CompTIA PenTest+ Readiness: Prove the Attack Path, On Paper and In Practice
Signature Course No. 441 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's CompTIA PenTest+ Readiness: Prove the Attack Path, On Paper and In Practice course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
Nothing in this course teaches or encourages unauthorized access. Every offensive scenario in these pages sits inside a signed scope: a named client, named assets, named methods, named dates, and a named person who can halt the work. Where a scenario asks what a tester should do next, the first question is always whether the scope permits the move — and where the scope is silent, the answer is to stop and get the amendment in writing, however strong the technical opportunity looks. That is not caution pasted over the material. On the examination, and in the profession, authorization discipline is the material.
It starts with the scope. You will learn to read a scope the way a lawyer reads a contract and a tester reads a map at the same time; to tell passive information from active contact, and a scanner's lead from a proven finding; to weigh severity by consequence and conditions rather than by a label; to name the class of an attack from a described symptom and choose the mildest proof that settles the question; to follow a path from first foothold to stated objective and say exactly what each step proved; and to write the finding, the executive summary, and the retest verdict in language that survives a skeptical reader.
It works in two movements. First, Module 1 — Scope It, See It, Sort It — work through Concepts 1–9, finishing with The Engagement File; then, Module 2 — Prove the Path, Then Write It So It Stays Proved — work through Concepts 10–18, finishing with The Attack-Path Brief and Report.
Both capstones produce real artifacts — the engagement file for one Ironwick Security engagement, a test of a regional cold-storage and food-logistics operator: the scope analysis, the rules of engagement, and the discovery-and-analysis packet a lead could run the engagement from; and the attack-path brief and client report, with its remediation and retest plan — the path argued at exactly the strength its evidence earns, and the readiness page that judges the learner by the same standard. Both are written to be usable on the real job, not just in the course.
The honesty standard is part of the course. This is a readiness course, not a promise: no book, coach, or practice set can guarantee that you will pass an examination you have not yet sat. What it certifies is narrower and more useful — that you have worked every domain of the published outline on fresh problems and can judge your readiness on timed evidence rather than hope. Examinations are revised: before you sit, verify the current exam version, objectives, and candidate guidance against CompTIA's own published pages. The book names attack classes and weakness families only at the level the published blueprint names them — it gives no operating procedure for any attack and no tool walkthroughs, because the blueprint tests recognition, reasoning, and restraint.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
CompTIA PenTest+ Readiness: Prove the Attack Path, On Paper and In Practice is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with authorization. Think of any system you have legitimate access to at work and say who, exactly, could authorize a stranger to attack it — and how you know that person holds that authority; take a scope that names “the company's web presence” and list three different things a tester might honestly believe that phrase covers, and the risk each reading carries; and mid-engagement, facing an unlisted system that looks badly exposed, write the two sentences you would send before touching it — and name what you would do if no reply came. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Engagement File for Module 1 and The Attack-Path Brief and Report for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
No scope, no test — and no finding without evidence that can carry it. An examination candidate meets penetration testing the way the blueprint presents it: as a sequence of short, pressured decisions. May you touch this system? Does this record prove that weakness? The scanner says critical — do you report it as critical? Every concept is taught at examination depth: short stems, competing plausible answers, and the discipline of eliminating the options that break a rule, skip a step, or claim more than the evidence holds.
Module 1 builds the engagement's lawful frame. Authorization before everything; the rules of engagement as the contract for how you may work; reading the blueprint and the question; reconnaissance judgment — what the public record proves; enumeration judgment — mapping what answers; discovery output treated as a lead, not a finding; severity in context; the human surface; and the physical and wireless doors candidates most often forget.
Module 2 spends that frame on the path and the report. Attack-path reasoning — from weaknesses to a path; web and application attack classes — name the class, choose the proof; identity, privilege, and escalation reasoning; persistence and lateral movement — what staying and moving prove; cloud, APIs, and the modern estate; evidence discipline; the report — findings a client can act on; remediation, retest, and closure; and readiness, judged honestly, on timed evidence over hope.
And it holds its boundary throughout. The craft of penetration testing itself — how an authorized tester plans an engagement and validates a weakness at the mildest level that proves it — is taught in its own neighboring course, No. 283, Ethical Hacking and Penetration Testing. This course owns the examination: the judgment the blueprint tests when it hands you a short scenario and four plausible actions and asks which one a disciplined tester takes. The two share a profession. They do not share a lesson.
What you will learn
- Plan and scope an engagement: authorization, rules of engagement, constraints, and the amendment discipline that keeps work lawful
- Read the current published blueprint and judge examination questions — stems, distractors, and performance-style tasks — on the evidence the stem actually gives
- Judge reconnaissance and enumeration: what a source proves, what contact costs, and where the scope line falls
- Turn discovery output into analyzed findings: severity, context, conditions, and the difference between a lead and a proof
- Reason about attack paths and post-exploitation concepts — classes, chains, persistence, and movement — at the level the blueprint tests, choosing the mildest sufficient proof
- Keep evidence to a professional standard and write the report a client can act on: findings, summaries, remediation guidance, and the retest verdict
Everything in the course
- All 18 concepts of CompTIA PenTest+ Readiness: Prove the Attack Path, On Paper and In Practice, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Engagement File and The Attack-Path Brief and Report
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for professionals who must prove judgment, not just claim it
Working testers and security staff — who do authorized assessment work, or support the people who do, and need the credential that states it; and security analysts moving toward offensive work who know the defensive side of the log and want the tester's judgment, examined to the blueprint's standard.
Career changers with a security foundation — who hold an entry credential or equivalent experience and are aiming at the intermediate, hands-on-judgment rung PenTest+ occupies.
Consultants and internal red-team members — whose clients and employers ask for the credential by name, and who need their engagement habits — scope, evidence, reporting — to match what the examination rewards. This course assumes a working foundation: networking and security fundamentals at the level an entry security credential teaches, comfort reading logs and system descriptions, and enough exposure to assessment work to recognize the situations the examination describes. It does not assume you have led an engagement.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Authorization Before Everything
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
CompTIA PenTest+ Readiness: Prove the Attack Path, On Paper and In Practice is Signature Course No. 441. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.