EC-Council · CEH
Certified Ethical Hacker (CEH) Practice Tests
Validates proficiency in ethical hacking techniques and tools across 20 security domains, including reconnaissance, network scanning, vulnerability analysis, system hacking, malware threats, social engineering, web application attacks, SQL injection, cryptography, and cloud and IoT security.
Exam Details
Practice Questions
594
≈ 4 practice exams
Duration
240 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Certified Ethical Hacker Practice Test
This Certified Ethical Hacker practice test helps you review reconnaissance, scanning, enumeration, exploitation concepts, web application attacks, malware, wireless security, cloud security, and defensive countermeasures. The goal is to improve your ability to identify the right technique or tool from a scenario, not simply remember labels.
Use the free questions to benchmark your starting point, then practice in focused sessions by reviewing every explanation after submission. CEH preparation benefits from repetition because many answer choices are close; understanding why the wrong options fail is essential for raising your score.
Exam Overview
The Certified Ethical Hacker (CEH), now in its 13th version (CEH v13), is EC-Council's flagship offensive security certification that validates a professional's ability to identify, exploit, and remediate vulnerabilities using the same tools and techniques as malicious hackers — but within a lawful, authorized context. Spanning 20 security domains and over 550 attack techniques, CEH v13 covers the full spectrum of ethical hacking methodology: from footprinting and reconnaissance through system hacking, malware analysis, social engineering, web application attacks, SQL injection, wireless network exploitation, and cloud and IoT security. The curriculum also integrates AI-driven hacking techniques, making CEH v13 the first ethical hacking certification to incorporate AI and machine learning as core competencies. Launched in September 2024, CEH v13 reflects the evolving threat landscape with updated modules on cloud environments (AWS, Azure), OT/ICS systems, and AI-powered offensive tools. The certification is globally recognized, listed on the U.S. Department of Defense (DoD) Approved Baseline Certifications list (DoD 8570/8140), and is administered through EC-Council's exam code 312-50.
Who Should Take This Exam
CEH is designed for mid-career IT and security professionals who want to formalize and validate their offensive security knowledge. Primary target roles include penetration testers, security analysts, SOC analysts, network security engineers, security auditors, security consultants, and IT managers responsible for defensive strategy. Candidates typically have a background in networking, operating systems, or system administration and are looking to transition into or advance within offensive and red-team security roles. The certification is also widely pursued by professionals in government, defense contracting, and financial services who need credentials recognized by the DoD or regulated-industry compliance frameworks.
Prerequisites
EC-Council does not enforce a formal degree requirement, but candidates must satisfy one of two eligibility paths. The first path requires completing an official EC-Council-accredited CEH training course, after which the candidate is automatically eligible to sit the exam. The second path allows self-study candidates with at least two years of verifiable information security work experience to apply directly by submitting an eligibility application form and paying a $100 non-refundable fee for EC-Council review. Regardless of path, candidates are strongly expected to have working knowledge of TCP/IP networking, Windows and Linux operating systems, and foundational security concepts. Familiarity with tools such as Nmap, Wireshark, and Metasploit is practically necessary to succeed on both the knowledge exam and the optional practical exam.
Exam Format
The CEH knowledge exam (exam code 312-50) consists of 125 multiple-choice questions to be completed in 240 minutes (4 hours). Questions are a mix of knowledge-based and scenario-based multiple-choice items. The exam is delivered either online via remote proctoring through EC-Council's portal or in person at Pearson VUE testing centers worldwide. Scoring uses a scaled model, meaning the exact passing threshold varies by exam form difficulty — typically falling between 60% and 85%, with approximately 70% as a general benchmark. The certification is valid for three years, after which holders must earn 120 EC-Council Continuing Education (ECE) credits or retake the exam. Separately, EC-Council offers the CEH Practical, a 6-hour, 20-challenge hands-on exam conducted in a live cyber range; passing both the knowledge exam and the practical earns the CEH Master designation.
