Skip to content
CertGPS
Comparison

PenTest+ or OSCP: A Scenario Exam, a 24-Hour Practical, and Which Comes First

PenTest+ tests penetration testing knowledge in 165 minutes; OSCP has you break into machines for nearly a day. What each proves, where they overlap, and the order.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

PenTest+ or OSCP: A Scenario Exam, a 24-Hour Practical, and Which Comes First

PenTest+ asks which tool, attack or finding comes next. OSCP gives you a private network and 23 hours and 45 minutes to compromise it, then a day to write the report. PenTest+ checks that you know how an engagement works, and OSCP that you can carry one out alone. Which you take first depends on whether you can already root a lab machine you've never seen.

The numbers

PenTest+OSCP
IssuerCompTIAOffSec
FormatMultiple choice and performance-based questions (PT0-003)Proctored practical: three standalone machines and an Active Directory set of three, then a written report
Questions or targetsUp to 90 questionsSix machines, 100 points
Time165 minutes23 hours 45 minutes, plus 24 hours for the report
Passing score750 on a 100 to 900 scale70 of 100 points
Price$439 voucher; $579 with one retake$1,699 exam only; $1,749 with 90 days of PEN-200
ExperienceNone required; three to four years as a tester recommended, with Network+ and Security+ knowledgeNone required; TCP/IP, Windows and Linux administration and basic scripting recommended
RenewalThree years; 60 CEUs and $150 per cycleOSCP never expires; OSCP+ lasts three years. Extensions need annual coverage plus CPEs or a qualifying exam; $799 recertification without AMF issues a new three-year certification

What a pass tells an employer

A PenTest+ pass says you know the whole engagement on paper: scoping and rules of engagement, reconnaissance, attacks across Active Directory, web, cloud and AI systems, post-exploitation, and what belongs in the report. Questions are mostly scenarios, and some are performance-based tasks in a simulated environment. It doesn't show you can get a shell on a host nobody has described to you.

An OSCP pass says exactly that. Each standalone machine is worth 20 points, half for initial access and half for root or administrator, and the Active Directory set is worth 40, starting from a supplied domain account. The exam guide accepts no flag without a screenshot from an interactive shell showing the target's IP address, and a thin report can cost points or the whole exam.

CompTIA also lists PenTest+ against US Defense Department work roles: it's recognized for DoD 8140.03M roles such as exploitation analyst. For a contractor filling one of those seats, that can matter more than either exam's reputation.

The same targets, tested two ways

PenTest+ PT0-003 leans hard on Active Directory: its objectives name Impacket, CrackMapExec, Responder, BloodHound, Mimikatz and Rubeus, with pass-the-hash and Kerberos attacks. BloodHound, Impacket and Mimikatz are tools OSCP candidates use on the Active Directory set. A PenTest+ candidate who builds a small domain lab to prepare is doing the first weeks of OSCP preparation already.

The differences are in breadth and in rules. PenTest+ covers ground OSCP never touches: statements of work and authorization letters, testing frameworks, matching findings to controls, physical attacks, operational technology protocols such as Modbus, and prompt injection against AI systems. OSCP covers less but asks for all of it under pressure, and its restrictions shape how you work. You may use Metasploit against one machine only. Automatic exploitation tools such as SQLmap, mass scanners such as Nessus, and AI chatbots are banned. Nmap and Burp's free edition are allowed. PenTest+ will ask you which tool fits a situation. OSCP takes most of the automation away and has you do the work by hand.

Order, money and upkeep

For an analyst or administrator moving into offensive work, PenTest+ first is a sensible order. It's a quarter of the price of the cheapest OSCP route, it gives you a syllabus to work through, and its lab-heavy preparation feeds straight into PEN-200. CompTIA itself names OSCP among the advanced certifications to pursue after PenTest+. If you're still learning the basics, look at a shorter practical first; our eJPT and PenTest+ comparison covers that step.

If you already root unfamiliar lab machines every week, skip PenTest+ and put the $439 toward OSCP. The bundle's 90 days of PEN-200 is tight for most people, and OffSec's Learn One subscription costs $2,749 a year with two exam attempts.

Upkeep differs too. PenTest+ is valid for three years and renews with 60 CEUs and a $150 fee, or by passing a newer version or a higher CompTIA certification. OSCP itself is permanent. Since November 2024 a pass also brings OSCP+, which expires after three years unless you renew it, so the recurring cost is optional and depends on whether your employers ask for the "+". For what comes after both, see our penetration tester career progression.

Our view

If your job will be breaking into systems, OSCP is the credential that proves it, and we'd make it the target from the start. PenTest+ earns its place as the first step for someone coming from defense or administration who wants a structured syllabus and a credential in a few months, or who works in a DoD-mapped role where CompTIA's listing counts. What we wouldn't do is stop at PenTest+ and call the offensive skills proven. A reasonable tester might disagree and skip PenTest+ entirely, and if your lab work is already strong, that's the cheaper call.

Sources