On this page
Intro
CEH, Certified Ethical Hacker, is EC-Council’s credential for professionals who learn to think like an attacker in order to defend systems. The current version reviewed here is CEH v13. EC-Council describes a knowledge exam that is required for certification and an optional practical exam that supports the higher CEH Master level. CertMonk can help organize review for the knowledge exam alongside hands-on lab work. The details come from EC-Council’s CEH page.
This guide covers the knowledge exam. Practice only in environments you own or have written permission to test; ethical hacking depends on authorization.
Exam at a glance
| Detail | CEH v13 knowledge exam |
|---|---|
| Exam code | Not stated on the reviewed pages |
| Questions | 125 |
| Time | 4 hours |
| Passing score | Varies by exam form; EC-Council says cut scores typically fall between 60% and 85% |
| Question types | Multiple choice, taken online through the EC-Council exam portal |
| Price | Check the vendor’s site for current pricing |
| Retirement | Date not published on the reviewed pages |
The optional practical exam is a separate assessment of 20 real-world challenges over 6 hours, delivered in a cyber range, and it supports the CEH Master level.
Sources: EC-Council CEH page and program page, reviewed November 7, 2026.
Exam domains and weights
EC-Council’s reviewed pages list 20 course modules and do not publish a percentage weight for each one. This guide therefore groups the modules and leaves the weights out rather than guessing.
| Module group | Modules | In plain English |
|---|---|---|
| Foundations and reconnaissance | Introduction to Ethical Hacking; Footprinting and Reconnaissance; Scanning Networks; Enumeration; Vulnerability Analysis | Learn the field, then find and map targets. |
| System attacks and malware | System Hacking; Malware Threats; Sniffing; Social Engineering | How systems and people are compromised. |
| Network and session attacks | Denial-of-Service; Session Hijacking; Evading IDS, Firewalls, and Honeypots | Attacks on availability and sessions, and ways to evade defenses. |
| Web and wireless | Hacking Web Servers; Hacking Web Applications; SQL Injection; Hacking Wireless Networks | Common web and wireless weaknesses. |
| Mobile, IoT, cloud and cryptography | Hacking Mobile Platforms; IoT and OT Hacking; Cloud Computing; Cryptography | Newer platforms and the math that protects data. |
The page also describes the exam as covering threats and attack vectors, attack detection, attack prevention, procedures and methodologies. Use the module list as your checklist and see the EC-Council CEH page for any update.
What each domain really tests
Foundations and reconnaissance
Start with the ethical hacking process: reconnaissance, scanning, enumeration, gaining access, maintaining access and covering tracks, along with the legal and ethical context. For each phase, write what information you are trying to gather and which tool categories help.
Reconnaissance and scanning are tested through concepts as well as tools. Know what passive and active reconnaissance mean, how a port scan differs from a vulnerability scan and what enumeration adds. Explain the output of a scan in plain words rather than memorizing switches.
System attacks and malware
System hacking covers how attackers obtain credentials, escalate privileges and persist. Malware topics cover types, delivery and analysis at a conceptual level. Sniffing and social engineering round out the group.
For each technique, practice writing three things: how it works, what evidence it leaves and how a defender would counter it. This three-part habit matches the defensive purpose of the credential and helps with scenario questions.
Network and session attacks
Study denial-of-service attacks by the resource they exhaust, session hijacking by what token or sequence is stolen and evasion by what a control inspects. Compare firewalls, intrusion detection systems and honeypots in terms of what each sees and what an attacker tries to do about it.
Draw simple network diagrams and mark where each attack happens and where each defense sits. Diagrams make it easier to answer scenario questions about which control would have helped.
Web and wireless
Web topics include web servers, web applications and SQL injection. Know the classes of weakness and the logic of how injection works, and study how input handling, authentication and session management go wrong. Wireless topics cover protocols, encryption weaknesses and common attacks.
In a lab you own, reproduce one weakness at a time and then apply the matching fix. Seeing the before and after is more durable than reading a list of vulnerability names.
Mobile, IoT, cloud and cryptography
These modules extend the same attack and defense thinking to newer platforms. For mobile, IoT and operational technology, note what is different about the device and its update path. For cloud, focus on shared responsibility and common misconfiguration.
Cryptography deserves steady review: symmetric and asymmetric encryption, hashing, signatures, certificates and common attacks on them. Write short comparisons so similar-sounding concepts stay distinct.
The topics above follow EC-Council’s module list; the exercises are our learning approach.
