- Why C)PTC Has No Fixed 2026 Exam Calendar
- How the Two-Part Assessment Shapes Your Timeline
- Purchase, Scheduling and Attempt Mechanics
- Reading the Rules for Your Exact Assessment
- Training Dates Versus Exam Dates
- Sequencing Your Preparation Around a Self-Chosen Date
- Three-Year Validity and Renewal Deadlines
- Pre-Booking Verification Checklist
- Frequently Asked Questions
- Mile2's current sources do not publish fixed 2026 testing windows for C)PTC; confirm scheduling details with the issuer before planning.
- Certification has two parts: a hands-on penetration test with a written report, then online MACS assessments.
- The knowledge exam is 100 multiple-choice questions, two hours, with a 70% requirement.
- Mile2 training is optional; the five-day course and its 40 CEUs are not exam timing.
Why C)PTC Has No Fixed 2026 Exam Calendar
Candidates searching for "C)PTC exam dates 2026" often expect a published calendar of testing windows, registration cut-offs and results dates, similar to what some cohort-based certifications publish. For the Certified Penetration Testing Consultant credential from Mile2, the issuer sources checked on October 2, 2026 did not present a fixed calendar of that kind. The materials we reviewed describe an assessment structure, an Exam Combo product, general policies and a renewal program, but they do not list dated testing windows for this credential.
That absence matters for planning. Rather than inventing dates, the useful approach is to understand what the issuer does document: how the certification assessment is structured, what the Exam Combo includes, which policies govern the exam, and how long the credential stays valid. Those details determine how you build a realistic timeline, even without a calendar to anchor it.
Because the credential is described in the issuer's materials without dated windows, treat any third-party page that lists specific 2026 "testing windows" for C)PTC with caution. Check the date against the issuer's own pages and ask Mile2 directly if anything is unclear. For a broader view of eligibility and prerequisites, see our guide to C)PTC requirements.
How the Two-Part Assessment Shapes Your Timeline
The most important scheduling fact is structural: the issuer's outline describes a two-part certification assessment. Your timeline is really two timelines, and they do not behave the same way.
Part One: The Hands-On Penetration Test
The first part is a practical penetration test. According to the outline, candidates must successfully exploit four of five lab systems, identify flags, and produce a complete written report. Note what is and is not verified here. The four-of-five exploitation requirement, the flag identification and the report are documented. A time limit for this practical component was not verified, so do not assume one, and do not trust third-party practical timers that claim to know it.
For scheduling purposes, this means you should plan the practical as work that needs unhurried blocks of time, plus report-writing time afterwards. The report is not an afterthought. Domain 12, Penetration Testing Report Writing, exists precisely because a successful exploit without a clear, remediation-focused write-up does not satisfy the requirement.
Part Two: Online Assessments Through MACS
The second part runs through Mile2's Assessment and Certification System (MACS). It comprises flag-selection questions and a 100-question multiple-choice knowledge examination. The knowledge examination allows two hours and requires 70%. The "Exam" line in the issuer's materials refers only to that written component. It does not describe the practical work, the report, or the flag-selection assessment, so the two-hour figure should never be applied to the whole certification process.
| Component | What the issuer describes | Timing detail verified? |
|---|---|---|
| Hands-on penetration test | Exploit four of five lab systems; identify flags; complete written report | No practical time limit verified |
| Flag-selection questions (MACS) | Online questions tied to the practical work | Not verified separately |
| Knowledge examination (MACS) | 100 multiple-choice questions; 70% required | Two hours |
If you are weighing the difficulty of each part, our article on how hard the C)PTC exam is breaks down where candidates tend to feel pressure, and the C)PTC passing score guide covers the 70% requirement in more depth.
Purchase, Scheduling and Attempt Mechanics
Mile2 sells an Exam Combo for this credential. According to the issuer's materials, the combo includes an exam-preparation guide, practice questions or a simulator, and two exam attempts. Two attempts is a planning-relevant detail: it affects how aggressively you should schedule your first sitting and how much time to leave before a second try if needed.
