PenTest+ exam format: questions, PBQs, and the 750 passing score

Every figure below was read off CompTIA’s own certification, testing policy, and support pages on November 9, 2026, and each is linked to the page it came from.

The exam at a glance

The time is the first thing that stands out. 165 minutes for at most 90 questions is close to two minutes per question on average. That extra time is not a gift. The objectives below lean on reading things: scan results, tool output, scope documents, scripts, and reports. Reading carefully takes longer than recalling a definition, so plan to use the time rather than bank it.

The previous version of the exam retired on June 17, 2025. If a study guide or video course was not built for PT0-003, it was built for an exam you can no longer take.

What the exam covers

CompTIA splits PT0-003 into five domains. These are the published V3 weights, with a short summary of what CompTIA lists under each.

Attacks and exploits (35%) and reconnaissance and enumeration (21%) together make up more than half the exam. Under attacks, CompTIA lists network attacks such as VLAN hopping and on-path attacks, authentication attacks such as pass-the-hash, host-based privilege escalation, web application attacks such as SQL injection and cross-site scripting, cloud attacks such as container escapes and metadata service abuse, and a line item some readers will not expect: AI attacks, explaining prompt injection and model manipulation. Our PenTest+ certification page has the full breakdown.

Do not skip engagement management because it is the smallest domain at 13%. It covers scoping, rules of engagement, authorization letters, and writing the report, and those questions reward knowing the process a professional test follows. It is easy to lose points here by treating it as paperwork.

The reconnaissance domain also includes script modification: CompTIA names Python, PowerShell, and Bash, and the wording is about customizing scripts for reconnaissance and enumeration. Practice reading a short script in each and changing what it targets or what it outputs.

Performance-based questions on PenTest+

CompTIA’s performance-based questions page lists PenTest+ among the certifications with simulation PBQs, not virtual ones. A simulation is an approximation of an environment or tool, such as a firewall, a network diagram, a terminal window, or an operating system. From the same page:

• You can skip a simulation PBQ and come back to it. Your work is saved as you go and when you move to another item.
• Simulation PBQs have a reset button if you want to start the item over.
• There can be more than one way to solve it. CompTIA says scoring addresses different possible approaches.
• Partial credit may be given, so a half finished answer beats a blank one.

CompTIA does not say how many PBQs appear on PenTest+ or how many points each is worth. Numbers you read elsewhere are guesses, so we do not repeat them. The practical approach that follows from the rules above: if a PBQ looks long, skip it, clear the multiple-choice questions, and come back with the time you have left. Because your work is saved, starting a PBQ and leaving it costs you nothing.

What 750 means

750 is a scaled score, not a percentage. CompTIA’s scoring article says it uses a mathematical algorithm to calculate a scaled score derived from what would otherwise be a percentage, and that passing scores are set through statistical analysis. It also says CompTIA does not disclose the number of questions required to pass. So any claim that 750 equals a certain percentage is an estimate, not a CompTIA figure.

Your score report will not list the questions you missed. Per the same article, it lists the exam objectives tied to the questions you answered incorrectly. If you need a second attempt, that list is your study plan.

Who should take it

There is no gate. CompTIA’s prerequisites article says its exams have no educational, training, or certification prerequisites, and the PenTest+ page describes 3 to 4 years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge as recommended experience, not a requirement. That recommendation is worth taking seriously, though: it tells you the questions are written for someone who already knows networking and security fundamentals and has spent time with the tools.

If you are weighing PenTest+ against the defensive track, our CySA+ vs PenTest+ guide compares the two, and our CEH vs PenTest+ guide covers the other common penetration testing choice.

If you do not pass

CompTIA’s retake policy sets no waiting period between a first and second attempt. Before a third or any later attempt, you wait at least 14 calendar days from your last one. You pay the exam price every time, and CompTIA offers no free retests or retake discounts, so the bundles on the PenTest+ page that include a voucher with Retake Assurance are the one way to buy a second try up front.

The same policy says that once you pass, you cannot sit the same exam code again without CompTIA’s consent. Recertifying by exam means waiting for a new series, and as of November 9, 2026 CompTIA has published no V3 successor, only an estimated retirement of 2027.

After you pass

PenTest+ is valid for a three year renewal cycle. To renew with continuing education, CompTIA asks for 60 CEUs over the cycle and a $150 CE fee for the three year period. Passing PenTest+ also fully renews CySA+, Security+, Network+, A+. CySA+ is the one with a catch: CompTIA says the CEUs come when PenTest+ is first earned by passing the exam, and renewing CySA+ later does not automatically renew PenTest+.

FAQ

Want to see the material before you book? Our PenTest+ course is built domain by domain on the PT0-003 weights. The first module, Engagement Management, is free to start.