A realistic six-week study plan
This plan assumes basic networking and operating system knowledge. It is a suggested schedule, not a promise about readiness. With 20 modules, add time if the fundamentals are new.
Week 1: foundations and reconnaissance
Read the module list, set up an isolated lab and work through the first five modules. Keep a glossary of tools and the problem each one addresses.
Week 2: system attacks and malware
Cover system hacking, malware, sniffing and social engineering. For each technique, write how it works, what it leaves behind and how to counter it.
Week 3: network and session attacks
Study denial-of-service, session hijacking and evasion. Add untimed practice and record the reasoning behind each uncertain choice.
Week 4: web and wireless
Work through web servers, web applications, SQL injection and wireless. Reproduce one weakness at a time in your lab and apply its fix.
Week 5: mobile, IoT, cloud and cryptography
Cover the remaining modules and give cryptography its own sessions. Leave one session open for catch-up.
Week 6: mixed review under time pressure
With a four-hour exam, practice sustained concentration. Add timed sets, inspect your reasoning and spend remaining sessions on recurring gaps.
Make a deliberate readiness decision. Finishing six weeks is an organizational milestone, not proof of readiness.
Common mistakes and how to avoid them
- Memorizing tool names only. Learn what each tool is for and what its output means.
- Skipping lab practice. Reading about an attack is weaker than reproducing it safely.
- Neglecting cryptography. It is its own module and supports many others.
- Testing without permission. Only practice in systems you own or are permitted to test.
- Forgetting the defender’s view. Pair each attack with detection and prevention.
- Rushing into timed practice. Build clear reasoning untimed first, then use the clock to check pacing.
How to use practice questions well
After each practice item, explain why the chosen answer fits and why each alternative does not. Review wrong-answer explanations for the assumption that misled you, and add that concept to your next session.
CertMonk includes explanations for every answer choice, randomized practice tests, timed and untimed modes, flip-card flashcards, study games and progress by exam domain. Use the domain view to choose follow-up work, and flashcards for brief review between lab sessions.
Keep a separate list of correct guesses and revisit them later without the answer choices in front of you. When you add timed practice, use the result to investigate your preparation rather than to predict an exam outcome.
Free practice questions
Use the free CEH samples below to explore the explanations and spot areas to review without a purchase.
A defender wants early warning of attackers moving inside the network. The plan is to place a host with no business function on the server VLAN, so that any connection to it is suspicious by definition. What is this control called?
- AA honeypot, a decoy system that exists to attract and record hostile activity.
- BA DMZ, a screened network segment holding public-facing services.
- CA bastion host, a hardened gateway used to administer internal servers.
- DA DNS sinkhole, redirecting known malicious domains to a controlled address.
Show the answer and explanation
Answer: A. A honeypot, a decoy system that exists to attract and record hostile activity.
Correct. Because a honeypot has no legitimate users, any interaction is a high-confidence alert and can reveal an attacker’s tools and behavior.
Why not the others
- B. A DMZ is a network zone for real services exposed to untrusted networks, not a decoy.
- C. A bastion host has a real function and legitimate users, so connections to it are expected rather than suspicious.
- D. A sinkhole intercepts lookups for known bad domains. It does not wait on the internal network for attackers to connect to it.
Takeaway: A honeypot’s value comes from having no legitimate use: any touch is a signal. It complements, not replaces, monitoring of real systems.
An assessment plan states that during the first week the team may build a picture of the client’s external footprint but must not send any traffic to systems the client owns or operates, so that nothing appears in the client’s own logs. Which activity is consistent with that restriction?
- AConnecting once to each discovered service to read the banner it returns and identify its version, without sending any exploit or login attempt.
- BRunning a slow, low-rate TCP port sweep across the client’s published address ranges, timed to stay under intrusion detection thresholds.
- CRequesting a full zone transfer (AXFR) from the client’s authoritative DNS servers, which returns every record in the zone, including internal hostnames, in a single query.
- DCollecting hostnames and organizational detail from third-party sources such as domain registration records, certificate transparency logs, and public code repositories.
Show the answer and explanation
Answer: D. Collecting hostnames and organizational detail from third-party sources such as domain registration records, certificate transparency logs, and public code repositories.
Correct. These sources are held by other parties, so querying them produces no traffic to the client and no entries in the client’s logs. This is passive reconnaissance.
Why not the others
- A. Banner grabbing requires establishing a connection to the client’s service. Any interaction with the target is active reconnaissance, however light the traffic volume.
