EC-Council · CEH
Certified Ethical Hacker (CEH) Practice Tests
Validates proficiency in ethical hacking techniques and tools across 20 security domains, including reconnaissance, network scanning, vulnerability analysis, system hacking, malware threats, social engineering, web application attacks, SQL injection, cryptography, and cloud and IoT security.
Exam Details
Practice Questions
594
≈ 4 practice exams
Duration
240 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
Certified Ethical Hacker Practice Test
This Certified Ethical Hacker practice test helps you review reconnaissance, scanning, enumeration, exploitation concepts, web application attacks, malware, wireless security, cloud security, and defensive countermeasures. The goal is to improve your ability to identify the right technique or tool from a scenario, not simply remember labels.
Use the free questions to benchmark your starting point, then practice in focused sessions by reviewing every explanation after submission. CEH preparation benefits from repetition because many answer choices are close; understanding why the wrong options fail is essential for raising your score.
Exam Overview
The Certified Ethical Hacker (CEH), now in its 13th version (CEH v13), is EC-Council's flagship offensive security certification that validates a professional's ability to identify, exploit, and remediate vulnerabilities using the same tools and techniques as malicious hackers — but within a lawful, authorized context. Spanning 20 security domains and over 550 attack techniques, CEH v13 covers the full spectrum of ethical hacking methodology: from footprinting and reconnaissance through system hacking, malware analysis, social engineering, web application attacks, SQL injection, wireless network exploitation, and cloud and IoT security. The curriculum also integrates AI-driven hacking techniques, making CEH v13 the first ethical hacking certification to incorporate AI and machine learning as core competencies. Launched in September 2024, CEH v13 reflects the evolving threat landscape with updated modules on cloud environments (AWS, Azure), OT/ICS systems, and AI-powered offensive tools. The certification is globally recognized, listed on the U.S. Department of Defense (DoD) Approved Baseline Certifications list (DoD 8570/8140), and is administered through EC-Council's exam code 312-50.
Who Should Take This Exam
CEH is designed for mid-career IT and security professionals who want to formalize and validate their offensive security knowledge. Primary target roles include penetration testers, security analysts, SOC analysts, network security engineers, security auditors, security consultants, and IT managers responsible for defensive strategy. Candidates typically have a background in networking, operating systems, or system administration and are looking to transition into or advance within offensive and red-team security roles. The certification is also widely pursued by professionals in government, defense contracting, and financial services who need credentials recognized by the DoD or regulated-industry compliance frameworks.
Prerequisites
EC-Council does not enforce a formal degree requirement, but candidates must satisfy one of two eligibility paths. The first path requires completing an official EC-Council-accredited CEH training course, after which the candidate is automatically eligible to sit the exam. The second path allows self-study candidates with at least two years of verifiable information security work experience to apply directly by submitting an eligibility application form and paying a $100 non-refundable fee for EC-Council review. Regardless of path, candidates are strongly expected to have working knowledge of TCP/IP networking, Windows and Linux operating systems, and foundational security concepts. Familiarity with tools such as Nmap, Wireshark, and Metasploit is practically necessary to succeed on both the knowledge exam and the optional practical exam.
Exam Format
The CEH knowledge exam (exam code 312-50) consists of 125 multiple-choice questions to be completed in 240 minutes (4 hours). Questions are a mix of knowledge-based and scenario-based multiple-choice items. The exam is delivered either online via remote proctoring through EC-Council's portal or in person at Pearson VUE testing centers worldwide. Scoring uses a scaled model, meaning the exact passing threshold varies by exam form difficulty — typically falling between 60% and 85%, with approximately 70% as a general benchmark. The certification is valid for three years, after which holders must earn 120 EC-Council Continuing Education (ECE) credits or retake the exam. Separately, EC-Council offers the CEH Practical, a 6-hour, 20-challenge hands-on exam conducted in a live cyber range; passing both the knowledge exam and the practical earns the CEH Master designation.
