow them, and each change must be logged for cleanup.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read these pages with a defender's eye. For each technique, ask how it would be noticed and which control would stop it, because the exam and the report both need the remediation side.
Ready for more practice?
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.