- B. A port sweep sends packets directly to client-owned hosts. That is active scanning however slowly it is paced: evading an intrusion detection threshold does not stop the packets reaching, and being logged by, the client’s systems.
- C. The request goes to a name server the client operates, so it is active and logged. It also probes a misconfiguration rather than merely observing public data.
Takeaway: The passive/active line is drawn by whether the target is touched, not by how noisy the technique is. One connection to a client-owned host makes the activity active and puts it in the client’s logs; querying third parties about the client does not.
A server shows unexplained outbound traffic, yet the operating system's own process, file and network listings display nothing unusual. Which approach is MOST likely to expose a kernel-level rootkit hiding the activity?
- AReview the process list using the tools built into the compromised operating system itself, repeatedly.
- BAdd a firewall rule blocking the destination address seen in the traffic.
- CExamine a memory image and an offline boot of the disk, then compare with the live view.
- DReboot the server and watch whether the outbound traffic resumes afterward.
Show the answer and explanation
Answer: C. Examine a memory image and an offline boot of the disk, then compare with the live view.
Correct. Analysis outside the compromised kernel is not subject to its filtering, and differences between views reveal what is hidden.
Why not the others
- A. A kernel-level rootkit can filter what those very tools report, so they will repeat the false picture.
- B. Blocking a destination may contain the symptom but does not find or remove the hidden component.
- D. A reboot loses volatile evidence and a persistent rootkit simply returns, proving little.
Takeaway: You cannot trust tools that run on a host whose kernel is compromised. Use external views, such as memory images and offline analysis, and compare them with the live system.
Source: MITRE ATT&CK T1014: Rootkit
A tester notices that a product page shows the same output for every input, but responses take noticeably longer when specially crafted conditions are included in one search parameter. The page never displays database errors or data. What does this behavior MOST likely indicate?
- AReflected cross-site scripting in the search parameter of the page.
- BA server that is simply slow because of high overall traffic volume.
- CA cross-site request forgery weakness in the search form of the page.
- DTime-based blind SQL injection, where input reaches the database query.
Show the answer and explanation
Answer: D. Time-based blind SQL injection, where input reaches the database query.
Correct. When no data or errors are visible, a controllable delay in the response reveals that the input is reaching the database query.
Why not the others
- A. Cross-site scripting would show script content executing in the browser, not delayed server responses.
- B. Random slowness would not track the specific conditions included in the parameter.
- C. Request forgery concerns forged actions from another site, not input-dependent response timing.
Takeaway: Blind injection infers database behavior from side effects such as response time or true and false page differences. Parameterized queries remove the weakness.
An employee roots a company-managed Android phone to install an app that policy blocks. From a security standpoint, what is the MAIN consequence for the device?
- AIt mainly shortens the overall device battery life while leaving the underlying security model fully intact.
- BIt simply makes the phone run faster with no meaningful security impact.
- CIt disables built-in platform protections such as the app sandbox and verified boot.
- DIt only changes which mobile carrier the phone is permitted to use.
Show the answer and explanation
Answer: C. It disables built-in platform protections such as the app sandbox and verified boot.
Correct. Rooting removes the platform’s integrity and isolation guarantees, so the app sandbox, verified boot, and update assurances no longer hold; MDM should detect and block rooted devices.
Why not the others
- A. Rooting’s significance is the loss of platform protections, not battery consumption.
- B. Perceived speed is not the point; rooting materially weakens the device’s security posture.
- D. That describes carrier unlocking, a separate action; rooting changes the device’s security model, not the carrier.
Takeaway: Rooting or jailbreaking strips the platform’s integrity and isolation controls (sandbox, verified boot), so a managed device can no longer be trusted. MDM should detect and quarantine such devices.
Source: OWASP Mobile Top 10
FAQ
Which version of CEH is covered here?
This guide follows CEH v13 as described on EC-Council’s CEH page. Check that page for any newer version.
How long is the knowledge exam?
EC-Council lists 125 multiple-choice questions over 4 hours, delivered online through its exam portal.
What score do I need?
EC-Council says each exam form has its own cut score, typically between 60% and 85%. The exact threshold is not fixed in advance.
What is the practical exam?
It is a separate, optional assessment of 20 real-world challenges over 6 hours that supports the CEH Master level. This guide focuses on the knowledge exam.
Do I need lab practice?
Hands-on practice is strongly useful, because many questions describe techniques you understand better after reproducing them safely in an environment you own.
How long should I study?
Use six weeks as a starting framework if you already have networking and security background. Add time where your notes show gaps.
Next step
Try free practice questions → https://app.certmonk.app/samples