Skills Measured
- 1.Introduction to Ethical Hacking: Covers security fundamentals (CIA triad, attack classification, threat vectors), the five phases of ethical hacking, penetration testing methodologies, and legal/regulatory frameworks governing authorized security testing.
- 2.Footprinting and Reconnaissance: OSINT techniques, Google dorking, WHOIS and DNS enumeration, Shodan queries, social media intelligence gathering, and tools such as Maltego and Recon-ng to build a target profile before active engagement.
- 3.Scanning Networks: Active host discovery, port scanning with Nmap, service and OS fingerprinting, banner grabbing, network topology mapping, and techniques to identify live systems and open attack surfaces.
- 4.Enumeration: Extracting detailed information from target systems including NetBIOS/SMB enumeration, SNMP walking, LDAP queries, NTP enumeration, and username/share harvesting from Windows and Linux environments.
- 5.Vulnerability Analysis: Vulnerability lifecycle, scoring systems (CVSS), and use of scanners such as Nessus, OpenVAS, and Nikto to identify and classify weaknesses in hosts, services, and applications.
- 6.System Hacking: Password cracking techniques (brute force, dictionary, pass-the-hash, rainbow tables), privilege escalation, maintaining persistent access via backdoors and rootkits, and log manipulation to cover tracks.
- 7.Malware Threats: Malware types (viruses, worms, Trojans, ransomware, fileless malware, APTs), creation concepts, evasion techniques, analysis methods (static and dynamic), and anti-malware strategies.
- 8.Sniffing: Passive and active network sniffing, ARP poisoning/spoofing, MAC flooding, DHCP attacks, DNS spoofing, and tools such as Wireshark and Ettercap.
- 9.Social Engineering: Human-based and computer-based social engineering attacks, phishing, vishing, pretexting, impersonation, insider threats, and countermeasures including security awareness programs.
- 10.Denial-of-Service: DoS and DDoS attack categories, volumetric/protocol/application-layer attacks, botnet structures, amplification attacks (DNS, NTP, SSDP), and detection/mitigation strategies.
- 11.Session Hijacking: TCP session hijacking, cookie theft, XSS-based session attacks, MITM techniques, and tools used to intercept or forge authenticated sessions.
- 12.Evading IDS, Firewalls, and Honeypots: Evasion techniques against signature-based and anomaly-based IDS/IPS, firewall rule bypass, tunneling, obfuscation, and honeypot identification.
- 13.Hacking Web Servers: Web server architecture vulnerabilities, misconfiguration exploitation, directory traversal, HTTP response splitting, banner grabbing, and tools such as Metasploit and w3af.
- 14.Hacking Web Applications: OWASP Top 10 vulnerabilities, authentication bypass, broken access control, IDOR, SSRF, XXE, command injection, and web application penetration testing methodology.
- 15.SQL Injection: In-band, blind, and out-of-band SQL injection techniques, error-based and time-based exploitation, automated tools (sqlmap), database fingerprinting, and mitigation via parameterized queries.
- 16.Hacking Wireless Networks: 802.11 standards, WEP/WPA/WPA2/WPA3 weaknesses, evil twin and rogue AP attacks, Bluetooth hacking, Wi-Fi analysis tools (Aircrack-ng, Kismet), and wireless security best practices.
- 17.Hacking Mobile Platforms: Android and iOS security architectures, mobile application vulnerabilities, OWASP Mobile Top 10, mobile device management (MDM) weaknesses, and mobile-specific attack vectors.
- 18.IoT and OT Hacking: IoT architecture attack surface, OT/ICS/SCADA security, MQTT and CoAP protocol vulnerabilities, device firmware analysis, Shodan-based IoT discovery, and industrial control system threats.
- 19.Cloud Computing: Shared responsibility model, cloud-specific threats (misconfigured S3 buckets, IAM misconfigurations, serverless vulnerabilities), container and Kubernetes security, and attacks against AWS, Azure, and GCP environments.
