IT, Cloud & Cybersecurity • Certification
CompTIA PenTest+
Prove you can think like a tester
Researched and maintained by TestPrepPilot Editorial BoardCloud, IT & cybersecurity certifications desk · Figures last verified August 2026
The short version
What is the CompTIA PenTest+ and is it worth it?
PenTest+ (PT0-003) is a single performance-based exam covering planning, information gathering, attacks, reporting and compliance for penetration testing.
- Hands-on
- Maps to DoD 8140
- Offensive counterpart to CySA+
What is it?
What exactly is the CompTIA PenTest+?
Prove you can think like a tester
CompTIA PenTest+ certifies the hands-on penetration-testing and vulnerability-management skills used to plan, scope, exploit and report on authorized security assessments.
Before you book
Who is eligible to sit the CompTIA PenTest+?
Who it is for: Penetration testers and security consultants
The test itself
What is the format of the CompTIA PenTest+?
The CompTIA PenTest+ is administered by Pearson VUE and runs 165 minutes, contains 85 (incl. PBQs) questions and requires 750 of 900 to pass.
| Administered by | Pearson VUE |
|---|---|
| Questions | 85 (incl. PBQs) |
| Time limit | 165 minutes |
| Pass mark | 750 of 900 |
| Exam fee | $404 |
| Format | Multiple-choice and performance-based |
Content outline
What topics are on the CompTIA PenTest+?
The CompTIA PenTest+ is weighted across 5 domains; the largest are Attacks and exploits (30%), Information gathering and vulnerability identification (22%), Reporting and communication (18%).
Weightings come from the official exam outline. Study time is best allocated in roughly these proportions rather than evenly across domains.
- Planning and scoping 14%
- Information gathering and vulnerability identification 22%
- Attacks and exploits 30%
- Reporting and communication 18%
- Tools and code analysis 16%
Money & time
How much does the CompTIA PenTest+ cost?
For the CompTIA PenTest+, the exam fee is $404; the all-in cost is typically $404+; most candidates spend 3–4 months preparing.
Cost breakdown
| Exam voucher | $404 |
|---|---|
| Typical total | $404+ |
Academic pricing available.
Timeline
- Labs and study 8–12 weeks
- Sit PT0-003 test day
Typical prep: 3–4 months
The path
How do you register for the CompTIA PenTest+?
- 1
Create your accounts10 minutes
Set up a free CompTIA account and a Pearson VUE account. Your CompTIA account is where the certification and CEUs are tracked; Pearson VUE handles scheduling and delivery.
Use a consistent email so your exam result links to your CompTIA record.
- 2
Purchase an exam voucher1 day
Buy the XK0-006 voucher from the CompTIA store (standard $390 USD). Optionally choose an exam+retake bundle or add CertMaster training.
- Select Linux+ (XK0-006) in the CompTIA store
- Choose voucher only, exam+retake bundle, or bundle with training
- Save the voucher code from your CompTIA account
- 3
Schedule your exam15 minutes
Go to Pearson VUE, enter your voucher code, and book a date. Choose a nearby test center or online proctoring (OnVUE).
- Pick test center or OnVUE online
- Run the OnVUE system check if testing at home
- Confirm date, time, and time zone
- 4
Prepare your ID and environmentTest-day prep
Bring a government-issued photo ID to a center. For online testing, prepare a quiet private room, clear your desk, and have your webcam ready for the check-in scan.
Accepted ID rules follow Pearson VUE policy (typically passport or driver's license matching your account name).
- 5
Take the exam90 minutes
Complete up to 90 questions in 90 minutes, including multiple-choice and performance-based items. You see a pass/fail result on screen immediately after finishing.
- 6
Claim and maintain your certificationA few days
Your certification appears in CompTIA CertCentral. Log in to download the e-certificate and start tracking the 50 CEUs needed to renew within 3 years.
The fine print
What are the retake and renewal rules for the CompTIA PenTest+?
- Proctoring & delivery
- Delivered by Pearson VUE with two options: an in-person proctored test center, or online proctoring via OnVUE with a live remote proctor (requires webcam, stable internet, and a private room).
