Skip to content
CertGPS
Comparison

CEH or PenTest+: Similar Ground, Very Different Bills

PenTest+ vs CEH compared from the vendors' own pages: formats, the $439 and $1,050 entry prices, what each outline stresses, DoD 8140 standing and renewal overlap.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CEH or PenTest+: Similar Ground, Very Different Bills

CEH and PenTest+ both test whether you know how a penetration test runs, and both vendors say their exam counts for US Department of Defense (DoD) 8140 roles. The bills differ: CompTIA lists a PenTest+ voucher at $439, and EC-Council's self-study route to CEH costs a $100 application fee plus a $950 voucher. Unless a posting or contract names CEH, that gap usually settles it.

Prices, formats and renewal

CEHPenTest+
IssuerEC-CouncilCompTIA
FormatMultiple choice (exam 312-50); a separate six-hour CEH Practical is optionalMultiple choice and performance-based questions (PT0-003)
Questions125Up to 90
Time4 hours165 minutes
Passing scoreSet per exam form, between 60% and 85%750 on a 100 to 900 scale
Price$950 remote voucher plus $100 application; official training from $1,699$439 voucher; $579 with one retake
ExperienceOfficial training, or two years in information securityNone required; three to four years as a penetration tester recommended
Renewal3 years; 120 credits and an $80 annual fee3 years; 60 CEUs and a $150 fee per cycle

Where the outlines overlap and where they part

Both exams walk the same sequence: reconnaissance, scanning and enumeration, exploitation, then what an attacker does after getting in. The weighting differs. CompTIA puts 35% of PT0-003 on Attacks and Exploits, and 18 of its 24 objectives start "Given a scenario", so much of the exam asks what you'd do next on a specific engagement. The objectives name the Active Directory tooling a tester uses today: Impacket, BloodHound, Responder, Mimikatz and Rubeus.

CEH spreads itself wider and thinner. Blueprint v5.0 gives each of its 20 sub-domains six or seven questions, according to EC-Council's candidate handbook, so denial of service carries as many questions as SQL injection, and wireless, mobile, IoT and operational technology each get a share. The questions lean toward recall: which tool, which flag, which phase.

The biggest outline difference is the paperwork of a test. PenTest+ has a whole domain, Engagement Management at 13%, on rules of engagement, statements of work, authorization letters and the report's sections, and objective 1.5 asks you to match findings to remediating controls. CEH's nine domains are organized around attack techniques, and none of them is about scoping or reporting.

PenTest+ also mixes performance-based items into its 165 minutes. The CEH knowledge exam is multiple choice only; EC-Council keeps its hands-on test separate, as the CEH Practical, a $550 voucher for 20 challenges in six hours.

Who each suits

PenTest+ fits a SOC or vulnerability analyst moving toward offense, a consultant who runs authorized assessments and writes the reports, or anyone paying their own way. It also renews Security+ and Network+, because both sit below it in CompTIA's hierarchy, so one exam keeps three certifications current.

CEH fits when someone else has already decided: a government contract, a job posting or an employer training budget that names it. EC-Council states that both of its CEH exams are approved under DoD 8140. CompTIA says PenTest+ is recognized for DoD 8140.03M work roles including exploitation analyst. Check which credential your target work role lists before buying either.

Reading the vendors' claims

CompTIA's PenTest+ FAQ takes on CEH directly. It says PenTest+ "emphasizes intermediate hands-on skills" while CEH "focuses more on basic cybersecurity and pen testing knowledge", and that PenTest+ "is often seen as more practical and cost-effective". The cost half is plain arithmetic: $439 against $1,050. The practical half holds against the CEH knowledge exam but not against the CEH Practical, which puts you on live machines, as PenTest+ never does. For a full day spent compromising an unfamiliar network and then writing it up, look at OSCP instead.

Holding both

The renewal rules don't treat the two equally. EC-Council's CPE policy gives 40 credits for passing a certification exam related to IT security, so a PenTest+ pass covers a third of CEH's 120-credit cycle. CompTIA's list of outside certifications that count toward PenTest+ renewal doesn't include CEH. It does include EC-Council's Certified Penetration Testing Professional (CPENT) at 40 CEUs and CISSP at 60.

Neither credential waives a year of CISSP experience. ISC2's approved list includes Security+, CySA+ and SecurityX from CompTIA, but not PenTest+, and it includes nothing from EC-Council.

If you'll end up with both, take PenTest+ first. It's cheaper, it renews your lower CompTIA certifications, and its pass then earns credits toward CEH. For where either one leads, see CEH vs OSCP and our penetration testing certification guide.

Our pick

PenTest+ for anyone choosing freely. It covers the work as a tester does it, from scoping to the report, and costs well under half as much. A reader in a shop where every senior tester holds CEH may reasonably weigh that culture above the arithmetic. Otherwise we'd buy CEH only when a named requirement makes it the price of the job, and then add the $550 Practical, the only part of CEH that tests hands-on work.

Sources