EC-Council · CEH

Certified Ethical Hacker (CEH) Practice Test

Validates proficiency in ethical hacking techniques and tools across 20 security domains, including reconnaissance, network scanning, vulnerability analysis, system hacking, malware threats, social engineering, web application attacks, SQL injection, cryptography, and cloud and IoT security.

Exam Details

Questions

594

Duration

240 minutes

Passing Score

70%

Difficulty

Associate

Last Updated

Feb 2026

Certified Ethical Hacker Practice Test

This Certified Ethical Hacker practice test helps you review reconnaissance, scanning, enumeration, exploitation concepts, web application attacks, malware, wireless security, cloud security, and defensive countermeasures. The goal is to improve your ability to identify the right technique or tool from a scenario, not simply remember labels.

Use the free questions to benchmark your starting point, then practice in focused sessions by reviewing every explanation after submission. CEH preparation benefits from repetition because many answer choices are close; understanding why the wrong options fail is essential for raising your score.

Exam Overview

The Certified Ethical Hacker (CEH), now in its 13th version (CEH v13), is EC-Council's flagship offensive security certification that validates a professional's ability to identify, exploit, and remediate vulnerabilities using the same tools and techniques as malicious hackers — but within a lawful, authorized context. Spanning 20 security domains and over 550 attack techniques, CEH v13 covers the full spectrum of ethical hacking methodology: from footprinting and reconnaissance through system hacking, malware analysis, social engineering, web application attacks, SQL injection, wireless network exploitation, and cloud and IoT security. The curriculum also integrates AI-driven hacking techniques, making CEH v13 the first ethical hacking certification to incorporate AI and machine learning as core competencies. Launched in September 2024, CEH v13 reflects the evolving threat landscape with updated modules on cloud environments (AWS, Azure), OT/ICS systems, and AI-powered offensive tools. The certification is globally recognized, listed on the U.S. Department of Defense (DoD) Approved Baseline Certifications list (DoD 8570/8140), and is administered through EC-Council's exam code 312-50.

Official exam page

Who Should Take This Exam

CEH is designed for mid-career IT and security professionals who want to formalize and validate their offensive security knowledge. Primary target roles include penetration testers, security analysts, SOC analysts, network security engineers, security auditors, security consultants, and IT managers responsible for defensive strategy. Candidates typically have a background in networking, operating systems, or system administration and are looking to transition into or advance within offensive and red-team security roles. The certification is also widely pursued by professionals in government, defense contracting, and financial services who need credentials recognized by the DoD or regulated-industry compliance frameworks.

Prerequisites

EC-Council does not enforce a formal degree requirement, but candidates must satisfy one of two eligibility paths. The first path requires completing an official EC-Council-accredited CEH training course, after which the candidate is automatically eligible to sit the exam. The second path allows self-study candidates with at least two years of verifiable information security work experience to apply directly by submitting an eligibility application form and paying a $100 non-refundable fee for EC-Council review. Regardless of path, candidates are strongly expected to have working knowledge of TCP/IP networking, Windows and Linux operating systems, and foundational security concepts. Familiarity with tools such as Nmap, Wireshark, and Metasploit is practically necessary to succeed on both the knowledge exam and the optional practical exam.

Exam Format

The CEH knowledge exam (exam code 312-50) consists of 125 multiple-choice questions to be completed in 240 minutes (4 hours). Questions are a mix of knowledge-based and scenario-based multiple-choice items. The exam is delivered either online via remote proctoring through EC-Council's portal or in person at Pearson VUE testing centers worldwide. Scoring uses a scaled model, meaning the exact passing threshold varies by exam form difficulty — typically falling between 60% and 85%, with approximately 70% as a general benchmark. The certification is valid for three years, after which holders must earn 120 EC-Council Continuing Education (ECE) credits or retake the exam. Separately, EC-Council offers the CEH Practical, a 6-hour, 20-challenge hands-on exam conducted in a live cyber range; passing both the knowledge exam and the practical earns the CEH Master designation.