- Retake policy
- If you do not pass, you may retake XK0-006 after a 14-day waiting period. Each attempt requires a new exam voucher; there is no limit on the number of retakes. CompTIA's standard candidate agreement governs retake rules.
- Score reporting
- A pass/fail result is shown on screen immediately after the exam. A detailed score report by domain is available in your Pearson VUE account and mirrored in your CompTIA CertCentral record.
- Recertification
- Linux+ is valid for 3 years from the certification date. Renew by earning 50 Continuing Education (CE) credits and paying the CE fee through CompTIA CertCentral, by earning a higher-level CompTIA certification, or by passing the current XK0-006 exam again.
- Refunds & rescheduling
- Exam vouchers are generally non-refundable but may be transferable or have a defined expiry; optional CertMaster training may be refundable within a limited window per CompTIA's terms. Review voucher terms at purchase.
Context
Linux certifications compared
| Credential | Vendor | Level | Exam | Validity | |
|---|---|---|---|---|---|
| CompTIA Linux+ | CompTIA | Vendor-neutral | Intermediate | 1 exam (XK0-006) | 3 years |
| LPIC-1 | Linux Professional Institute | Vendor-neutral | Entry | 2 exams (101 + 102) | 5 years |
| Red Hat RHCSA | Red Hat | Vendor-specific | Entry | 1 exam (performance lab) | 3 years |
What it pays
How much does this credential pay?
$124,910 median for information security analysts (BLS, May 2024)
There is no Bureau of Labor Statistics occupation called "penetration tester" as a distinct category — BLS folds the work into Information Security Analysts, SOC 15-1212, and we have chosen it deliberately: PenTest+ is positioned by CompTIA for security professionals who assess and exploit vulnerabilities, and that is the analyst tier of the security workforce. The occupation had a May 2024 median annual wage of $124,910, with the lowest 10 percent earning under $69,660 and the highest 10 percent over $186,420, and it is one of the fastest-growing tracked occupations: BLS projects 29 percent employment growth from 2024 to 2034 with about 16,000 openings a year. The distribution is worth reading carefully because penetration-testing work sits toward the experienced end of it: entry-level security analysts start well below the median, and the offensive-security specialisation this exam signals — vulnerability assessment, exploitation, reporting — is what pushes practitioners toward the top decile over several years, often in consulting or specialised security firms where offensive skills command a premium. The occupational headwind is different from most IT roles: security demand is growing, not shrinking, so the credential compounds in a rising market. The honest takeaway for a PenTest+ candidate is that this is a professional-tier certification, not an entry ticket — CompTIA recommends a background in Security+ or equivalent plus practical network experience — so the salary story is about the security-analyst career you are advancing inside, with the exam marking the offensive-skill step rather than the entry into the field.
| Measure | Figure | Source / note |
|---|---|---|
| Median annual wage, information security analysts | $124,910 | BLS Occupational Outlook Handbook, May 2024 |
| Lowest 10 percent | less than $69,660 | BLS OOH Pay tab, May 2024 |
| Highest 10 percent | more than $186,420 | BLS OOH Pay tab, May 2024 |
| Employment, 2024 | 182,800 jobs | BLS OOH Quick Facts, 2024 |
| Projected annual openings | ~16,000 per year | BLS OOH Job Outlook, 2024-34 — 29% growth, much faster than average |
Job growth.+29% projected change 2024-34 (much faster than average), ~16,000 openings a year. PenTest+ is a professional-tier offensive-security credential for the analyst workforce, not an entry ticket.
Source: BLS Occupational Outlook Handbook — Information Security Analysts
Your odds
What are the pass rates?