- 20.Cryptography: Symmetric and asymmetric encryption algorithms, PKI and digital certificates, hashing functions, cryptographic attacks (birthday, MITM, padding oracle), disk encryption, and practical use of cryptographic tools.
Study Tips
- Download and study the official CEH v13 exam blueprint (available on EC-Council's website) to understand the 20 domains. Cross-reference every topic in the blueprint against your study materials before the exam to ensure full coverage.
- Use EC-Council's official courseware or an authorized training partner — the official iClass platform includes labs mapped directly to exam objectives and gives you access to the same tools tested on the exam.
- Build a lab environment using free tools: set up Kali Linux in VirtualBox, deploy vulnerable VMs like Metasploitable and DVWA, and practice hands-on with Nmap, Metasploit, Wireshark, sqlmap, and Aircrack-ng, since scenario questions test applied knowledge.
- Focus extra preparation time on web application hacking (OWASP Top 10, SQL injection, XSS) and cloud security, as CEH v13 places significantly heavier weight on these areas compared to prior versions — together they can account for a substantial portion of the exam.
- Take full-length timed practice exams (125 questions in 4 hours) using reputable question banks such as those from Matt Walker's 'CEH Certified Ethical Hacker All-in-One Exam Guide' or EC-Council's official practice tests to build exam stamina and identify weak domains.
- Review the legal and methodology sections thoroughly — questions on the five phases of ethical hacking, penetration testing frameworks (PTES, OWASP Testing Guide), and relevant laws (CFAA, GDPR) appear regularly and are easy points if memorized.
- For CEH v13 specifically, study AI-assisted hacking concepts including how machine learning is used in vulnerability scanning, anomaly detection bypass, and automated exploitation — this new content area is unique to v13 and will be represented in the question pool.
Career Benefits
The CEH certification is one of the most widely recognized offensive security credentials globally, directly qualifying holders for roles such as penetration tester, security analyst, cybersecurity engineer, SOC analyst, security consultant, and information security manager. Salary data from PayScale and Glassdoor indicates CEH-certified professionals earn an average base salary ranging from approximately $86,000 to over $147,000 in the United States, with penetration testers typically earning $95,000–$145,000 and information security managers reaching $90,000–$175,000. CEH holders who transition from network administration roles report salary increases of up to 54% according to EC-Council data. The certification's inclusion on the U.S. Department of Defense Approved Baseline Certifications list (DoD 8570/8140) makes it a mandatory or strongly preferred credential for government, military, and defense contractor positions — an advantage not shared by many competing certifications. Compared to alternatives like CompTIA PenTest+ (entry-level) or OSCP (more hands-on/advanced), CEH occupies a well-recognized middle ground that balances breadth of knowledge with industry name recognition, making it particularly effective for professionals entering or advancing within offensive security who need a credential that resonates with HR and hiring managers across both the public and private sectors.
Sample Questions
5 sample questions with answers and explanations. The full bank has 594 questions, enough for 4 full-length practice exams.
Preview — answers shown1. A penetration tester uses Maltego to perform reconnaissance on a target organization. After running transforms on a domain entity, the tool discovers multiple email addresses, social media profiles, and document metadata. Which type of reconnaissance technique is the tester performing? (Select one!)
AActive reconnaissance using network scanning
BSemi-passive reconnaissance with DNS zone transfers
CIntrusive reconnaissance with vulnerability exploitation
DPassive reconnaissance using OSINT
Explanation
Passive reconnaissance using OSINT (Open Source Intelligence) gathers information from publicly available sources without directly interacting with the target systems. Maltego specializes in transforming entities like domains into related information such as email addresses, social media profiles, and metadata by querying public databases and search engines. Active reconnaissance involves direct interaction like port scanning. DNS zone transfers are active techniques that directly query DNS servers. Intrusive reconnaissance involves exploiting vulnerabilities which goes beyond information gathering.
2. An ethical hacker performs a TCP ACK scan using Nmap against a target network to map firewall rules. The scan results show some ports as unfiltered and others as filtered. How should the results be interpreted? (Select one!)
