- Which C)PTE This Article Covers
- The Number: 70% on 100 Questions
- What the Passing Grade Does Not Tell You
- Standard vs. Accredited: Do Not Mix Their Rules
- Unproctored Delivery and the Policy Wording Conflict
- Where Your Points Will Come From
- Scenario Thinking for a Knowledge Exam
- A Domain-Ordered Prep Sequence
- Attempts, Access Periods and Credential Validity
- Frequently Asked Questions
- The Standard C)PTE course outline specifies 100 multiple-choice questions, about two hours, and a minimum passing grade of 70%.
- Seventy percent of 100 questions is a target of 70 correct answers, assuming each question carries equal weight.
- The 62% passing figure and live proctoring belong to the separate C)PTE-A accredited exam, not the Standard exam.
- The Exam Combo includes an exam-preparation guide, a practice quiz and two attempts, so treat the first attempt seriously.
Which C)PTE This Article Covers
The acronym C)PTE is shared by several credentials, and mixing them up is the most common way candidates end up studying the wrong material. This article is about one credential only: the Certified Penetration Testing Engineer from Mile2, in its Standard form, using the 2026 preparation curriculum. It is not the Canadian Physiotherapy Examination, and it is not the separate C)PTE-A accredited examination that Mile2 also offers.
If you are still orienting yourself on what the credential is, start with What Is C)PTE Certification? and then return here. If your question is simply "what score do I need and how is the exam delivered?", you are in the right place.
The Number: 70% on 100 Questions
Mile2's current course outline for the Standard Certified Penetration Testing Engineer describes the knowledge exam in three parts: 100 multiple-choice questions, approximately two hours, and a minimum passing grade of 70%. That is the entire published scoring picture for the Standard exam, and it is worth being precise about what it does and does not say.
| Exam attribute | Standard C)PTE (Mile2) |
|---|---|
| Question format | Multiple choice |
| Number of questions | 100 |
| Time allowed | Approximately two hours |
| Minimum passing grade | 70% |
| Attempts in the Exam Combo | Two |
| Prerequisite course to sit the exam | None required |
Read plainly, a 70% minimum on a 100-question exam means 70 correct answers, provided every question carries the same weight. Mile2 does not publish a statement about unscored or experimental items, partial credit, or weighted questions for the Standard exam in the sources reviewed for this article, so planning around "70 right out of 100" is a sensible working assumption rather than a documented guarantee. Do not assume a scaled-score system, and do not assume a built-in curve; none is described.
What the Passing Grade Does Not Tell You
A single passing percentage invites a lot of speculation, and most of it is unsupported. Here is what you cannot conclude from the published numbers.
- It is not a pass rate. The 70% is the score you need, not the share of candidates who succeed. For what is and is not known about outcomes, see C)PTE Pass Rate 2026: What the Data Shows, and do not treat any unsourced figure you see elsewhere as established.
- It is not a domain-weighted threshold. The ten curriculum headings in the Detailed Outline are unweighted preparation headings. They are not an official ten-domain exam count, not a weighted blueprint, and not a guarantee that every heading is tested in equal proportion.
- It is not a per-domain minimum. Nothing in the sources describes a requirement to hit 70% in each domain. The stated requirement is an overall minimum passing grade.
- It does not measure hands-on skill. The course includes labs, but those labs are preparation. They are not a separately verified practical certification examination. The credential test itself is the multiple-choice knowledge exam.
That last point matters for how you prepare. Candidates coming from lab-heavy certifications sometimes over-invest in tooling muscle memory and under-invest in the conceptual breadth a 100-question multiple-choice exam rewards. If you want a frank read on difficulty, see How Hard Is the C)PTE Exam? Complete Difficulty Guide 2026.
Standard vs. Accredited: Do Not Mix Their Rules
This is where the most damaging mistakes happen. Mile2 offers the Standard C)PTE and, separately, an accredited version, C)PTE-A. They are different examinations with different rules, and the facts for one cannot be borrowed for the other.
| Topic | Standard C)PTE | C)PTE-A (accredited) |
|---|---|---|
| Passing requirement | Minimum 70% | 62% (do not apply to Standard) |
| Proctoring | Exam Combo describes online, on-demand delivery without a proctor | Live proctoring (do not apply to Standard) |
| Pricing | Not independently confirmed from retrievable listings | Separate; do not substitute |
| Scope of this article | Yes | No |
If you see a forum post saying "you only need 62%" or "you must book a live proctor," check which credential it describes. For the Standard exam, the working figure is 70%. For a fuller comparison of requirements, see C)PTE Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Key Takeaway
When a source quotes a C)PTE passing score, identify the credential first. The Standard exam's documented minimum is 70%; the accredited exam's different requirement does not carry over.