CompTIA publishes no pass rate — but it does publish the passing score: 750 out of 900
CompTIA does not release pass-rate statistics for PenTest+ or any of its certifications, and it never has. Unlike some vendors, however, it does publish the cut score, and understanding what that number means is more useful than any rumoured pass rate. The PenTest+ exam (currently code PT0-002, with the objectives document revised periodically) is scored on a scale of 100 to 900 and you need 750. That is not 83 percent of the questions: CompTIA equates every exam form so that a harder set of items demands the same underlying ability as an easier one, and performance-based questions carry more weight than a single multiple-choice item, so the raw-to-scaled conversion is not linear and cannot be reverse-engineered. Candidates who aim for "85 percent on practice tests" are using a heuristic that does not map onto the scoring model; aim instead to be able to complete every PBQ task type unaided. Two documented policies matter more than a pass rate. First, retakes: CompTIA imposes no waiting period between your first and second attempt, so a narrow fail can be re-sat almost immediately, but from the third attempt onward you must wait 14 calendar days between sittings, and every attempt is paid at full price unless you bought a retake bundle. Second, the score report: you get the outcome and your scaled score on screen the moment you finish, plus a printed report showing relative performance by domain — the closest thing to diagnostic feedback available, and it turns a failed attempt into an actionable study plan.
Read this before quoting the number.No pass rate is published by CompTIA or by Pearson VUE. Published and verifiable: passing score 750 on a 100-900 scale; no waiting period between attempts one and two, 14 days from the third attempt onward; score report includes per-domain performance.
Your schedule
How long should I study for it?
110-130 hours of focused study
The first thing to establish is which exam you are actually studying for: PenTest+ is currently PT0-002, and CompTIA retires old exam codes on a published schedule, so confirm the current code on the CompTIA site before buying any material — studying for a retired code is the single most common way candidates waste money here. The PT0-002 exam is a maximum of 85 questions in 165 minutes, covering six domains: Information Security and Penetration Testing Concepts, Planning and Scoping, Information Gathering and Vulnerability Scanning, Attacks and Exploits, Penetration Testing Tools, and Reporting and Communication. The weighting is the planning key: the offensive domains — Attacks and Exploits, Information Gathering and Vulnerability Scanning, and Planning and Scoping — carry the majority of the paper, while Reporting and Communication, though a smaller percentage, is where candidates who cannot write a finding lose points they earned technically. The plan below runs ten weeks at roughly 10-12 hours a week and assumes you already hold or know the material behind Security+ — CompTIA recommends that background, and starting PenTest+ without it means building the security base and the offensive skills simultaneously. A second structural fact shapes the schedule: the exam is tool-heavy and PBQ-heavy, so a lab environment is not optional. You need a safe place to run nmap, a vulnerability scanner, and the exploitation and post-exploitation tooling the objectives name — most candidates use a virtualised environment with intentionally vulnerable targets — and no amount of reading substitutes for having typed the commands.
- Weeks 1-210-12 hrs/week
Domain 1 — Concepts and Domain 2 — Planning and Scoping
- Information security and penetration testing concepts: attack surfaces, kill chain, frameworks, and the difference between assessment types
- Planning and scoping: rules of engagement, legal and compliance boundaries, scope validation, and the ethical lines
- Write sample scoping documents and rules of engagement — the exam tests them as scenarios
- Stand up the lab: a virtualised environment with a target VM and the core tools installed
- Weeks 3-411-13 hrs/week
Domain 3 — Information Gathering and Vulnerability Scanning
- Passive and active reconnaissance: DNS, OSINT, network scanning with nmap, and service enumeration
- Vulnerability scanning with a commercial-class scanner, and understanding false positives
- Run the scans in the lab until the commands and output are familiar without reference
- Practise interpreting scan output into findings — the exam grades the interpretation, not just the run
- Weeks 5-612-14 hrs/week
Domain 4 — Attacks and Exploits
- Exploitation techniques: web application attacks, network attacks, privilege escalation, and post-exploitation
- Password attacks, social engineering concepts, and the OWASP-oriented web testing the objectives name
- Execute the attacks in the lab against intentionally vulnerable targets — this is the PBQ rehearsal
- Learn the tooling for each attack type: what it does, what output it gives, and when to use it
- Week 711-13 hrs
Domain 5 — Penetration Testing Tools
- The tool categories the objectives name: scanners, exploitation frameworks, packet capture and analysis, password crackers, and reporting tools
- Drill the tool-vs-task matching items — the exam asks which tool for which job
- Complete tool-focused PBQ practice: given a scenario, select and use the right tool in the simulated environment
- Rehearse the Metasploit-style workflow end to end in the lab
- Week 89-11 hrs
Domain 6 — Reporting and Communication
- Writing findings: severity, remediation, and the language a client can act on
- Report structure, executive summaries, and the documentation of evidence
- Practise turning a lab finding into a written report entry — the exam scores the writing
- Rehearse the PBQ reporting task types under a timer
- Weeks 9-1011-13 hrs/week
Timed full exams and PBQ rehearsal
- Three full 85-question practice exams timed to 165 minutes
- Re-drill every PBQ task type until each is automatic — tool selection, scan interpretation, finding writing
- Re-lab every miss by domain rather than re-reading it
- Final pass over the scoping, legal and reporting items — the cheapest points on the paper
- One quiet day before the exam
Adjusting the pace
Already hold Security+ and work in security operations.Six to seven weeks at 10-12 hrs/week. Skip the concept review, go straight to domains 3-5, and invest the recovered time in the lab and PBQ rehearsal.