AUnfiltered ports are behind a stateful firewall, filtered ports are protected by IDS
BUnfiltered ports are open and accepting connections, filtered ports are closed
CUnfiltered ports accept ACK packets, filtered ports only accept SYN packets
DUnfiltered ports responded with RST packets indicating no firewall blocking, filtered ports received no response indicating firewall presence
Explanation
TCP ACK scan (-sA) sends packets with only the ACK flag set to determine firewall rules, not port states. Unfiltered means the port responded with RST packet indicating no firewall blocking those packets. Filtered means no response received, suggesting a firewall dropped the packet. ACK scans cannot determine if ports are open or closed, only filtered vs unfiltered. Stateful firewalls track connections and typically drop unsolicited ACK packets. This scan is specifically for firewall rule mapping, not service detection.
3. An ethical hacker needs to identify live hosts on a target network segment without performing port scans. They want to use Nmap for host discovery only. Which Nmap flag performs a ping scan without conducting port scanning? (Select one!)
A-Pn
B-sP
C-PS
D-sn
Explanation
The -sn flag (formerly -sP) performs host discovery only without scanning ports, making it ideal for quickly identifying live hosts on a network. The -Pn flag disables ping and treats all hosts as online, then proceeds to port scanning. The -PS flag performs TCP SYN discovery on specified ports but is not exclusively for host discovery. While -sP was the original syntax, it has been deprecated in favor of -sn in current Nmap versions.
4. A company implements IPsec VPN with ESP protocol. During a security assessment, the tester captures network traffic between VPN endpoints. What information remains visible to the attacker despite ESP encryption? (Select one!)
AAuthentication credentials and pre-shared keys
BSource and destination IP addresses in the outer IP header
COriginal IP headers and all packet contents
DPayload data and application layer protocols being transmitted
Explanation
ESP (Encapsulating Security Payload) encrypts the payload and ESP trailer but does not encrypt the outer IP header, leaving source and destination IP addresses visible. This allows traffic analysis to determine communication patterns even though content is encrypted. ESP encrypts the payload data and application protocols, making them unreadable. Authentication credentials and pre-shared keys are never transmitted in plaintext; they are used locally for key derivation. ESP in tunnel mode encapsulates the original IP header within the encrypted payload, hiding it from observation. Only transport mode ESP preserves the original IP header, but even then only the outer header is visible.
5. During a web application penetration test, an ethical hacker intercepts an HTTP response header containing the following: Set-Cookie: SessionID=a8f5f167f44f4964e6c998dee827110c; Path=/; HttpOnly; Secure; SameSite=Strict. Which two security protections do these cookie attributes provide? (Select two!)
Multiple correct answersAPrevents cookie transmission over unencrypted HTTP connections
BPrevents JavaScript access to the cookie value
CEncrypts the cookie value using AES-256
DPrevents cookie submission in cross-site requests
EEnables cookie sharing across multiple subdomains
Explanation
The Secure attribute ensures cookies are only transmitted over HTTPS connections, preventing interception over unencrypted HTTP. The SameSite=Strict attribute prevents the cookie from being sent in cross-site requests, providing CSRF protection. The HttpOnly attribute prevents JavaScript access to cookies, mitigating XSS-based cookie theft, but this is a third protection not among the two asked. Cookie attributes do not encrypt cookie values; encryption must be implemented at the application layer. The Domain attribute, not shown here, controls subdomain cookie sharing.
More EC-Council Practice Exams
Certified SOC Analyst (CSA)
CSA · 570 questions
Certified Threat Intelligence Analyst (CTIA)
CTIA · 740 questions
Certified Chief Information Security Officer (CCISO)
CCISO · 578 questions
Certified EC-Council Instructor (CEI)
CEI · 611 questions
Computer Hacking Forensic Investigator (CHFI)
CHFI · 589 questions
Certified Cloud Security Engineer (CCSE)
CCSE · 624 questions
$17.99
One-time access to this exam
594 questions (4 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available