One of the most useful scheduling facts from the issuer is that purchasing or completing Mile2 training is not mandatory. You can buy the exam path without the course. That removes the course calendar as a gating item: you are not waiting for a live class date before you can attempt certification. What you are doing instead is deciding for yourself when you are ready.
The issuer's suggested preparation, which is guidance rather than a hard prerequisite, includes familiarity with C)PEH and C)PTE material or equivalent knowledge, two years of networking experience, sound TCP/IP knowledge and computer-hardware knowledge. Use that list as a readiness filter before you commit to a date. If TCP/IP fundamentals feel shaky, fix that first, because every one of the twelve curriculum headings assumes you can reason about network behavior.
Reading the Rules for Your Exact Assessment
Candidates frequently ask whether C)PTC is proctored, open-book, or on-demand. The honest answer is that the issuer's documents differ in tone and you should follow the instructions assigned to your specific assessment.
- Mile2's general Policies and Procedures document, dated May 26, 2026, describes open-book examinations but uses broad proctoring language.
- The current FAQ describes most standard exams as on-demand without a live proctor.
- Neither general statement should be read as a blanket rule for every component of the C)PTC certification assessment.
The practical takeaway: when you receive your assessment instructions through MACS, treat those as controlling. Do not assume that because one document says "open-book" you can skip structured preparation, and do not assume that because the FAQ says "no live proctor" every part of the process is unmonitored. Read the instructions presented for each component before you start the clock on anything.
Key Takeaway
Before you begin any portion of the assessment, screenshot or save the instructions MACS gives you for that component. If a general policy and your assigned instructions seem to conflict, the instructions for your exact assessment are the ones to follow, and the issuer is the party to ask.
Training Dates Versus Exam Dates
It is easy to conflate the course with the exam, and many third-party pages do. Keep them separate:
- The five-day course is a training format. The 40 CEUs attached to it are training credit measures.
- Neither the five days nor the 40 CEUs describe examination timing. The only verified examination time limit is the two hours for the knowledge exam.
- Training is optional. You can pursue certification through the Exam Combo without it.
If you do choose structured training, see our overview of C)PTC training to decide whether a class fits your schedule. Candidates with strong exploitation backgrounds sometimes skip the course and go straight to self-directed lab work and the study guide. Candidates newer to stack-based exploitation often benefit from guided instruction before they commit to an attempt.
Sequencing Your Preparation Around a Self-Chosen Date
Without an issuer-published calendar, you control the date, which means you control the risk. The sensible way to choose it is to work backwards from the content. The twelve headings in the issuer's Detailed Outline are unweighted curriculum headings, not a weighted blueprint, so you should not skip any on the assumption that it counts for less. They do, however, fall into natural clusters that suggest an order.
Cluster 1: Methodology and Reconnaissance (Domains 1 and 2)
Pentesting Team Foundation and NMAP Automation set the frame for authorized-lab work.
- Project metrics and team roles in an authorized engagement
- Interpreting NMAP reports rather than merely running scans
- Automating scans so results feed later exploitation decisions
Cluster 2: Exploitation Fundamentals (Domains 3, 4 and 5)
Exploitation Processes, Fuzzing with Spike and Privilege Escalation form the core of the practical.
- Reviewing exploitation steps and documenting what worked
- Spike fuzzing concepts for finding crash conditions
- Privilege escalation review on both Windows and Linux targets
Cluster 3: Memory Corruption and Protections (Domains 6 through 11)
This is the densest stretch and the one that rewards the most lab repetition.
- Stack Based Windows Buffer Overflow concepts
- Linux Stack Smashing and Linux Address Space Layout Randomization
- Windows Exploit Protection, including DEP, SEH, SafeSEH and SEHOP
- Getting Around SEH and ASLR (Windows)
Cluster 4: Web and Reporting (Domains 7 and 12)
Web Application Security and Exploitation references OWASP Top 10-2017 in the outline, and Penetration Testing Report Writing ties everything to remediation.
- Recognize that the outline is undated and cites the 2017 OWASP list; it should not be treated as a newly updated 2026 syllabus
- Practice writing findings that name a fix, not just an exploit
A Week-by-Week Shape Tied to Those Clusters
If you are working toward a self-chosen date, an eight-week shape that respects the clusters might look like this. It is a scaffold, not an issuer requirement.
