PenTest+ is often bought as a box to tick before a first testing role, yet the current exam weights hands-on attack and exploitation knowledge at more than a third of the score and expects several years of experience behind it. This guide sets out what CompTIA publishes about PenTest+ V3 (exam PT0-003): the format, the five domains and their weightings, the recommended experience, the retake rules and the three-year continuing education cycle. It then adds a preparation plan, decision guidance on when PenTest+ is the right credential, and where it sits against alternatives such as OSCP, GPEN and CEH. It describes the exam, not attack techniques. It is written for administrators and analysts moving into offensive security, and for managers who fund or require testing credentials. Facts are as published on comptia.org, checked October 2026; confirm on the linked pages before you book.
Key takeaways
- One live version. PenTest+ V3 (PT0-003) launched on 17 December 2024; the previous exam retired on 17 June 2025, and CompTIA estimates V3 retirement for 2027, about three years after launch.
- The exam is long and mixed. Up to 90 multiple-choice and performance-based questions in 165 minutes, with a passing score of 750 on a scale of 100 to 900.
- Attacks and exploits dominate. That domain carries 35% of the exam, more than engagement management (13%) and post-exploitation (14%) combined.
- Experience is recommended, not required. CompTIA recommends three to four years as a penetration tester plus Network+ and Security+ or equivalent knowledge, but does not gate the exam on them.
- Renewal is 60 CEUs in three years. Holders log 60 continuing education units and pay the CE fee, or renew through CertMaster CE or a higher-level certification.
Who the certification is for
CompTIA describes PenTest+ as a certification for people advancing a career as a penetration tester or security consultant. It is vendor-neutral and covers the whole engagement, from scoping and legal authorisation through to the report, rather than a single toolset.
- Good fit: security analysts, systems and network administrators and junior consultants who already hold Security+ (or equivalent knowledge) and want a structured, multiple-choice-plus-simulation credential in offensive testing.
- Good fit for employers: internal assessment teams and consultancies that need a common baseline for engagement management, scoping and reporting, not just exploitation skill. See the Penetration Testing Guide for how tests fit into a security programme.
- Weaker fit: experienced testers who need to prove they can compromise systems in a live, proctored lab. A fully practical exam such as the one described in the OSCP Certification Guide carries that signal more directly.
- Buyers of testing services: PenTest+ on a tester's CV tells you they have studied the full engagement lifecycle. It does not replace checking methodology, references and sample reports. See the Penetration Testing Provider Buyer's Guide.
Exam format and domains
Format
| Item | PenTest+ V3 (PT0-003), as published by CompTIA |
|---|---|
| Status | Available; the only PenTest+ version on sale |
| Launch | 17 December 2024 |
| Previous exam | Retired 17 June 2025 |
| Expected retirement | Usually about three years after launch, estimated 2027 (no successor announced on the pages checked) |
| Questions | Up to 90 |
| Question types | Multiple-choice and performance-based |
| Duration | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Languages | English, French, Japanese, Portuguese |
| Recommended experience | Three to four years as a penetration tester; Network+ and Security+ or equivalent knowledge |
The 165 minutes is the main difference from Security+, which allows 90 minutes for the same maximum number of questions. The extra time exists because performance-based questions (PBQs) ask you to work through a task in a simulated environment, such as interpreting scan output or choosing the next step in an engagement, rather than pick an answer.
The five domains and their weightings
| Domain (PT0-003) | Weight | What CompTIA lists under it | Related reading |
|---|---|---|---|
| 1. Engagement management | 13% | Planning and scoping, legal and ethical compliance, stakeholder communication, penetration test reports | Penetration Test Scoping Checklist |
| 2. Reconnaissance and enumeration | 21% | Active and passive reconnaissance including OSINT, DNS and directory enumeration, and modifying scripts in Python, PowerShell and Bash | Attack Surface Management Guide |
| 3. Vulnerability discovery and analysis | 17% | Authenticated and unauthenticated scanning, SAST and DAST, validating results and spotting false positives | Vulnerability Management Guide |
| 4. Attacks and exploits | 35% | Network, authentication, host, web application, cloud and AI attack categories (including prompt injection and model manipulation) | AI Red Teaming Guide |
| 5. Post-exploitation and lateral movement | 14% | Persistence, lateral movement, artefact clean-up, and documenting attack narratives with remediation recommendations | Red Teaming Guide |
Domain names and weights are from CompTIA's V3 page; the last column is our revision suggestion, not CompTIA content. CompTIA also says the exam covers attack surfaces including cloud, web applications, APIs and IoT. Two points stand out for anyone who studied older material. First, AI attacks now sit inside the exploits domain, so a candidate who has never read about prompt injection will lose marks. Second, the exam names tools in its objectives, but the questions test judgement about which approach fits an authorised scope, not tool syntax. Use CompTIA's official exam objectives document for PT0-003 as your checklist: it lists every sub-objective.
