TL;DR: The CompTIA PenTest+ (exam PT0-003) and the EC-Council CEH (exam 312-50) both sit in the “ethical hacking” lane, but they pull toward different jobs. PenTest+ is built around the penetration testing workflow: scoping, reconnaissance, attacks, post-exploitation and reporting. It includes performance-based questions, and its largest block (35%) is attacks and exploits. The CEH is a broader tour of attack techniques and tools, taken as a 125-question multiple-choice exam, with a separate 6-hour hands-on CEH Practical that can lead to CEH Master. The CEH usually costs much more once training or vouchers are counted, and its eligibility needs either official EC-Council training or 2 years of information security experience plus a USD 100 application fee. If you want a hands-on, lower-cost proof of pentest skills, start with PenTest+. If a job posting, a contract or a government role names the CEH, take the CEH. Neither replaces practical lab work, and neither guarantees a job.
Key Takeaways
- Two different shapes of exam. PenTest+ has up to 90 questions (multiple choice plus performance-based) in 165 minutes. The CEH knowledge exam has 125 multiple-choice questions in 4 hours.
- PenTest+ is organized by the engagement. Its five domains follow a test from planning to reporting. The CEH is organized by attack topics and tools.
- Cost gap is large. One third-party guide lists CEH vouchers at about USD 950 (remote) and USD 1,199 (Pearson VUE), while CompTIA’s PenTest+ price was not on the page we reviewed. EC-Council does not set one price, so confirm with your training partner.
- Eligibility differs. CompTIA lists experience as recommended for PenTest+. EC-Council requires either official training or 2 years of information security experience with a USD 100 application fee.
- Hands-on proof is separate for CEH. The CEH Practical is a different exam. Passing both leads to CEH Master.
- Government and contractor roles need a check. Both vendors point to DoD 8140, but qualification depends on the work role and level, so verify against your component’s list.
- Neither guarantees a job. Employers also look at labs, write-ups and experience.
Quick Facts
| Item | CompTIA PenTest+ (PT0-003) | EC-Council CEH (312-50) |
| Issued by | CompTIA | EC-Council |
| Exam format | Up to 90 questions: multiple choice and performance-based | 125 multiple-choice questions |
| Time | 165 minutes | 4 hours |
| Passing score | 750 on a 100 to 900 scale | No single fixed score. EC-Council says cut scores vary by exam form (60% to 85% per its page). A third-party guide says about 70% |
| Content | 5 domains: Engagement Management 13%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Attacks and Exploits 35%, Post-exploitation and Lateral Movement 14% | Broad coverage of attack techniques across 20 modules per a third-party guide. Domain weights are in EC-Council’s blueprint |
| Prerequisites | None required. CompTIA recommends about 3 to 4 years in a pentester role plus Network+ and Security+ or equivalent knowledge | Official training, or 2 years of information security experience plus a USD 100 application fee |
| Hands-on component | Performance-based questions inside the exam | Separate 6-hour CEH Practical (20 challenges in a cyber range) |
| Top tier | None | CEH Master (both exams) |
| Exam price | Not listed on the page we reviewed. A student price of USD 240 appeared on a CompTIA FAQ page | About USD 950 (remote) or USD 1,199 (Pearson VUE) per one third-party guide. Varies by region and partner |
| Valid for | 3 years | 3 years |
| Renewal | 60 CEUs per CompTIA CE rules, with a fee unless you use a no-fee path (per a third-party summary) | EC-Council Continuing Education credits and membership (amounts not listed on the pages we reviewed) |
| Languages | English, French, Japanese and Portuguese | Check EC-Council |
What Is CompTIA PenTest+?
PenTest+ is CompTIA’s penetration testing certification. The current version, PT0-003, launched December 17, 2024. CompTIA’s page says candidates plan and scope a test, follow legal and ethical requirements, write reports with remediation advice, run reconnaissance and enumeration, discover and validate vulnerabilities, carry out attacks across network, host, web application, cloud and AI-related targets, and handle post-exploitation work such as persistence and lateral movement.
CompTIA recommends about 3 to 4 years in a penetration tester role plus Network+ and Security+ or equivalent knowledge. That is a recommendation, not a formal gate. If you are still building the base, our Network+ vs Security+ guide and SY0-701 vs SY0-801 guide cover the usual path. See CompTIA’s official PenTest+ page for current details.
What Is the EC-Council CEH?
The CEH, Certified Ethical Hacker, is EC-Council’s long-running ethical hacking certification. The knowledge exam is 125 multiple-choice questions over 4 hours. To sit for it, EC-Council says you must either complete its official training, or show at least 2 years of information security work experience with a verifier and pay a USD 100 non-refundable application fee. Approval is valid for 3 months, according to the page we reviewed.
The CEH has a second, separate exam: the CEH Practical, a 6-hour assessment with 20 challenges in a live cyber range. Passing both earns the CEH Master designation. A third-party source says the CEH is ANAB-accredited under ISO/IEC 17024 and listed in the DoD 8140 qualification matrix for several work roles. EC-Council’s own page notes the credential family sits in its continuing education scheme. Because DoD roles depend on work role and level, check your employer’s authorized list.