No Security+ background, hands-on networking.Twelve to fourteen weeks at 10 hrs/week. Add three weeks before Week 1 on the security fundamentals the exam assumes; do not sit PenTest+ without the base.
Experienced pentester formalising the credential.Four to five weeks. Your lab work covers domains 3-5; spend the time on the exam's specific phrasing — scoping documents, reporting formats and tool-matching items — and on full-length timed mocks to check the 165-minute pace.
How to study
How do I prepare most effectively?
PenTest+ is the exam of its group where a meaningful share of the marks come from using tools and interpreting output, and the performance-based questions drop you into a simulated environment. That single fact should reshape how you study: reading about nmap and watching someone else run an exploit produces candidates who recognise the right answer in a list and freeze at a terminal with a running clock.
Run the toolset in a lab until it is reflex
The PBQs put you in a simulated environment and ask you to complete tasks — run a scan, select the right tool, interpret output, write a finding. Every tool the objectives name should be one you have run yourself in a safe lab: nmap, a vulnerability scanner, an exploitation framework, a packet analyser, a password cracker. Candidates who have typed the commands finish the PBQs; candidates who only read about them do not.
Learn the tool-vs-task matching, not just the tools
A large share of the multiple-choice items give you a task and ask which tool fits — and the distractors are real tools that do something adjacent. Build a table: task, correct tool, why, and the tempting wrong tool. This single mapping covers a disproportionate share of the paper and is where partial familiarity is punished.
Practise interpreting scan and tool output
Items and PBQs hand you output — a scan result, a banner, a service version — and ask what it means or what to do next. Practise reading the output your lab tools produce until the patterns are familiar: open ports, service versions, CVEs, and the follow-up step each implies. The exam grades the interpretation, not just the run.
Write findings like a consultant
The Reporting and Communication domain scores how you document findings: severity, evidence, remediation, and language a client can act on. Practise turning every lab finding into a structured report entry. Candidates who do great exploitation work and write it badly lose points they technically earned.
Cover the scoping and legal material seriously
Planning and Scoping plus the concept domain carry a meaningful weight and contain the easiest points on the paper: rules of engagement, legal boundaries, assessment types and the ethical lines. These are recall-adjacent and cheap relative to the offensive domains — memorise them and bank them.
Confirm the exam code before buying anything
CompTIA retires PenTest+ exam codes on a published schedule, and retired-code material still ranks well in search results. Check the current code and the objectives document's revision date on the CompTIA site before you buy a book, course or question bank; studying a retired blueprint is the most expensive mistake available.
What to buy
Which study resources are worth paying for?
The important buying decisions are the exam code (confirm PT0-002 is current), whether to buy a bundle that adds labs and a retake, and how much lab infrastructure you need — because a tool-heavy exam demands a safe place to run the tooling, and that is where self-study candidates most often under-invest.