Skills Measured

1.Introduction to Ethical Hacking: Covers security fundamentals (CIA triad, attack classification, threat vectors), the five phases of ethical hacking, penetration testing methodologies, and legal/regulatory frameworks governing authorized security testing.
2.Footprinting and Reconnaissance: OSINT techniques, Google dorking, WHOIS and DNS enumeration, Shodan queries, social media intelligence gathering, and tools such as Maltego and Recon-ng to build a target profile before active engagement.
3.Scanning Networks: Active host discovery, port scanning with Nmap, service and OS fingerprinting, banner grabbing, network topology mapping, and techniques to identify live systems and open attack surfaces.
4.Enumeration: Extracting detailed information from target systems including NetBIOS/SMB enumeration, SNMP walking, LDAP queries, NTP enumeration, and username/share harvesting from Windows and Linux environments.
5.Vulnerability Analysis: Vulnerability lifecycle, scoring systems (CVSS), and use of scanners such as Nessus, OpenVAS, and Nikto to identify and classify weaknesses in hosts, services, and applications.
6.System Hacking: Password cracking techniques (brute force, dictionary, pass-the-hash, rainbow tables), privilege escalation, maintaining persistent access via backdoors and rootkits, and log manipulation to cover tracks.
7.Malware Threats: Malware types (viruses, worms, Trojans, ransomware, fileless malware, APTs), creation concepts, evasion techniques, analysis methods (static and dynamic), and anti-malware strategies.
8.Sniffing: Passive and active network sniffing, ARP poisoning/spoofing, MAC flooding, DHCP attacks, DNS spoofing, and tools such as Wireshark and Ettercap.
9.Social Engineering: Human-based and computer-based social engineering attacks, phishing, vishing, pretexting, impersonation, insider threats, and countermeasures including security awareness programs.
10.Denial-of-Service: DoS and DDoS attack categories, volumetric/protocol/application-layer attacks, botnet structures, amplification attacks (DNS, NTP, SSDP), and detection/mitigation strategies.
11.Session Hijacking: TCP session hijacking, cookie theft, XSS-based session attacks, MITM techniques, and tools used to intercept or forge authenticated sessions.
12.Evading IDS, Firewalls, and Honeypots: Evasion techniques against signature-based and anomaly-based IDS/IPS, firewall rule bypass, tunneling, obfuscation, and honeypot identification.
13.Hacking Web Servers: Web server architecture vulnerabilities, misconfiguration exploitation, directory traversal, HTTP response splitting, banner grabbing, and tools such as Metasploit and w3af.
14.Hacking Web Applications: OWASP Top 10 vulnerabilities, authentication bypass, broken access control, IDOR, SSRF, XXE, command injection, and web application penetration testing methodology.
15.SQL Injection: In-band, blind, and out-of-band SQL injection techniques, error-based and time-based exploitation, automated tools (sqlmap), database fingerprinting, and mitigation via parameterized queries.
16.Hacking Wireless Networks: 802.11 standards, WEP/WPA/WPA2/WPA3 weaknesses, evil twin and rogue AP attacks, Bluetooth hacking, Wi-Fi analysis tools (Aircrack-ng, Kismet), and wireless security best practices.
17.Hacking Mobile Platforms: Android and iOS security architectures, mobile application vulnerabilities, OWASP Mobile Top 10, mobile device management (MDM) weaknesses, and mobile-specific attack vectors.
18.IoT and OT Hacking: IoT architecture attack surface, OT/ICS/SCADA security, MQTT and CoAP protocol vulnerabilities, device firmware analysis, Shodan-based IoT discovery, and industrial control system threats.
19.Cloud Computing: Shared responsibility model, cloud-specific threats (misconfigured S3 buckets, IAM misconfigurations, serverless vulnerabilities), container and Kubernetes security, and attacks against AWS, Azure, and GCP environments.
20.Cryptography: Symmetric and asymmetric encryption algorithms, PKI and digital certificates, hashing functions, cryptographic attacks (birthday, MITM, padding oracle), disk encryption, and practical use of cryptographic tools.