One point worth knowing: EC-Council’s own writing says the CEH “is not” a penetration testing course and points pentest-focused learners to a different program. Treat the CEH as an ethical hacking and attack-awareness credential first.
How Do the Exam Contents Compare?
PenTest+ follows a test from start to finish. The CEH surveys the attacker’s toolbox.
| Skill area | PenTest+ | CEH |
| Scoping, rules of engagement, legal and reporting | Engagement Management (13%) | Light coverage, per third-party guides |
| Reconnaissance and enumeration | 21% | Core module area |
| Vulnerability scanning and analysis | 17% (includes SAST and DAST) | Core module area |
| Exploitation across targets | Attacks and Exploits (35%) | Broad coverage of attack types and tools |
| Post-exploitation and lateral movement | 14% | Covered, per third-party guides |
| Cloud, web and wireless | Included inside the domains above | Dedicated modules per third-party guides |
| AI-related content | AI-related attacks appear in the domains | Introductory AI coverage across modules, per a third-party guide |
| Reporting and remediation advice | Explicitly tested | Less emphasis |
What this means: PenTest+ asks “what would you do next in an engagement?” The CEH asks “what is this attack and which tool does it?” If your goal is to work through a real test, PenTest+ aligns more closely. If your goal is broad attack and defense awareness, or to meet a posting that names CEH, the CEH fits.
How Do the Exam Formats Compare?
One mixes simulations into the exam. The other splits knowledge and hands-on into two exams.
- PenTest+: up to 90 questions in 165 minutes, with multiple-choice and performance-based items. The performance-based items ask you to complete a task, such as interpreting output or choosing steps. Passing is 750 on a 100 to 900 scale.
- CEH knowledge exam: 125 multiple-choice questions over 4 hours. EC-Council says the cut score varies by exam form. A third-party guide estimates about 60 percent conceptual recall and 40 percent scenario-based.
- CEH Practical: a separate 6-hour lab exam with 20 challenges. The price was not listed on the pages we reviewed.
- Retakes: one third-party guide lists CEH rules of no wait for the second attempt, 14 days before attempts 3 to 5, and a maximum of 5 attempts in 12 months. CompTIA’s page says you buy another voucher to retest. Confirm current policy with each vendor.
What Are the Requirements for Each?
PenTest+ lists recommendations. The CEH lists an eligibility gate.
| If you are… | PenTest+ | CEH |
| New to security with no experience | You can register, but CompTIA recommends Network+ and Security+ first | Not eligible by the experience route. Official training is the other route |
| Finishing a security training program | Can register | Eligible if it is official EC-Council training |
| 1 year in a SOC or help desk | Can register | Not eligible by the experience route yet (needs 2 years) |
| 2+ years in information security | Can register | Eligible with application and USD 100 fee |
| An experienced tester | Can register | Eligible, if the credential helps with employers or contracts |
Eligibility on paper is not the same as readiness. PenTest+ rewards candidates who have run scans, read tool output and written findings. If you have not done that, practice in a lab first.
How Much Do They Cost?
Count the whole path, not only the voucher.
| Cost item | PenTest+ | CEH |
| Exam | Not listed on the CompTIA page we reviewed. Check CompTIA’s store | About USD 950 (remote) or USD 1,199 (Pearson VUE) per a third-party guide. EC-Council says prices vary by region and partner |
| Application | None | USD 100 (self-study route) |
| Training | Optional | Often bundled with official training, which is a separate cost |
| Hands-on exam | Inside the exam | CEH Practical priced separately |
| Retake | A new voucher. Some bundles include a retake | Varies by partner |
| Renewal | 60 CEUs per CompTIA CE rules. A third-party summary lists a USD 150 total CE fee per 3-year cycle if you renew by CEU upload, with no-fee paths such as passing the latest exam or a higher certification that renews it | EC-Council continuing education credits and membership. The amounts were not listed on the pages we reviewed |
We do not quote a single total because prices vary by country, bundle and partner. Compare official quotes and ask your employer whether the exam is reimbursed.
Which Is Harder?
They are hard in different ways, and neither side publishes a fair difficulty measure.
PenTest+ tests whether you can reason through a task, so candidates without lab time struggle with the performance-based items. The CEH tests breadth, so candidates struggle with the volume of tools, attack types and terms. The CEH’s longer length and larger question count test stamina. We do not quote pass rates, since we found no official numbers.
Take a timed practice test for each exam style, and run a few labs, before you pay.
Which Fits Which Career Path?
| Your goal | Better fit | Why |
| Junior penetration tester | PenTest+ | The domains follow an engagement, and the exam includes performance-based items |
| SOC analyst moving toward offense | PenTest+ | Lower cost, and it reinforces scanning and attack reasoning |
| Meeting a posting or contract that names CEH | CEH | Requirements win over preference |
| Government or contractor role | Check the work role first | DoD 8140 mapping depends on role and level |
| Security generalist wanting attack awareness | CEH or PenTest+ | Either helps. Cost and eligibility decide |
| Proving hands-on skills beyond an exam | CEH Practical, or labs and write-ups | A lab-based credential or portfolio shows practice |
| Early career, still building fundamentals | Security+ first | Build the base before offensive certifications |
| Moving toward security leadership | Neither as the main step | See our SecurityX vs CISSP guide and CISSP vs CISM guide |
Decision Framework: Which Should You Take?