| Resource | Price | Format | Best for |
|---|---|---|---|
| Exam voucher (PenTest+ PT0-002) | ~$439 US list; authorised resellers commonly $370-409 | Pearson VUE, test centre or online | Required — buy the voucher alone if you already have a lab |
| CompTIA CertMaster Perform + CertMaster Practice bundles | Bundle pricing at the CompTIA Store; includes voucher and often a retake | eLearning with hands-on labs plus adaptive practice | Candidates with no lab of their own and no employer training budget |
| Your own lab — virtualised targets and the core toolset | Free to low-cost (VM software and intentionally vulnerable targets) | Self-built lab | The single most valuable resource for a PBQ-heavy, tool-heavy exam |
| CompTIA PenTest+ Study Guide (Sybex) and video courses | ~$50-60 book; video ~$15-30 during sales | Print + eBook with test bank; video demonstrations | Ordered reference and watching an experienced pentester work |
| Jason Dion practice tests (Udemy) | ~$15-30 during Udemy's frequent sales | Timed practice exams with explanations | Cheap readiness checks; weaker on PBQ simulation than on multiple choice |
| Hands-on practice platforms (TryHackMe, Hack The Box) | Free tier plus paid plans | Browser/SSH labs with guided rooms | Rehearsing real tool use and attack workflows under a clock |
Prices checked 2026-08 in USD before tax; CompTIA voucher pricing varies by region and promotion and Udemy list prices are close to meaningless outside a sale — confirm at the source before buying. We do not rank by commission.
Avoid these
What mistakes do candidates most often make?
PenTest+ candidates fail on execution more than knowledge: they study a retired code, read about tools instead of running them, and leave the reporting and scoping items under-prepared. The six traps below are the recurring ones, and all are fixable within one study cycle.
✕Studying for a retired exam code
✓CompTIA retires PenTest+ codes on a published schedule, and retired-code books, courses and question banks still rank highly in search. Confirm the current code and the objectives document's revision date on the CompTIA site before you buy anything. A full course on the wrong blueprint is a total loss of money and study weeks.
✕Preparing with multiple-choice only
✓Performance-based questions put you in a simulated environment with a task to complete, and they carry more weight than a single multiple-choice item. A candidate who scores 90 percent on a question bank but has never run a scan and interpreted the output is not ready. Convert at least a third of your study hours into hands-on tool work in a lab.
✕Memorising tool names without the task mapping
✓Items hand you a task and ask which tool fits, with distractors that are real tools doing something adjacent. Build the task-to-tool table and drill it; knowing what a tool is called is not the same as knowing when to use it, and the exam tests the latter.
✕Neglecting the reporting and scoping domains
✓Reporting and Communication plus Planning and Scoping carry a meaningful weight, and they are the cheapest points on the paper — scoping documents, rules of engagement, legal boundaries, and writing findings that a client can act on. Offensive-focused candidates who skip them lose points they earned technically and leave easy ones unbanked.
✕Spending too long on the first PBQs
✓Unlike the Cisco exams, CompTIA allows navigation: you can skip performance-based questions and return to them. Mark every PBQ, clear the multiple-choice items at a fast tempo, then divide the remaining time across the tasks. Candidates who work in presented order regularly spend forty minutes on the opening PBQs and then rush the multiple choice.
✕Forgetting that the certification expires
✓PenTest+ is a CompTIA CE certification, valid for three years and renewed by earning continuing education units or by passing a higher-level CompTIA certification, with a CE fee. Diary the expiry the week you pass, and note that a higher CompTIA certification renews it automatically — which makes the renewal cycle a prompt to move up rather than a chore.
What you'll face
What question types will I see?
The PenTest+ exam (PT0-002) is a maximum of 85 questions in 165 minutes, in English, scored on a 100-900 scale with a 750 cut. The paper mixes multiple choice — both single-answer and multiple-response — with performance-based questions that drop you into a simulated environment and give you a task to complete: run a scan, select and use the right tool, interpret output, or write a finding. PBQs are typically presented at the start and are weighted more heavily than individual multiple-choice items, but crucially you may skip them and return, so the presented order is not the order you should work in. The six domains are Information Security and Penetration Testing Concepts, Planning and Scoping, Information Gathering and Vulnerability Scanning, Attacks and Exploits, Penetration Testing Tools, and Reporting and Communication. Because CompTIA equates forms, your scaled score is not a percentage of items correct and cannot be converted into one. The practical implication for pacing is simple: multiple-choice items should average well under a minute so that the PBQs, which can easily consume five minutes each, have somewhere to come from.
A simulated environment with a task to complete — run a scan, select the right tool, interpret output, write a finding. Skippable and returnable, which is the key tactical difference from a Cisco exam.