Skills Measured
- 1.Introduction to Ethical Hacking: Covers security fundamentals (CIA triad, attack classification, threat vectors), the five phases of ethical hacking, penetration testing methodologies, and legal/regulatory frameworks governing authorized security testing.
- 2.Footprinting and Reconnaissance: OSINT techniques, Google dorking, WHOIS and DNS enumeration, Shodan queries, social media intelligence gathering, and tools such as Maltego and Recon-ng to build a target profile before active engagement.
- 3.Scanning Networks: Active host discovery, port scanning with Nmap, service and OS fingerprinting, banner grabbing, network topology mapping, and techniques to identify live systems and open attack surfaces.
- 4.Enumeration: Extracting detailed information from target systems including NetBIOS/SMB enumeration, SNMP walking, LDAP queries, NTP enumeration, and username/share harvesting from Windows and Linux environments.
- 5.Vulnerability Analysis: Vulnerability lifecycle, scoring systems (CVSS), and use of scanners such as Nessus, OpenVAS, and Nikto to identify and classify weaknesses in hosts, services, and applications.
- 6.System Hacking: Password cracking techniques (brute force, dictionary, pass-the-hash, rainbow tables), privilege escalation, maintaining persistent access via backdoors and rootkits, and log manipulation to cover tracks.
- 7.Malware Threats: Malware types (viruses, worms, Trojans, ransomware, fileless malware, APTs), creation concepts, evasion techniques, analysis methods (static and dynamic), and anti-malware strategies.
- 8.Sniffing: Passive and active network sniffing, ARP poisoning/spoofing, MAC flooding, DHCP attacks, DNS spoofing, and tools such as Wireshark and Ettercap.
- 9.Social Engineering: Human-based and computer-based social engineering attacks, phishing, vishing, pretexting, impersonation, insider threats, and countermeasures including security awareness programs.
- 10.Denial-of-Service: DoS and DDoS attack categories, volumetric/protocol/application-layer attacks, botnet structures, amplification attacks (DNS, NTP, SSDP), and detection/mitigation strategies.
- 11.Session Hijacking: TCP session hijacking, cookie theft, XSS-based session attacks, MITM techniques, and tools used to intercept or forge authenticated sessions.
- 12.Evading IDS, Firewalls, and Honeypots: Evasion techniques against signature-based and anomaly-based IDS/IPS, firewall rule bypass, tunneling, obfuscation, and honeypot identification.
- 13.Hacking Web Servers: Web server architecture vulnerabilities, misconfiguration exploitation, directory traversal, HTTP response splitting, banner grabbing, and tools such as Metasploit and w3af.
- 14.Hacking Web Applications: OWASP Top 10 vulnerabilities, authentication bypass, broken access control, IDOR, SSRF, XXE, command injection, and web application penetration testing methodology.
- 15.SQL Injection: In-band, blind, and out-of-band SQL injection techniques, error-based and time-based exploitation, automated tools (sqlmap), database fingerprinting, and mitigation via parameterized queries.
- 16.Hacking Wireless Networks: 802.11 standards, WEP/WPA/WPA2/WPA3 weaknesses, evil twin and rogue AP attacks, Bluetooth hacking, Wi-Fi analysis tools (Aircrack-ng, Kismet), and wireless security best practices.
- 17.Hacking Mobile Platforms: Android and iOS security architectures, mobile application vulnerabilities, OWASP Mobile Top 10, mobile device management (MDM) weaknesses, and mobile-specific attack vectors.
- 18.IoT and OT Hacking: IoT architecture attack surface, OT/ICS/SCADA security, MQTT and CoAP protocol vulnerabilities, device firmware analysis, Shodan-based IoT discovery, and industrial control system threats.
- 19.Cloud Computing: Shared responsibility model, cloud-specific threats (misconfigured S3 buckets, IAM misconfigurations, serverless vulnerabilities), container and Kubernetes security, and attacks against AWS, Azure, and GCP environments.