- Check the job postings you want. If they name CEH, PenTest+ or neither, follow the pattern.
- Check your eligibility. The CEH needs official training or 2 years of experience. PenTest+ has recommendations.
- Check your target employer. For government or contractor work, confirm which credential your work role accepts.
- Compare your budget. The CEH path can cost far more when training and the Practical are included.
- Compare how you prove skill. If you need a hands-on exam, PenTest+ has performance items and the CEH has a separate Practical.
- Check your fundamentals. If networking and Security+ topics are shaky, build them first.
- Plan for renewal. Both last 3 years and need continuing education.
Career Value
Certifications help a resume get noticed, but a lab portfolio and experience carry the interview. PenTest+ signals that you can follow a structured test and report on it. The CEH signals broad attack knowledge and is widely recognized by name. We do not quote salaries, since pay depends on region, employer and experience. Check postings for your target role and note which credential, if any, they name.
If you are mapping a longer path, our CISSP vs CCSP guide and ISC2 CC vs Security+ guide cover the entry and senior sides of the same field.
Study Plan Ideas
PenTest+ (about 8 to 12 weeks, our estimate):
- Weeks 1 to 2: engagement management, scoping, legal rules and report writing.
- Weeks 3 to 5: reconnaissance, enumeration and vulnerability scanning in a lab.
- Weeks 6 to 8: attacks and exploits (35% of the exam), with hands-on practice.
- Weeks 9 to 10: post-exploitation and lateral movement.
- Weeks 11 to 12: timed practice tests, including performance-based items.
CEH (about 10 to 14 weeks, our estimate):
- Weeks 1 to 3: footprinting, scanning and enumeration.
- Weeks 4 to 7: system hacking, malware, sniffing, social engineering and web attacks.
- Weeks 8 to 10: wireless, mobile, IoT, cloud and cryptography.
- Weeks 11 to 12: timed practice tests and a review of weak modules.
- If you plan the CEH Practical, add dedicated lab time.
Common Mistakes to Avoid
- Treating a certification as a replacement for labs. Employers want evidence of practice.
- Skipping eligibility rules. Check the CEH’s requirements before you budget.
- Ignoring total cost. Include training, the Practical and renewal.
- Assuming DoD acceptance. Check your work role and level.
- Using old exam versions. PenTest+ PT0-003 is current, and CompTIA typically retires a version about three years after launch.
- Practicing against systems you do not own. Use legal labs and authorized ranges only.
- Skipping fundamentals. Networking and security basics hold up both exams.
FAQS
Is CEH or PenTest+ better?
Neither wins for everyone. PenTest+ follows a pentest engagement and costs less to start. The CEH is widely named in postings and has a separate hands-on Practical.
Is PenTest+ easier than CEH?
We cannot say. PenTest+ tests task reasoning, and the CEH tests breadth. Take a practice test for each style.
How many questions are on PenTest+?
Up to 90 questions, multiple choice and performance-based, in 165 minutes, per CompTIA.
How many questions are on the CEH?
125 multiple-choice questions over 4 hours, per EC-Council.
What is the PenTest+ passing score?
750 on a 100 to 900 scale, per CompTIA.
What is the CEH passing score?
EC-Council says cut scores vary by exam form, with a range of 60% to 85% on its page.
Do I need experience for the CEH?
You need either official EC-Council training or 2 years of information security experience plus a USD 100 application fee.
Do I need experience for PenTest+?
CompTIA recommends about 3 to 4 years in a pentester role plus Network+ and Security+ or equivalent knowledge, but lists it as a recommendation.
How much does each exam cost?
CompTIA’s page we reviewed did not list a PenTest+ price. A third-party guide lists CEH vouchers around USD 950 to USD 1,199. Confirm on each vendor’s site.
What is CEH Master?
A designation earned by passing both the CEH knowledge exam and the 6-hour CEH Practical.
Does CEH satisfy DoD 8140?
A third-party source says the CEH is listed in the DoD 8140 matrix for several work roles, and CompTIA says PenTest+ V3 remains approved for the same work roles as the prior version. Qualification depends on your work role and level, so check your employer’s list.
How long do the certifications last?
Both are valid for 3 years and need continuing education to renew.
Should I get both?
You can, but most people choose one first based on postings, budget and eligibility.
Final Thoughts
If you want a lower-cost, engagement-shaped proof of pentest skills with hands-on items in the exam, PenTest+ is the practical starting point. If your target employer or contract names the CEH, or you want its broader attack coverage and a separate lab exam, take the CEH. Either way, build a lab portfolio, check current fees and rules on the vendor pages, and verify DoD roles with your employer before you pay.