Tool selection, output interpretation, methodology and concept discrimination. Distractors are usually real tools or real options that do something adjacent.
The stem states how many to select and scoring is all-or-nothing. Common where several steps together complete a task.
A described engagement — rules of engagement, a client request, a finding — asking for the correct next step or the correct document entry. These reward knowing the professional process, not just the tools.
Try these
Q1A penetration tester has been hired to assess a client's web application. During scoping, the client states that only the production environment may be tested. Which of the following is the correct professional action?
Answer:B
Scoping and rules of engagement are the contract for the engagement: the tester documents the limitation, confirms the authorised boundary and stays within it (B). A is incomplete — the scope must be documented and confirmed before testing begins. C violates the authorised boundary by substituting an unauthorised target, however well-intentioned. D expands scope without authorisation, which is both an ethical and legal violation. The exam rewards the professional process, not the convenient shortcut.
Q2A tester needs to identify open ports and running services on a target host from the command line. Which tool is the most appropriate?
Answer:A
nmap is the network scanning tool that performs port scanning and service/version detection (A). tcpdump (B) captures and analyses packets on the wire — a different task. hydra (C) is an online password-cracking tool. john (D) is an offline password cracker. The tool-vs-task mapping is exactly what this item tests: each distractor is a real tool that does something adjacent, and partial familiarity is punished.
Q3After exploiting a vulnerability and gaining access to a target, a tester must determine which actions establish persistence. Which of the following is the most appropriate post-exploitation consideration?
Answer:A
Post-exploitation in a professional engagement balances maintaining the foothold for further testing against evading detection, with every technique documented for the final report (A). B is destructive and violates the engagement's evidence requirements. C destroys client data — outside any authorised scope. D is a professional and ethical violation. The item tests that offensive skill is exercised inside professional and legal boundaries.
Samples are editor-written illustrations of the published blueprint, not live exam items.
The big day
What should I expect on exam day?
A maximum of 85 questions in 165 minutes, delivered through Pearson VUE either at a test centre or online with OnVUE proctoring. Two things about a CompTIA exam day differ sharply from the Cisco exams and both are in your favour. First, you can navigate: performance-based questions are presented early and you are permitted to skip them and return, and you can review and change multiple-choice answers before submitting. Build your pacing plan around that — mark every PBQ, sweep the multiple choice at a brisk tempo, then divide what remains across the outstanding tasks. Second, you get your result immediately: the scaled score appears on screen the moment you submit, and you receive a score report showing relative performance by domain, which is genuinely diagnostic if you have to come back. The thing that goes wrong most often has nothing to do with penetration testing: CompTIA requires two forms of identification, one of them a government-issued photo ID, and the name must match your CompTIA account exactly. Check your account spelling the week before, because correcting it on the day is not possible and the seat is lost. For online proctoring, run the system test on the exact machine you will use, clear the desk, and ensure a private room — the same routine applies to every Pearson VUE-delivered CompTIA exam.
Bring
- Two forms of identification, both unexpired, with names matching your CompTIA account exactly
- One must be a government-issued photo ID; the second must carry your name and signature (a credit card or bank card is usually accepted)
- Your CompTIA ID, in case check-in cannot locate the booking
- For OnVUE: a phone for check-in photographs, a completely clear desk, and a private room with a door you can close
- For OnVUE: a webcam, microphone and connection already system-tested on the exact machine you will use
Leave at home
- Phones, smartwatches, fitness trackers and earbuds — locker at a centre, out of the room for OnVUE
- All notes, cheat sheets and printed command references
- Your own paper and pens; a test centre issues an erasable noteboard and OnVUE provides a digital whiteboard only
- Bags, coats, hats, food and drink beyond what the centre permits
- Second monitors, which must be unplugged and turned away for OnVUE, and any other person in the room
How the day runs
Rules in the room
- Navigation is permitted: you may skip performance-based questions and return, and review multiple-choice answers before submitting.
- Passing score is 750 on a 100-900 scale; it is not a percentage of items correct.
- Two forms of ID are required, one government-issued with photo, names matching your CompTIA account exactly.
- No scheduled breaks in a 165-minute exam, and the clock does not stop if you leave.
