Last updated September 2026
PenTest+ is not a 24-hour hacking marathon. It’s CompTIA’s penetration testing exam: multiple-choice and performance-based questions that cover the whole engagement, from scoping and rules of engagement through recon, exploitation, post-exploitation and the report. That makes it a different animal from OSCP, and you should know which one you need before you spend a dollar.
The current exam is PT0-003. It launched December 17, 2024, PT0-002 retired June 17, 2025, and CompTIA estimates PT0-003 will retire in 2027. Older V2 books and practice tests are the wrong material now.
PenTest+, CEH or OSCP? Decide first
These three get compared constantly, and they prove different things:
| PenTest+ (PT0-003) | CEH v13 (312-50) | OSCP+ | |
|---|---|---|---|
| Format | Up to 90 multiple-choice and performance-based questions | 125 multiple-choice questions (optional 6-hour practical for CEH Master) | 24-hour proctored hands-on exam |
| Time | 165 minutes | 4 hours | 24 hours |
| Eligibility | None required | Official training, or an approved application with 2 years of infosec experience and a $100 fee | None required |
| Exam price | $439 (US retail) | $950 remote-proctored voucher from EC-Council, plus the $100 application fee if self-study | $1,699 standalone exam attempt |
| Renewal | 3 years (60 CEUs, $150) | 3 years (120 ECE credits, $80 a year) | OSCP+ expires after 3 years; the OSCP title itself doesn’t expire |
Sources: CompTIA, EC-Council’s CEH page and exam voucher, and OffSec’s PEN-200/OSCP page.
- PenTest+ vs CEH: Both test knowledge more than hands-on hacking. PenTest+ is cheaper, has no eligibility process and adds performance-based questions. CEH is broader, well known, and recognized under DoD 8140 for several cyber defense work roles. See our CEH guide for details.
- PenTest+ vs OSCP: OSCP is the hands-on proof: OffSec’s exam gives you 24 hours to compromise three standalone machines (60% of the points) and an Active Directory set (40%). Many people take PenTest+ or CEH first for the structured knowledge, then OSCP when they can already root lab boxes comfortably. Our CEH vs PenTest+ vs OSCP comparison puts all three side by side.
- PenTest+ vs CySA+: Same CompTIA tier, opposite sides. CySA+ is detection and response; PenTest+ is attack and report. Pick the one that matches the job you want next.
- Before PenTest+: Network+ and Security+ (or equivalent knowledge), per CompTIA. Much later: CISSP if you move toward security leadership.
Who gets the most out of PenTest+
- SOC analysts and blue-teamers who want to understand the other side and move toward testing
- Junior testers who need a vendor-neutral credential to get past résumé filters
- Vulnerability management staff who score findings all day and want to know how they get exploited
- People aiming at OSCP who want a structured, cheaper checkpoint first
CompTIA recommends 3 to 4 years in a penetration tester role, with Network+ and Security+ or equivalent knowledge (CompTIA). You can register without it. But if you’re brand new to IT, PenTest+ is the wrong first cert. Build the networking and security base first; our Network+ guide is a good place to start.
PT0-003 by the numbers
| Item | Details |
|---|---|
| Exam code | PT0-003 (PenTest+ V3) |
| Launch date | December 17, 2024 |
| Previous exam | PT0-002 retired June 17, 2025 |
| Retirement | CompTIA estimates 2027 (its exams usually run about three years) |
| Number of questions | Up to 90, mixing multiple-choice and performance-based items |
| Time limit | 165 minutes |
| Passing score | 750 (scale of 100 to 900) |
| Languages | English, French, Japanese and Portuguese |
| Recommended experience | 3 to 4 years in a penetration tester role, with Network+ and Security+ or equivalent knowledge |
| Exam price (US) | $439 US retail (up from $425 on June 1, 2026) |
| Renewal | Three-year cycle: 60 CEUs and a $150 CE fee, or another CompTIA renewal route |
Sources: CompTIA’s PenTest+ page, CompTIA’s continuing education pages on CEUs and fees, and the June 2026 price change as published by authorized CompTIA partner Total Seminars. Confirm the price at checkout.
What the exam weighs
| Domain | Weight | What it covers |
|---|---|---|
| 1. Engagement management | 13% | Scoping, rules of engagement, testing windows, authorization letters, legal and ethical requirements, stakeholder communication, and reports with executive summaries and remediation |
| 2. Reconnaissance and enumeration | 21% | Passive and active recon, OSINT, sniffing, DNS, service and directory enumeration, tools such as Nmap, Wireshark and Shodan, and modifying Python, PowerShell and Bash scripts |
| 3. Vulnerability discovery and analysis | 17% | Authenticated and unauthenticated scans, SAST and DAST, validating findings and weeding out false positives, tools such as Nessus, Nikto and OpenVAS |
| 4. Attacks and exploits | 35% | Network attacks (VLAN hopping, on-path), authentication attacks (brute force, pass-the-hash, credential stuffing), host attacks (privilege escalation, credential dumping), web attacks (SQL injection, XSS, directory traversal), cloud attacks (container escapes, metadata services, IAM misconfiguration) and AI attacks (prompt injection, model manipulation) |
| 5. Post-exploitation and lateral movement | 14% | Persistence, lateral movement, cleaning up artifacts, attack narratives and remediation recommendations |
Attacks and exploits is 35% of the exam. But engagement management (13%) and post-exploitation and lateral movement (14%) together count for more than most technically strong candidates expect. Domain list and weights: CompTIA PenTest+ exam details.