Methodology and NMAP
- Domain 1 and Domain 2 reading and lab scans
- Practice reading scan output and deciding next steps
Exploitation, Spike and Escalation
- Domains 3, 4 and 5
- Build repeatable notes for each exploited system
Memory Corruption Block
- Domains 6, 8, 9, 10 and 11
- Repeat Windows and Linux stack exercises until the steps are fluent
Web and Reporting
- Domains 7 and 12
- Draft a full sample report from a lab you completed
Knowledge Exam Rehearsal
- Timed sets of multiple-choice practice against the two-hour limit
- Review weak domains and confirm your assessment instructions
Place the memory-corruption block in the middle rather than at the end, because it is the material most likely to need a second pass. For deeper study structure, our C)PTC study guide expands on resources and pacing, and the C)PTC cheat sheet is useful for the final-week review. You can also test your recall with timed questions on the main practice test site.
Three-Year Validity and Renewal Deadlines
The only dated cycle that applies to C)PTC holders after certification is the renewal cycle. Per the issuer, certification has a three-year validity period. There are two documented routes to renew:
- CEU route: Document 60 CEUs over the three-year cycle, complete the applicable renewal purchase, and comply with ethics and policy requirements.
- Exam route: Pass the current full certification examination as an alternative.
Mile2's FAQ lists USD 200 as the U.S. regional fee for the CEU-route renewal. That figure is a renewal fee, not the initial exam fee, and it should not be confused with the cost of first-time certification. The FAQ also says annual membership is not required.
| Renewal element | Detail from issuer materials |
|---|---|
| Validity period | Three years |
| CEU route requirement | 60 documented CEUs, applicable renewal purchase, ethics/policy compliance |
| Alternative route | Pass the current full certification examination |
| CEU-route fee (U.S. regional) | USD 200, per the FAQ; not the initial exam fee |
| Annual membership | Not required |
From a planning standpoint, begin logging CEUs early in the cycle instead of scrambling in year three. If you expect to fall short of 60, the full-exam route is your fallback, and you should build in preparation time for it. For longer-term value questions, see whether the C)PTC is worth it and our overview of C)PTC jobs.
Pre-Booking Verification Checklist
Since there is no published calendar to lean on, build your own verification routine before you purchase or begin:
- Confirm the current Exam Combo price and inclusions on Mile2's own product and exam-combo pages.
- Confirm that your package includes the two attempts and ask how the second attempt is scheduled.
- Ask what instructions and any time constraints apply to the practical test, report and flag-selection components, since a practical time limit was not verified in the sources reviewed.
- Read the Policies and Procedures document and the FAQ, then follow the instructions assigned to your exact assessment.
- Decide whether you need training or whether your background already covers the suggested preparation.
- Note the three-year renewal clock from the day you certify.
If you are still orienting yourself to the credential, our explainers on what C)PTC certification is and what C)PTC stands for give useful background, and the C)PTC pass rate article explains why published pass-rate numbers should be handled carefully.
Frequently Asked Questions
The issuer sources reviewed did not publish fixed 2026 testing windows for this credential. They describe the assessment structure, the Exam Combo and renewal rules, but no dated calendar. Confirm any scheduling specifics directly with Mile2 before planning around a date.
The written knowledge examination is 100 multiple-choice questions with a two-hour allowance and a 70% requirement. That timing applies only to this written component, not to the hands-on penetration test, the report or the flag-selection assessment.
No. Purchasing or completing Mile2 training is not mandatory. The suggested preparation includes C)PEH and C)PTE or equivalent knowledge, two years of networking experience, sound TCP/IP knowledge and computer-hardware knowledge, but these are recommendations rather than hard prerequisites.
The Exam Combo includes an exam-preparation guide, practice questions or a simulator, and two exam attempts. The current initial package price could not be independently confirmed, so check Mile2's listing for the live figure.
Certification has a three-year validity cycle. You can renew by documenting 60 CEUs, making the applicable renewal purchase and complying with ethics and policy requirements, or by passing the current full certification examination. The FAQ lists USD 200 as the U.S. regional CEU-route fee.