- Erasable noteboard only at a test centre; OnVUE candidates get a digital whiteboard and no physical writing materials.
- Inside a PBQ you have the simulated environment and the tools presented — no browser, no external reference.
- No waiting period between your first and second attempt; from the third attempt onward you must wait 14 calendar days between sittings, and each attempt is paid unless you bought a retake bundle.
Afterwards.Your pass or fail and your scaled score appear on screen the instant you submit, and you leave a test centre with a printed score report showing how you performed relative to each domain. That report is the most useful artefact the exam produces, so read it properly rather than filing it. On a pass, your certification appears in your CompTIA account within a few days and you can claim the digital badge; PenTest+ is valid for three years under the CompTIA Continuing Education programme, renewed with CEUs plus the CE fee, or automatically by passing a higher-level CompTIA certification. Log the expiry date immediately. On a fail, resist booking the immediate retake that the no-waiting-period policy makes possible. Take the domain breakdown — most failures concentrate in the tool-use and PBQ domains or in reporting — and spend a fortnight labbing those specifically. The score report tells you precisely where to aim, and wasting it by re-sitting on the same knowledge is how a $439 voucher becomes an $878 one.
Reference
What are the key facts about the CompTIA PenTest+?
CompTIA PenTest+ is a certification credential; awarded by CompTIA; the exam fee is $404; typical preparation is 3–4 months; holders typically earn $85,000 – $130,000.
| Credential | CompTIA PenTest+ |
|---|---|
| Abbreviation | PenTest+ |
| Type | Certification |
| Profession | IT, Cloud & Cybersecurity |
| Specialty | CompTIA |
| Awarded by | CompTIA |
| Difficulty | Hard |
| Typical prep time | 3–4 months |
| All-in cost | $404+ |
| Typical salary range | $85,000 – $130,000 |
| Exam code | PT0-003 |
| Scope | National / Multi-state |
| Also known as | PT0-003, PT0-002 |
Real questions
Frequently asked questions about the CompTIA PenTest+
Do I need PenTest+ before OSCP?
No, but PenTest+ gives a structured, certifiable baseline; OSCP is a harder, fully hands-on lab exam.
Is it legal to use these skills?
Only within authorized, scoped engagements. The exam and the profession are strictly about permitted testing.
How do I register for comptia-pentest-plus?
You register and schedule comptia-pentest-plus through Pearson VUE. Pick a test-centre appointment or online proctoring, then sit the exam on your booked date.
What is the comptia-pentest-plus exam format?
The exam is delivered as Multiple-choice and performance-based, with about 85 (incl. PBQs) items, in 165 minutes. The published pass mark is 750 of 900.
How long is the comptia-pentest-plus certification valid?
Most CompTIA certifications are valid for three years and renewed via Continuing Education (CE) credits, a higher cert, or a single renew-by-exam.
How much does comptia-pentest-plus cost?
The exam fee is $404. Optional study materials and retakes are priced separately.
Who issues the Linux+ certification?
CompTIA (the Computing Technology Industry Association), a vendor-neutral certifying body. The exam is delivered through Pearson VUE and the credential is ANSI-accredited to ISO/IEC 17024.
How do I renew a CompTIA certification?
Through CompTIA CertCentral: accumulate the required Continuing Education (CE) credits (50 for Linux+) and pay the CE fee, earn a higher CompTIA cert, or retake the current exam. Most CompTIA certs follow the 3-year renewal cycle.
Are CompTIA exam vouchers refundable?
Vouchers are typically non-refundable but may be transferable and carry an expiry date. Optional training products may have a limited refund window. Always review the terms shown at purchase in the CompTIA store.
In short
Is the CompTIA PenTest+ worth it?
- PenTest+ is a hands-on offensive security cert.
- It covers scoping, exploitation and reporting.
- It renews every three years.
Same awarding body
What other credentials does CompTIA award?
Worth comparing
How does the CompTIA PenTest+ compare with similar credentials?
Trust
Where does this information come from?
Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.
- CompTIA Awarding body
- Official CompTIA PenTest+ exam page Exam page
- CompTIA certification programme Programme rules
Research confidence: high · Last reviewed 2026-08