CEH vs PenTest+: which penetration testing certification to get
By 8140.study · Published 2026-09-29 · Last updated 2026-09-29
Every figure below was read off CompTIA’s and EC-Council’s own pages on September 29, 2026, and each is linked to the page it came from.
The two exams side by side
| PenTest+ PT0-003 | CEH v13 | |
|---|---|---|
| Questions | Up to 90 | 125 |
| Time | 165 minutes | 4 hours |
| Question types | Multiple-choice and performance-based | Multiple choice |
| Passing score | 750 on 100 to 900 | Varies by exam form |
| Hands-on test | Built into the exam | Optional 6 hour practical, 20 challenges |
| Before you can sit it | Recommended experience only | Official training, or 2 years of experience and a $100 application |
| Exam price (US$) | Not listed on the exam page | $950 online proctored, $1,199 at a VUE center |
The format difference is the one that matters on test day. CompTIA’s PenTest+ page lists a maximum of 90 questions in 165 minutes, including performance-based questions, so part of the exam has you work a task rather than pick an answer. EC-Council’s CEH page lists the knowledge exam as 125 multiple-choice questions in 4 hours. Its practical is a separate 6 hour exam of 20 challenges in the iLabs Cyber Range, and EC-Council calls it optional. Pass both and EC-Council recognizes you as a CEH Master, which it describes as a designation, not a separate certification.
One date to watch on the CompTIA side: PenTest+ PT0-003 launched December 17, 2024, and CompTIA says exams usually retire about three years after launch, estimating 2027 for this one. If you are buying study material, make sure it is for PT0-003.
On scoring, CompTIA sets PenTest+ at 750 on a scale of 100 to 900. EC-Council explains that CEH has several exam forms, each with its own cut score, so the passing percentage depends on the form you get. We are not quoting a range: the CEH page gives two different ones in two places, so we left the number out rather than pick one.
What each exam covers
| PenTest+ domain | Weight |
|---|---|
| Engagement management | 13% |
| Reconnaissance and enumeration | 21% |
| Vulnerability discovery and analysis | 17% |
| Attacks and exploits | 35% |
| Post-exploitation and lateral movement | 14% |
PenTest+ follows a penetration test from start to finish: scoping the engagement and writing the report, reconnaissance, finding vulnerabilities, attacking, and moving laterally afterward. Attacks and exploits carries the most weight at 35 percent, and engagement management, the planning and reporting side, still counts for 13.
EC-Council does not publish domain weights on its CEH page. Its eligibility page lists the domains the experience has to fall in: ethical hacking overview, reconnaissance, system hacking, network and perimeter hacking, web application hacking, wireless, mobile, IoT and OT, cloud computing, and cryptography. That list names more attack surfaces outright, such as wireless, mobile, IoT and OT, and says less about running an engagement.
Who can sit each exam
PenTest+. CompTIA’s exam page lists recommended experience of 3 to 4 years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge. It is a recommendation, and the page names no application or approval step like the one CEH has. If you do not yet hold Security+, read that recommendation as a hint about order.
CEH. EC-Council’s eligibility page gives two routes. Complete official EC-Council training and you can go straight to the exam. Or apply without training: submit verifiable proof of at least 2 years of experience in the CEH domains with a non-refundable $100 application fee. EC-Council says approval typically takes 5 to 10 business days, it contacts the references you list, and an approval is good for 90 days. Once you buy the voucher you have 12 months to take the exam.
What each costs to get
EC-Council lists the CEH exam voucher at $950 for the online proctored exam and $1,199 at a VUE testing center, on the same eligibility page. Most official training packages include the voucher, and EC-Council notes that partner prices vary. On its CEH page, EC-Council’s own training starts at $1,699 on demand and $2,499 live online. If you fail, you can retake up to 4 times in one year.
CompTIA’s PenTest+ exam page does not state a price, so we do not quote one here. Check CompTIA’s store for the current voucher price in your country.
What each costs to keep
| PenTest+ | CEH | |
|---|---|---|
| Continuing education per 3 year cycle | 60 CEUs | 120 credits |
| Fees per 3 year cycle (US$) | $150 total | $80 a year, $240 total |
The CEU and credit numbers are in different units, so do not compare them directly. The fees are simpler: CompTIA charges $150 once per three year cycle if you renew by uploading CEUs, and EC-Council charges $80 every year.
One more renewal fact tips the scale for anyone who already holds a CompTIA certification. CompTIA’s higher-level renewal table says earning PenTest+ fully renews CySA+, Security+, Network+, and A+. If you already hold Security+, PenTest+ takes care of its renewal. CompTIA adds one caveat for CySA+: the CEUs come from passing the PenTest+ exam, and renewing PenTest+ later does not automatically renew CySA+. Our Security+ vs CySA+ guide covers the matching rule on the analyst side: earning CySA+ fully renews Security+.
Which one to get
Get PenTest+ if you want the exam itself to test hands-on work, you already hold Security+ and want it renewed along the way, or you do not have two years of security experience and do not plan to pay for official training. The PenTest+ certification page has the full details.
Get CEH if a job posting or contract names it, or your employer is paying for EC-Council training anyway, since the training includes the eligibility and usually the voucher. If you want the hands-on proof too, plan for the practical.
Either one is a reasonable second certification after Security+. When the paperwork names a specific certification, that settles it.
FAQ
Is CEH or PenTest+ better?
Neither is better across the board. PenTest+ mixes multiple-choice and performance-based questions in one 165 minute exam and CompTIA lists only recommended experience for it. CEH is a 125 question multiple-choice exam with a separate, optional 6 hour practical, and it requires official training or 2 years of experience plus a $100 application. If a job posting or contract names one, get that one.
Is PenTest+ harder than CEH?
They are hard in different ways. PenTest+ has performance-based questions, so you have to do tasks, not just recognize answers, and CompTIA recommends 3 to 4 years of penetration testing experience. The CEH knowledge exam is 125 multiple-choice questions over 4 hours and covers a wide catalog of attack types.
Can I take CEH without training?
Yes. EC-Council lets you apply for exam eligibility without official training if you can prove at least 2 years of experience in the CEH domains. The application fee is $100 and non-refundable, and approval typically takes 5 to 10 business days, as of September 29, 2026.
How much does the CEH exam cost?
EC-Council lists the CEH exam voucher at $950 for the online proctored exam and $1,199 at a VUE testing center. Candidates who skip official training also pay a $100 application fee. Official training packages usually include the voucher, as of September 29, 2026.
Does PenTest+ renew Security+?
Yes. CompTIA's higher-level renewal table says earning PenTest+ fully renews CySA+, Security+, Network+, and A+. For CySA+, the CEUs come from passing the PenTest+ exam, and renewing PenTest+ later does not automatically renew CySA+.
How do you renew CEH and PenTest+?
PenTest+ needs 60 CEUs and a $150 fee every three years. CEH needs 120 continuing education credits every three years and an annual fee of $80.
Want to try both before you pick? The first module of our PenTest+ course, Engagement Management, is free, and so is the first module of our CEH course, Introduction to Ethical Hacking.