- 20.Cryptography: Symmetric and asymmetric encryption algorithms, PKI and digital certificates, hashing functions, cryptographic attacks (birthday, MITM, padding oracle), disk encryption, and practical use of cryptographic tools.
Study Tips
- Download and study the official CEH v13 exam blueprint (available on EC-Council's website) to understand the 20 domains. Cross-reference every topic in the blueprint against your study materials before the exam to ensure full coverage.
- Use EC-Council's official courseware or an authorized training partner — the official iClass platform includes labs mapped directly to exam objectives and gives you access to the same tools tested on the exam.
- Build a lab environment using free tools: set up Kali Linux in VirtualBox, deploy vulnerable VMs like Metasploitable and DVWA, and practice hands-on with Nmap, Metasploit, Wireshark, sqlmap, and Aircrack-ng, since scenario questions test applied knowledge.
- Focus extra preparation time on web application hacking (OWASP Top 10, SQL injection, XSS) and cloud security, as CEH v13 places significantly heavier weight on these areas compared to prior versions — together they can account for a substantial portion of the exam.
- Take full-length timed practice exams (125 questions in 4 hours) using reputable question banks such as those from Matt Walker's 'CEH Certified Ethical Hacker All-in-One Exam Guide' or EC-Council's official practice tests to build exam stamina and identify weak domains.
- Review the legal and methodology sections thoroughly — questions on the five phases of ethical hacking, penetration testing frameworks (PTES, OWASP Testing Guide), and relevant laws (CFAA, GDPR) appear regularly and are easy points if memorized.
- For CEH v13 specifically, study AI-assisted hacking concepts including how machine learning is used in vulnerability scanning, anomaly detection bypass, and automated exploitation — this new content area is unique to v13 and will be represented in the question pool.
Career Benefits
The CEH certification is one of the most widely recognized offensive security credentials globally, directly qualifying holders for roles such as penetration tester, security analyst, cybersecurity engineer, SOC analyst, security consultant, and information security manager. Salary data from PayScale and Glassdoor indicates CEH-certified professionals earn an average base salary ranging from approximately $86,000 to over $147,000 in the United States, with penetration testers typically earning $95,000–$145,000 and information security managers reaching $90,000–$175,000. CEH holders who transition from network administration roles report salary increases of up to 54% according to EC-Council data. The certification's inclusion on the U.S. Department of Defense Approved Baseline Certifications list (DoD 8570/8140) makes it a mandatory or strongly preferred credential for government, military, and defense contractor positions — an advantage not shared by many competing certifications. Compared to alternatives like CompTIA PenTest+ (entry-level) or OSCP (more hands-on/advanced), CEH occupies a well-recognized middle ground that balances breadth of knowledge with industry name recognition, making it particularly effective for professionals entering or advancing within offensive security who need a credential that resonates with HR and hiring managers across both the public and private sectors.
Sample Questions
5 sample questions with answers and explanations. The full bank has 594 questions, enough for 4 full-length practice exams.
Preview — answers shown1. A penetration tester successfully gains initial access to a network and wants to perform lateral movement by creating a pivot point. Using Meterpreter, they need to forward local port 3389 to an internal server at 10.10.10.50 to enable RDP access. Which command accomplishes this port forwarding? (Select one!)
Apivot -l 3389 -r 10.10.10.50 -p 3389
Bforward 3389 10.10.10.50 3389
Cportfwd -L 3389:10.10.10.50:3389
Dportfwd add -l 3389 -p 3389 -r 10.10.10.50
Explanation
The correct Meterpreter syntax for port forwarding is: portfwd add -l [local port] -p [remote port] -r [remote host]. This creates a local listener that forwards traffic to the specified remote host and port through the compromised system. The -L syntax resembles SSH port forwarding but is not valid in Meterpreter. There is no forward command in Meterpreter; the correct command is portfwd. The pivot command does not exist in Meterpreter; pivoting is accomplished through route and portfwd commands.