Study Tips

Download and study the official CEH v13 exam blueprint (available on EC-Council's website) to understand the 20 domains. Cross-reference every topic in the blueprint against your study materials before the exam to ensure full coverage.
Use EC-Council's official courseware or an authorized training partner — the official iClass platform includes labs mapped directly to exam objectives and gives you access to the same tools tested on the exam.
Build a lab environment using free tools: set up Kali Linux in VirtualBox, deploy vulnerable VMs like Metasploitable and DVWA, and practice hands-on with Nmap, Metasploit, Wireshark, sqlmap, and Aircrack-ng, since scenario questions test applied knowledge.
Focus extra preparation time on web application hacking (OWASP Top 10, SQL injection, XSS) and cloud security, as CEH v13 places significantly heavier weight on these areas compared to prior versions — together they can account for a substantial portion of the exam.
Take full-length timed practice exams (125 questions in 4 hours) using reputable question banks such as those from Matt Walker's 'CEH Certified Ethical Hacker All-in-One Exam Guide' or EC-Council's official practice tests to build exam stamina and identify weak domains.
Review the legal and methodology sections thoroughly — questions on the five phases of ethical hacking, penetration testing frameworks (PTES, OWASP Testing Guide), and relevant laws (CFAA, GDPR) appear regularly and are easy points if memorized.
For CEH v13 specifically, study AI-assisted hacking concepts including how machine learning is used in vulnerability scanning, anomaly detection bypass, and automated exploitation — this new content area is unique to v13 and will be represented in the question pool.

Career Benefits

The CEH certification is one of the most widely recognized offensive security credentials globally, directly qualifying holders for roles such as penetration tester, security analyst, cybersecurity engineer, SOC analyst, security consultant, and information security manager. Salary data from PayScale and Glassdoor indicates CEH-certified professionals earn an average base salary ranging from approximately $86,000 to over $147,000 in the United States, with penetration testers typically earning $95,000–$145,000 and information security managers reaching $90,000–$175,000. CEH holders who transition from network administration roles report salary increases of up to 54% according to EC-Council data. The certification's inclusion on the U.S. Department of Defense Approved Baseline Certifications list (DoD 8570/8140) makes it a mandatory or strongly preferred credential for government, military, and defense contractor positions — an advantage not shared by many competing certifications. Compared to alternatives like CompTIA PenTest+ (entry-level) or OSCP (more hands-on/advanced), CEH occupies a well-recognized middle ground that balances breadth of knowledge with industry name recognition, making it particularly effective for professionals entering or advancing within offensive security who need a credential that resonates with HR and hiring managers across both the public and private sectors.

Sample Questions

5 sample questions with answers and explanations. Start a practice session to test yourself across all 594 questions.

Preview — answers shown

1. A web application penetration test reveals that the application uses the following XML processing without validation: <?xml version='1.0'?><!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]><root>&xxe;</root>. When submitted, the application returns the contents of /etc/passwd in the response. Which vulnerability class is present, and what is the attack vector? (Select one!)

AServer-Side Template Injection in XML parsing engine

BSQL injection via XML-based database queries with malformed input

CXML External Entity (XXE) injection enabling local file disclosure

DLDAP injection through XML attribute manipulation

Explanation

XML External Entity (XXE) injection occurs when XML parsers process external entity references without proper validation. The DOCTYPE declaration defines an entity 'xxe' that references the file:// URI scheme to access local files. When the parser processes &xxe; entity reference, it replaces it with the content of /etc/passwd. XXE attacks enable local file disclosure, Server-Side Request Forgery (SSRF) to internal systems via http:// URIs, denial of service through billion laughs attacks, and remote code execution in some configurations. Out-of-band XXE uses protocols like ftp:// to exfiltrate data when responses are not displayed. SQL injection targets database queries, not XML parsing. LDAP injection manipulates LDAP queries through input fields but is unrelated to XML entity processing. Server-Side Template Injection (SSTI) exploits template engines like Jinja2 or Freemarker, not XML parsers. Proper defenses include disabling external entity processing, using simple data formats like JSON instead of XML, input validation, and applying least-privilege file system permissions.

2. An organization implements 3DES encryption for legacy system compatibility. What is the effective key strength when using 3DES with three independent keys? (Select one!)