Unproctored Delivery and the Policy Wording Conflict
The Standard Exam Combo explicitly describes online, on-demand delivery through your Mile2 account without a proctor. That is the delivery model specific to the Standard product, and it is the one this article follows.
There is, however, a documented wrinkle. Mile2's general Policies and Procedures document, dated May 26, 2026, describes open-book testing but uses broader proctoring language than the Standard product page does. Those two statements do not line up cleanly. Rather than quietly resolving the conflict in either direction, the sensible reading is this: follow the instructions shown to you for the Standard exam inside your Mile2 account, and confirm the exact conditions before you begin, because you may have only two attempts and an avoidable misunderstanding about conditions is a costly way to lose one.
Whatever the delivery conditions turn out to be, an "open-book" description is not a reason to skip preparation. With roughly 72 seconds per question, you cannot look up the answer to many items and still finish. Knowledge you have internalized is what keeps you inside the time limit. For related logistics, see C)PTE Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Where Your Points Will Come From
Because the exam is unweighted as far as published sources go, the safest strategy is breadth: you need 70 correct answers across whatever mix of topics appears, so a gaping hole in one area can sink you even if another is strong. The ten Domain headings in Mile2's Detailed Outline are your map. They are a preparation outline, not an official exam blueprint, so treat them as coverage targets rather than predicted question counts. For a deeper walk-through, see C)PTE Exam Domains 2026: Complete Guide to All 10 Content Areas.
Domain 1: Penetration Testing Methodologies
Expect questions that test whether you understand how an engagement is structured, not just how a tool works.
- Authorized scope, rules of engagement and what to do when a target falls outside them
- Where each phase of a methodology starts and ends, and what artifacts it produces
- Why written authorization comes before any technical activity
Domain 2: Advanced Recon & Attack Surface Mapping
Reconnaissance questions reward knowing what each technique reveals and what it costs in noise.
- DNS enumeration and OSINT sources, and what each exposes about an organization
- Service reconnaissance and how to interpret what a banner or response implies
- Distinguishing passive collection from active probing
Domain 3: Exploitation Techniques (Local & Remote)
Know the difference between a local and a remote vector, and what conditions make each viable.
- Local privilege escalation concepts versus remote code execution concepts
- How misconfiguration, weak credentials and unpatched services differ as entry points
Domain 4: Post-Exploitation & Lateral Movement
Post-access questions are as much about discipline as technique.
- Moving between hosts, credential handling and persistence within agreed limits
- Cleanup: removing artifacts and restoring the environment after testing
Domain 5: Cloud & Active Directory Exploitation
Identity is where modern engagements are often decided.
- Entra ID, Microsoft 365 and hybrid identity concepts, including how on-premises and cloud trust relate
- Active Directory abuse paths and why identity misconfiguration compounds quickly
Domain 6: Evasion & Payload Crafting
Approach this as controlled-lab payload concepts: how payloads work and how defenses detect them.
- Payload types, delivery and staging concepts
- Why defenders' detections catch some techniques and miss others
Domain 7: Web, API & Mobile Attacks
Authorization failures are a recurring theme across all three surfaces.
- Broken access control patterns in web applications and APIs
- Mobile app trust boundaries between the device, the app and the backend
Domain 8: Threat Simulation & Attack Chains
Be able to place an action on a MITRE ATT&CK-style chain and explain what comes before and after it.
Domain 9: Purple Team Collaboration
Know how offensive and defensive teams work together to validate whether detections fire.
Domain 10: Reporting & Business Risk Analysis
Know how findings are written for a technical audience versus an executive one, and how technical severity translates into business risk. This domain is easy to under-study and easy to lose points on.
Scenario Thinking for a Knowledge Exam
Multiple-choice does not mean trivia. Many questions will describe a situation and ask for the best next step or the most likely explanation. Practicing with short original scenarios is the most efficient way to reach 70%.
Consider a scenario like this: a tester has a foothold on a workstation in a hybrid environment and finds a cached token for a Microsoft 365 account. The question is rarely "what tool dumps it?" It is more likely "is using this token within the rules of engagement, and what does it reveal about the trust between on-premises and cloud identity?" Candidates who studied only commands miss the scope-and-authorization layer; candidates who studied only theory miss the technical consequence.