Where good hackers lose points
- Scoping and legal questions. Engagement management is 13% of the exam. Questions about authorization letters, testing windows and out-of-scope assets have one correct, boring answer, and it’s rarely “start scanning.”
- Reading scripts. Domain 2 expects you to modify small Python, PowerShell and Bash scripts. If you only run other people’s tools, practice reading code line by line.
- Tool output, not tool names. Knowing that Nmap exists won’t get you through a question that shows you a scan result and asks what to do next.
- Clock management on performance-based questions. You have 165 minutes. Flag long simulations, answer the quick items, then come back.
Budget: the voucher is the small part
- Exam voucher: $439 at US retail. CompTIA raised it from $425 on June 1, 2026, according to authorized partner Total Seminars. That’s the same price as Security+ and CySA+.
- Discounts: Authorized partners resell vouchers below retail. Watch expiry dates on discounted vouchers.
- Labs: Your real cost. Budget for a practice-lab subscription or a home lab. Offensive skills come from reps, not reading.
- Renewal: $150 in CE fees over the three-year cycle if you renew with CEUs. Earning a higher-level CompTIA certification, such as SecurityX, also renews it.
Twelve weeks, lab first
Plan on roughly one to two lab sessions for every reading session. Legal lab environments only.
- Weeks 1 to 2: objectives and rules. Read the PT0-003 objectives end to end. Write your own one-page scoping checklist: authorization, scope, out-of-scope assets, testing windows and escalation contacts.
- Weeks 3 to 4: recon and enumeration. Nmap scan types and output, DNS and service enumeration, OSINT. Practice in a legal lab environment only. Read and tweak small Python, PowerShell and Bash scripts until you can predict what they do.
- Weeks 5 to 6: vulnerability scanning. Run authenticated and unauthenticated scans in your lab, compare results, and practice proving or disproving findings.
- Weeks 7 to 9: attacks. Web (SQL injection, XSS, traversal), password and hash attacks, Windows and Linux privilege escalation, and cloud misconfigurations. Learn the AI attack concepts in the objectives, such as prompt injection.
- Week 10: post-exploitation and reporting. Persistence, lateral movement and cleanup. Write one full sample report with an executive summary a manager could read in two minutes.
- Weeks 11 to 12: exam rehearsal. Full practice exams at 165 minutes, performance-based question drills, and a review of every miss by objective.
What PenTest+ does for your job search
CompTIA positions PenTest+ for penetration tester and security consultant roles. In practice, offensive teams hire on proof. PenTest+ gets your résumé past the filter and shows you know the engagement process end to end. What gets you the offer is a folder of lab write-ups, a sample report a client could read, and eventually a hands-on cert like OSCP.
CompTIA positions PenTest+ for penetration tester and security consultant roles. The BLS Occupational Outlook Handbook doesn’t publish a separate category for penetration testers. The closest large BLS category, information security analysts, had median pay of $129,180 in May 2025; the lowest 10% earned less than $75,090 and the top 10% more than $199,850. BLS projects 21% employment growth for the category from 2025 to 2035 (BLS).
Weighing what to take after PenTest+? The certification roadmap shows the offensive path in order.
Don’t collect tools; learn a process. Scope it, enumerate it, prove it, write it up. Keep every write-up, because that folder turns into your portfolio.
Exploits age fast. Your pentest notes shouldn’t. The techniques on your exam are already old news on real engagements. The CyberExperts Daily Brief covers new vulnerabilities, exploited bugs and why they matter, in five minutes each weekday morning. Get tomorrow’s brief.
Quick answers on PenTest+
Is PenTest+ a hands-on hacking exam?
Partly. It mixes multiple-choice with performance-based questions, but it isn’t a live 24-hour lab like OSCP. It tests the whole engagement: planning, recon, attacks, post-exploitation and reporting.
What’s on PT0-003, and what score passes?
Up to 90 questions and 165 minutes. The pass mark is 750 (the scale runs 100 to 900). Attacks and exploits is the largest domain at 35%.
How much is PenTest+ in 2026?
$439 at U.S. retail, up from $425 before CompTIA’s June 1, 2026 increase. Authorized partners often sell vouchers for less. Confirm the price at checkout.
Can I still take PT0-002?
No. PT0-002 retired June 17, 2025. PT0-003, launched December 17, 2024, is the only current PenTest+ exam.
Should I take PenTest+ or OSCP first?
If you’re new to offensive work, PenTest+ gives you a structured, lower-cost checkpoint across the whole engagement. OSCP is a 24-hour hands-on exam and makes more sense once you can already compromise lab machines on your own.
How much experience do I need?
None is required to register. CompTIA recommends Network+ and Security+ (or equivalent knowledge) plus 3 to 4 years in a penetration tester role, and the exam is written with that background in mind.
How do I renew PenTest+?
Every three years. Earn 60 continuing education units and pay $150 in CE fees during the cycle, or earn a higher-level CompTIA certification such as SecurityX.
Sources
- CompTIA, PenTest+ certification and PT0-003 exam details: comptia.org
- CompTIA, Earn continuing education units (CEU requirements): comptia.org
- CompTIA, Continuing education renewal fees: comptia.org
- CompTIA, Continuing education program FAQ (renewal by higher-level certification): comptia.org
- Total Seminars (authorized CompTIA partner), CompTIA exam price increase June 2026: totalsem.com
- BLS, Information security analysts: bls.gov
- EC-Council, Certified Ethical Hacker (CEH) v13: eccouncil.org
- EC-Council Store, CEH exam voucher (remote proctored): store.eccouncil.org
- OffSec, PEN-200 and the OSCP+ exam: offsec.com
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