A56 bits

B112 bits

C256 bits

D168 bits

Explanation

Despite 3DES using three 56-bit keys for a total of 168 bits, the effective security strength is only 112 bits due to meet-in-the-middle attacks. This is why 3DES is deprecated in modern security standards despite having a larger nominal key size than some current algorithms. The 56-bit strength represents single DES which is completely broken. While the total key material is 168 bits, this does not represent actual security strength. 256 bits represents AES-256, a completely different algorithm.

3. An attacker uses Nmap to scan a network and receives RST (reset) packets for every ACK probe sent to a target system regardless of port state. What information does this ACK scan reveal about the network security infrastructure? (Select one!)

ANo firewall is filtering packets; the host is unfiltered

BAll scanned ports are closed on the target system

CThe target system is offline or blocking ICMP packets

DA stateful firewall is blocking the initial SYN packets

Explanation

Nmap ACK scan (-sA) is specifically designed for firewall rule mapping, not port state detection. ACK scans send TCP packets with only the ACK flag set, which should normally be part of an established connection. When unfiltered hosts receive unexpected ACK packets, they respond with RST regardless of whether ports are open or closed, indicating no firewall is filtering the packets. Stateless firewalls may allow ACK packets through while blocking SYN packets, allowing attackers to map firewall rules. If a stateful firewall tracks connection state, it will drop ACK packets that are not part of established connections, resulting in no response (filtered state). The scan does not definitively determine if ports are open or closed, only filtered versus unfiltered. This technique helps identify firewall configurations and which ports are allowed through security devices. Window scan (-sW) provides similar functionality but analyzes TCP window size in RST responses. Proper stateful firewall configuration prevents ACK scan effectiveness.

4. During a Meterpreter session, an attacker wants to extract all credentials including plaintext passwords, hashes, and Kerberos tickets from a Windows system. Which Meterpreter commands should be executed? (Select two!)

Multiple correct answers

Ahashdump

Bload kiwi

Ccreds_all

Dgetsystem

Eclearev

Explanation

Loading the kiwi extension (Mimikatz integration) with load kiwi and then executing creds_all extracts all types of credentials including plaintext passwords from memory, NTLM hashes, and Kerberos tickets. This combination provides comprehensive credential harvesting. The hashdump command only extracts password hashes from SAM, not plaintext passwords or Kerberos tickets. The getsystem command escalates privileges but does not extract credentials. The clearev command clears event logs for anti-forensics.

5. An ethical hacker performs a TCP SYN scan using Nmap with the -sS flag against a target host. Port 80 responds with a SYN/ACK packet. How does Nmap complete the scan for this port? (Select one!)

ANmap sends an ACK packet to complete the three-way handshake

BNmap sends a NULL packet with no flags set to evade detection

CNmap waits for the target to send a FIN packet and then responds with FIN/ACK

DNmap sends a RST packet to tear down the connection without completing the handshake

Explanation

TCP SYN scan (stealth scan) is called half-open scanning because it never completes the three-way handshake. When Nmap receives a SYN/ACK response indicating an open port, it immediately sends a RST (reset) packet to tear down the connection before it is fully established. This prevents the connection from being logged by many application-level logging mechanisms and reduces detection. Completing the handshake with an ACK packet would make it a TCP Connect scan (-sT), not a SYN scan. FIN packets are used to gracefully close established connections, not during SYN scans. NULL packets with no flags set are a different scan type (-sN) used for firewall evasion.

More EC-Council Practice Exams

Certified Threat Intelligence Analyst (CTIA)

CTIA · 740 questions

Certified Cybersecurity Technician (CCT)

CCT · 630 questions

Certified Secure Computer User (CSCU)

CSCU · 630 questions

EC-Council Certified Encryption Specialist (ECES)

ECES · 627 questions

Ethical Hacking Essentials (EHE)

EHE · 627 questions

ICS/SCADA Cybersecurity

ICS-SCADA · 627 questions

$17.99

One-time access to this exam

Full access to all 594 questions

Or $15/mo for all 253 exams

Detailed explanations

Free preview stays available