Where identity fits
CompTIA's exploits domain lists authentication attacks and cloud IAM misconfiguration, and the post-exploitation domain covers lateral movement. In real engagements these routes usually run through credentials: service accounts with standing privilege, API keys in repositories, cloud roles that are too broad. Testers who understand non-human identities report findings that defenders can fix. See the Privileged Access Management Guide.
Where PenTest+ maps in control frameworks
| Framework | Reference | Relevance to PenTest+ skills |
|---|---|---|
| NIST SP 800-53 Rev 5 | CA-8 Penetration Testing | The control a PenTest+ holder most directly helps an organisation meet |
| NIST SP 800-53 Rev 5 | CA-8(2) Red Team Exercises | Adjacent enhancement; post-exploitation and lateral movement skills feed into it |
| NIST SP 800-53 Rev 5 | RA-5 Vulnerability Monitoring and Scanning | Domain 3 content (scanning, validation, false positives) |
| NIST CSF 2.0 | ID.RA-01 | Vulnerabilities in assets are identified, validated and recorded |
| NIST CSF 2.0 | ID.IM-02 | Improvements are identified from security tests and exercises |
Prerequisites and experience
There is no mandatory prerequisite. CompTIA recommends three to four years of experience as a penetration tester, plus Network+ and Security+ or equivalent knowledge. In practice many candidates sit PenTest+ with less direct testing experience; if you do, the gap shows up in the PBQs and in scenario questions about scope and rules of engagement.
- Networking and operating systems: you need to read protocol and service output fluently and be comfortable on both Windows and Linux command lines.
- Scripting literacy: CompTIA lists modifying scripts in Python, PowerShell and Bash. You need to read and adjust short scripts, not write tools from scratch.
- Web and cloud basics: the exploits domain spans web applications and cloud services, so understand HTTP, sessions, common web flaws and cloud identity models first. See the Cloud Security Guide.
- Legal and ethical grounding: engagement management questions test authorisation, scope boundaries and communication. Knowing when to stop and escalate is examinable.
- Exam delivery: CompTIA offers online testing through Pearson OnVUE. You must run a 5 to 10 minute system test on the same computer and network you will use, set display scaling to 100% on Windows, clear the workspace and have valid ID. Online testing is not offered in some countries, including China, South Korea and Slovenia, so check before you book.
Preparation plan
The plan below assumes ten to twelve hours a week and a Security+ level starting point. Practice must happen only in your own lab or on platforms that authorise it. See the Cyber Ranges, CTFs and Hands-On Training Guide.
- Confirm the exam code (week 0): download the PT0-003 objectives and check that every book, course and question bank you buy names PT0-003. Material for the retired version omits the AI and expanded cloud content.
- Baseline (week 1): take a timed diagnostic and record a score per domain. Weight study time by the domain percentages; attacks and exploits alone is 35%.
- Engagement management first (week 2): learn scoping, rules of engagement, authorisation letters and report structure early. These questions are easy marks for prepared candidates and recur in scenarios across other domains.
- Recon and vulnerability analysis (weeks 3 to 5): work through the objectives in a lab you own. For each objective, note what evidence it produces and how you would validate a result before reporting it.
- Attacks, exploits and post-exploitation (weeks 5 to 9): cover each attack category CompTIA lists (network, authentication, host, web, cloud, AI) at the level of "what it is, what conditions make it possible, how a defender would detect and fix it".
- PBQ practice (weeks 8 to 10): rehearse reading scan output, choosing the next step within scope, and placing findings into a report with severity and remediation.
- Timed mocks (week 11): sit at least two full mocks of 90 questions in 165 minutes. Flag long PBQs and return to them.
- Book and sit (week 12): if testing online, rerun the OnVUE system test shortly before exam day on the same machine and network.
If you fail: CompTIA's retake policy sets no waiting period between the first and second attempt, but requires at least 14 calendar days before a third or later attempt. Every attempt is charged at full price; CompTIA offers no free retests or retake discounts, although some CompTIA bundles include a voucher with Retake Assurance. Use the score report to target weak domains before rebooking.
Small vs large employers: a small team rarely has a senior tester to shadow, so budget for lab platforms and protected study time. Larger organisations can pair candidates with their internal assessment team on scoping and reporting, which covers domain 1 better than any book.
Measuring readiness
- Domain scores: per-domain practice scores tracked weekly, with attacks and exploits at or above your overall target.
- Timed mocks: full mocks completed inside 165 minutes with time left to review flagged items.
