Identifying the Penetration Testing Framework with 14 Components
Short answer
B OSSTMM is the framework that breaks the security testing life cycle into 14 components or channels.
Question
Key Takeaways
The main trap is confusing MITRE ATT&CK's 14 tactics with OSSTMM's 14 testing channels; the question tests knowledge of testing methodologies, not threat intelligence matrices.
This page explains why OSSTMM is the correct answer for the PenTest+ question regarding the framework with 14 components, distinguishing it from MITRE ATT&CK's 14 tactics.
Common mistake: Candidates often select MITRE ATT&CK because it famously lists 14 tactics. However, ATT&CK models adversary actions, whereas OSSTMM defines the structure of the penetration testing engagement itself.
Expert Analysis
The question asks to identify a framework that breaks the life cycle into 14 components. This requires distinguishing between frameworks based on their specific structural definitions within the CompTIA PenTest+ curriculum.
OSSTMM (Open Source Security Testing Methodology Manual) is the correct answer. It is a comprehensive testing methodology that structures security testing around 14 distinct channels (or components). These include Information, Data, Systems, Human, Wireless, Physical, and Databases, among others. In the context of the PT0-003 exam, OSSTMM is specifically associated with this "14 component" structure for organizing penetration test activities.
MITRE ATT&CK is a common distractor because it organizes adversary behavior into 14 tactics (e.g., Initial Access, Execution, Persistence). However, ATT&CK is an attack knowledge base used for modeling threats and post-exploitation analysis, not a penetration testing lifecycle methodology that breaks down the engagement itself into 14 operational components. The confusion arises from the number "14," but the semantic difference between "tactics" (ATT&CK) and "testing channels/components" (OSSTMM) is critical.
OWASP MASVS is a mobile application security verification standard, not a general lifecycle framework with 14 components. CREST is a professional body for certification and accreditation of cyber security professionals, not a technical testing framework or methodology manual.
Therefore, the framework defined by its 14-component structure for testing engagements is OSSTMM.
Exam Strategy
When faced with questions about framework structures, pay close attention to the specific terminology used in the options. For PenTest+, memorize the unique identifiers for each major framework: OSSTMM has 14 channels, NIST SP 800-115 has three phases (Preparation, Detection, Attack), and OWASP Top 10 lists the most critical web risks. Do not assume any framework with a numbered list is the same; differentiate between 'tactics' (ATT&CK), 'channels' (OSSTMM), and 'phases' (NIST/PTES).
Frequently Asked Questions
Why isn't MITRE ATT&CK the correct answer if it has 14 items?
What are the 14 components in OSSTMM?
Is CREST a testing framework?
Community Votes
67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
56f412f 👍 5 Answered BFor the CompTIA PenTest+ (PT0-003) exam, the intended correct answer is ✅ b. osstmm. While it is a well-known technical fact that MITRE ATT&CK contains 14 tactics, the CompTIA exam curriculum specifically associates the Open Source Security Testing Methodology Manual (OSSTMM) with a lifecycle or methodology that comprises 14 components/categories for a penetration testing engagement.
-
stinkle 👍 3 Answered CCOMPARISON TABLE Option What it is Structure / Framework OWASP MASVS Mobile security standard Requirement categories OSSTMM Testing methodology Testing channels MITRE ATT&CK Attack behavior model 14 tactics CREST Certification body None FINAL MEMORY HOOKS (EXAM GOLD) “14 stages / tactics” → MITRE ATT&CK “Mobile app requirements” → OWASP MASVS “Testing methodology” → OSSTMM “Certifying testers” → CREST
-
56f412f 👍 2 Answered B🧠 Final Verdict for Exam 👉 Correct Answer for PenTest+ (PT0-003): ✅ B. OSSTMM ❌ MITRE ATT&CK is NOT the correct answer for this question in the exam context 🔥 Why Google’s explanation looks convincing (but is wrong for THIS question) Yes, the statement about MITRE ATT&CK having 14 tactics is factually true. But the question is asking: “framework that breaks the life cycle into 14 components for a penetration testing engagement” 👉 That wording maps to a testing methodology, not an attacker behavior matrix
-
1d7f84b 👍 2 Answered B🔑 Exam Bottom Line: • OSSTMM → 14 components / structured penetration testing methodology • MITRE ATT&CK → attack techniques database • OWASP MASVS → mobile security standard • CREST → certification, not a testing framework
-
HeatSquad77 👍 1 Answered B✅ B. OSSTMM Why: The Open Source Security Testing Methodology Manual (OSSTMM) is a penetration testing framework and methodology that breaks security testing activities into multiple phases and components throughout the engagement lifecycle. The PenTest+ exam commonly references OSSTMM as having 14 channels/components used to structure testing activities.
Show 1 more comment
-
sneeed 👍 1 Answered CC. MITRE ATT&CK The ATT&CK Enterprise matrix breaks the adversary life cycle into 14 tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PT0-003 Questions
Access 120 questions with complete answers and detailed explanations.
View Full PT0-003 Practice Test →