2. During an Android penetration test, a security researcher uses ADB to connect to a rooted device and wants to examine the application's local database for stored credentials. Where is the SQLite database typically located? (Select one!)
A/sdcard/Android/data/com.package.name/
B/data/data/com.package.name/databases/
C/data/app/com.package.name/lib/
D/system/app/com.package.name/
Explanation
Android applications store SQLite databases in the /data/data/com.package.name/databases/ directory within the application's private data directory. This requires root access to examine as normal users cannot access other applications' private data. The /sdcard/Android/data/ directory contains external storage accessible without root but typically does not hold sensitive databases. The /system/app/ directory contains system application APKs, not user data. The /data/app/ directory contains APK files and libraries, not runtime databases. Application sandboxing protects the /data/data/ directory from unauthorized access.
3. During enumeration, a penetration tester uses enum4linux to extract information from a Windows domain controller. Which command extracts the password policy including minimum password length and lockout thresholds? (Select one!)
Aenum4linux -P 192.168.1.10
Benum4linux -S 192.168.1.10
Cenum4linux -G 192.168.1.10
Denum4linux -U 192.168.1.10
Explanation
The -P flag in enum4linux specifically extracts password policy information from SMB/Samba systems, including minimum password length, password complexity requirements, lockout thresholds, and lockout duration. The -U flag enumerates users, -S enumerates shares, and -G enumerates groups. Password policy information is critical for attackers planning brute-force or password-spraying attacks, as it reveals how many failed attempts trigger account lockout and what password complexity requirements must be met.
4. A penetration tester is performing reconnaissance on a target organization. They need to identify all subdomains and email addresses associated with the target domain example.com without directly interacting with the target's infrastructure. Which tool should they use to gather this information from multiple public sources? (Select one!)
AtheHarvester with the -b all flag
BNmap with the -sV flag
CWireshark with display filters
DNikto with SSL enumeration
Explanation
theHarvester is specifically designed for passive reconnaissance and OSINT gathering from multiple sources including search engines, Shodan, and certificate transparency logs. The -b all flag queries all available data sources without directly contacting the target infrastructure. Nmap performs active scanning with direct target interaction. Nikto is a web vulnerability scanner requiring direct connection to web servers. Wireshark captures network traffic but does not perform reconnaissance gathering from public sources.
5. During a penetration test of an industrial control system, the tester identifies a Modbus TCP service running on port 502 without authentication. The tester wants to read holding registers from a PLC to understand the process control values. Which tool and command syntax should the tester use to safely interact with the Modbus service without disrupting operations? (Select one!)
AUse modbus-cli with command modbus read --address 40001 --count 10 to read 10 holding registers
BUse Wireshark with modbus dissector to passively capture and analyze existing Modbus traffic
CUse Nmap NSE script modbus-discover to identify all available function codes
DUse Metasploit module auxiliary/scanner/scada/modbusdetect to enumerate device information
Explanation
Passive traffic capture using Wireshark with the Modbus protocol dissector is the safest approach for initial reconnaissance of industrial control systems. This method observes existing legitimate traffic without sending any commands that could potentially disrupt operations, trigger safety systems, or alter process control values. The Metasploit modbusdetect module sends active probes which could affect operations. Using modbus-cli to read registers is an active operation that could potentially interfere with real-time control. Nmap scripts send packets to discover function codes, which is active scanning unsuitable for production ICS environments where safety is critical.
More EC-Council Practice Exams
Certified SOC Analyst (CSA)
CSA · 570 questions
Certified Threat Intelligence Analyst (CTIA)
CTIA · 740 questions
Certified Chief Information Security Officer (CCISO)
CCISO · 578 questions
Certified EC-Council Instructor (CEI)
CEI · 611 questions
Computer Hacking Forensic Investigator (CHFI)
CHFI · 589 questions
Certified Cloud Security Engineer (CCSE)
CCSE · 624 questions
$17.99
One-time access to this exam
594 questions (4 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available