- PBQ accuracy: share of simulation tasks completed correctly, tracked separately from multiple-choice.
- Objective coverage: percentage of PT0-003 sub-objectives you can explain without notes, including the AI attack items.
- Report quality: a peer review of one practice report for clear scope, evidence, severity and remediation.
Cost, renewal and continuing education
| Item | Rule or amount (as published by CompTIA, checked October 2026) |
|---|---|
| Exam fee | Not stated on the CompTIA pages checked; prices vary by country and channel, so check the CompTIA store for your region |
| Retakes | Full exam price each attempt; no wait before the second attempt; at least 14 calendar days before a third or later attempt |
| Certification cycle | Three years; activities must be completed within the cycle |
| CEUs required | 60 for PenTest+ |
| Training relevance | At least 50% of a course's content must relate to the PenTest+ exam objectives to count |
| CE fee | $150 per three-year period on CompTIA's renewal fee page, due by the expiry date, payable only when renewing by uploading CEUs |
| Renewal options | CertMaster CE; a higher-level CompTIA certification (full CEUs); other CompTIA or qualifying non-CompTIA certifications (full or partial); preapproved training; higher education, industry participation, publishing and work experience with documentation |
| Retaking a passed exam | Not allowed on the same exam code without CompTIA's prior consent |
Earning a higher-level CompTIA certification within the cycle counts for full CEUs, which suits holders who plan to progress anyway. Check CompTIA's CE pages for which certifications qualify before relying on this route.
Common failure patterns
- Studying retired material: using books or question banks written for the version retired in June 2025, which lack the AI attack content, the restructured domains and the 35% exploits weighting.
- Tool memorisation over judgement: candidates who learn tool flags but not scope and rules of engagement lose marks on scenario questions about what is permitted.
- Neglecting reporting: engagement management and post-exploitation both test how findings are documented with remediation, a skill many self-taught testers skip.
- Running out of time on PBQs: 165 minutes feels generous until two long simulations appear early.
- Testing outside a lab: practising on systems you do not own or have no written permission for is illegal in most jurisdictions and ends careers before they start.
- Letting the cycle lapse: holders who do not log 60 CEUs or pay the CE fee by the expiry date lose the certification at the end of the cycle.
Where it fits on the career path
PenTest+ is an intermediate, specialist credential, usually taken after Security+ and during or before a first dedicated testing role.
| Credential | Format in brief | Choose it when |
|---|---|---|
| CompTIA PenTest+ | Proctored multiple-choice and performance-based exam; three-year CE cycle | You want vendor-neutral coverage of the whole engagement, including scoping and reporting, and a continuation of the CompTIA path |
| EC-Council CEH | Multiple-choice knowledge exam, optional practical exam for CEH Master | An employer or contract names CEH; see the CEH Certification Guide |
| OffSec OSCP | Hands-on practical exam | You need to prove hands-on exploitation ability; see the OSCP Certification Guide |
| GIAC GPEN | Proctored exam tied to GIAC's own objectives | Your employer funds SANS-style training; see the GIAC GPEN Guide |
- Before it: Security+ and networking experience. See the CompTIA Security+ Guide.
- Alongside it: defenders often pair it with CySA+; see the CompTIA CySA+ Guide.
- After it: practical exams such as OSCP, then specialisms such as web or cloud testing, or senior architecture via SecurityX (see the CompTIA SecurityX (CASP+) Guide).
CompTIA does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For role progression, see the Penetration Tester Career Guide.
Practitioner checklist
- Confirm you are preparing for PT0-003 and that every course, book and practice test names that code.
- Download the official PT0-003 exam objectives and use them as your revision checklist.
- Plan study time by domain weight, with at least a third on attacks and exploits.
- Learn scoping, rules of engagement and report structure early, not in the final week.
- Practise only in your own lab or on platforms that give written authorisation.
- Cover the AI and cloud attack categories CompTIA lists, at concept and remediation level.
- Sit at least two timed mocks of 90 questions in 165 minutes before booking.
- If testing online, run the OnVUE system test on the same computer and network you will use.
- After passing, diarise the three-year expiry and log CEUs towards the 60 required.
Standards and references
- CompTIA: PenTest+ Certification
- CompTIA: PenTest+ V3 (PT0-003)
- CompTIA: Earn Continuing Education Units (CEUs)
- CompTIA: Continuing Education Renewal Fees
- CompTIA: Certification Retake Policy
- CompTIA Help Center: How Can I Take a CompTIA Test Online
- NIST: SP 800-53 Rev 5, Security and Privacy Controls
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Penetration Testing Guide · OSCP Certification Guide · CEH Certification Guide · Penetration Tester Career Guide