Another pattern: an attack chain is described in prose, and you must identify which stage is missing or which defensive control would have interrupted it. Purple-team questions often follow the same shape: a technique ran, no alert fired, and you must identify what detection logic was absent. Build a habit of asking, for every technique you study, "what would a defender see, and where does this sit in the chain?"
A Domain-Ordered Prep Sequence
Rather than a generic schedule, sequence your preparation around how the domains depend on each other. Foundations first, then identity and chaining, then communication. For the broader plan, see C)PTE Study Guide 2026: How to Pass on Your First Attempt.
Methodology and reconnaissance
- Domain 1 and Domain 2: scope, rules of engagement, DNS/OSINT and service reconnaissance
- Why first: every later domain assumes you understand authorization and information gathering
Access and movement
- Domain 3 and Domain 4: local and remote exploitation, post-exploitation, cleanup
- Pair each technique with its cleanup step so they stick together
Identity, payloads and applications
- Domain 5, Domain 6 and Domain 7: Entra ID and hybrid identity, payload concepts, web/API/mobile authorization
- Spend extra time on identity; it connects most of the other topics
Chains, collaboration and reporting
- Domain 8, Domain 9 and Domain 10: attack chains, purple-team detection validation, technical and executive reporting
- Finish with a timed practice run against the clock, using the C)PTE practice test
Mile2 suggests, but does not require, background in C)PEH or equivalent knowledge, about 12 months of networking experience, sound TCP/IP knowledge, basic Linux knowledge and Microsoft security experience. Those are recommendations, not entry gates: no prerequisite course is required to sit the exam. If one of those recommended areas is weak for you, front-load it. More detail is in C)PTE Requirements 2026.
Attempts, Access Periods and Credential Validity
Several different clocks run in this process, and candidates routinely confuse them.
| Item | What it is | What it is not |
|---|---|---|
| Exam Combo | Exam-preparation guide, practice quiz and two attempts | A statement of the Standard exam price (not independently confirmed) |
| Ultimate Combo (optional) | One-year course access, videos, digital workbook, lab guide, two weeks of Cyber Range access and two exam attempts | A measure of how long your certification lasts |
| Five-day live course and 40 course CEUs | Training delivery details | Exam timing |
| Certification validity | Three-year cycle | The same as course, lab or voucher access periods |
Course access and lab access expire on their own schedules, independent of your certification. Likewise, an unused exam attempt does not extend your credential. For cost context, see C)PTE Certification Cost 2026: Complete Pricing Breakdown; note that the Standard exam price and optional training-bundle prices could not be independently confirmed from the retrievable issuer product listings, so verify current figures on Mile2's product pages directly rather than trusting an old promotional number.
Renewal after the first three years
Once you pass, the credential runs on a three-year cycle. Renewal is through 60 documented CEUs, the applicable renewal purchase, and ethics and policy compliance, or by passing the current full certification examination again. Mile2's FAQ quotes USD 200 for the U.S. regional CEU-route renewal fee and says annual membership is not required. Do not confuse that renewal figure with an exam price; it is a different fee for a different purpose.
Frequently Asked Questions
Mile2's current course outline specifies a minimum passing grade of 70% on a 100-question multiple-choice exam, which works out to 70 correct answers if all questions carry equal weight. Mile2 does not describe a scaled score for the Standard exam in the sources reviewed.
No. The 62% requirement belongs to the separate C)PTE-A accredited examination. For the Standard C)PTE, the documented minimum is 70%. Do not apply C)PTE-A rules, including its live proctoring, to the Standard exam.
The published requirement is an overall minimum passing grade. No per-domain minimum is described. The ten domain headings are unweighted preparation headings rather than an official weighted blueprint, so breadth across all of them is the safest approach.
The Standard Exam Combo includes two attempts, along with an exam-preparation guide and a practice quiz. Because attempts are limited, confirm the delivery conditions before starting and avoid treating the first try as a warm-up.
The credential test is a multiple-choice knowledge exam; course labs are preparation rather than a separately verified practical examination. For how employers view the credential, see C)PTE Jobs and Is the C)PTE Certification Worth It?. General penetration-tester salary data should not be read as a measured premium for C)PTE holders; see C)PTE Salary Guide 2026 for a careful treatment.