Prep
What this CEH study guide covers
This CEH study guide gives you a 10-week plan for EC-Council's Certified Ethical Hacker knowledge exam, mapped to the 20 modules of the current version (CEH v13, which EC-Council brands as CEH AI) and to the nine domains of the official exam blueprint. It also answers two questions people ask before they commit: how hard is CEH, and is CEH worth it?
Exam facts come from EC-Council's CEH course page, its CEH exam page, the CEH Exam Blueprint v5.0 linked from that page, and its eligibility and continuing education pages, all checked on November 7, 2026. The study plan is our editorial recommendation.
| Item | Detail |
|---|---|
| Version | CEH v13 (CEH AI), 20 modules |
| Exam code | 312-50 |
| Questions and time | 125 multiple choice, 4 hours |
| Passing score | Cut score of 60% to 85%, set per exam form |
| Voucher | USD 950 online proctored / USD 1,199 Pearson VUE |
| Eligibility | Official training, or 2 years of security experience plus USD 100 application |
| Renewal | 120 ECE credits per 3 years, USD 80 a year |
CEH exam facts
- Exam: Certified Ethical Hacker, code 312-50.
- Questions: 125 multiple choice.
- Time: 4 hours.
- Passing score: there is no single figure. Each exam form has its own cut score, set from the difficulty of its questions, ranging from 60% to 85%.
- Delivery: EC-Council lists voucher prices for an online exam with remote proctoring (USD 950) and for Pearson VUE test centers (USD 1,199).
- Eligibility: either complete official EC-Council training, or apply with proof of two years of information security work experience and a non-refundable USD 100 application fee.
- Retakes: up to four attempts in one year, through EC-Council's retake request process.
- Renewal: 120 EC-Council Continuing Education (ECE) credits every three years and an annual fee of USD 80.
The optional CEH Practical is a separate exam: 20 challenges in 6 hours in EC-Council's iLabs Cyber Range. Passing both earns the CEH Master designation. Our CEH exam cost page breaks down every fee and both eligibility routes.
The CEH blueprint: nine domains, 20 modules
The CEH v13 course has 20 modules. The exam blueprint groups them into nine domains and gives each module a number of questions. This is how you should weight your study time:
| Blueprint domain | Course modules | Questions | Weight |
|---|---|---|---|
| 1. Information Security and Ethical Hacking Overview | 1 Introduction to Ethical Hacking | 7 | 6% |
| 2. Reconnaissance Techniques | 2 Footprinting and Reconnaissance, 3 Scanning Networks, 4 Enumeration | 21 | 17% |
| 3. System Hacking Phases and Attack Techniques | 5 Vulnerability Analysis, 6 System Hacking, 7 Malware Threats | 19 | 15% |
| 4. Network and Perimeter Hacking | 8 Sniffing, 9 Social Engineering, 10 Denial-of-Service, 11 Session Hijacking, 12 Evading IDS, Firewalls, and Honeypots | 30 | 24% |
| 5. Web Application Hacking | 13 Hacking Web Servers, 14 Hacking Web Applications, 15 SQL Injection | 18 | 14% |
| 6. Wireless Network Hacking | 16 Hacking Wireless Networks | 6 | 5% |
| 7. Mobile Platform, IoT, and OT Hacking | 17 Hacking Mobile Platforms, 18 IoT and OT Hacking | 12 | 10% |
| 8. Cloud Computing | 19 Cloud Computing | 6 | 5% |
| 9. Cryptography | 20 Cryptography | 6 | 5% |
The question counts add up to 125. EC-Council's rounded percentages add up to 101%. Domains 2 to 5 together account for 88 of the 125 questions, so that is where most of your hours should go.
The v13 course also adds AI material, such as AI-powered OSINT, AI-based malware and AI-assisted vulnerability assessment, with AI labs spread across several modules. The blueprint on EC-Council's exam page does not list AI as a separate domain, so treat AI as a theme inside the modules rather than a block of its own.
The 10-week CEH study plan
This plan assumes 8 to 10 hours a week and a working knowledge of networking. EC-Council says its course will not teach basics such as what a port is. If TCP/IP, subnets and common ports are new to you, add two to four weeks of networking fundamentals first.
| Week | Modules | Focus and hands-on work |
|---|---|---|
| 1 | 1 | Hacking phases, methodologies and frameworks, security controls, laws and standards. Set up a legal home lab with deliberately vulnerable virtual machines. |
| 2 | 2 | Footprinting: search engines, web services, social networks, Whois, DNS and email footprinting, and countermeasures. |
| 3 | 3, 4 | Scanning and enumeration: host discovery, port and service discovery, OS fingerprinting, NetBIOS, SNMP, LDAP, SMTP and DNS enumeration. Practise with Nmap in your lab. |
| 4 | 5, 6 | Vulnerability assessment types and reports; gaining access, password cracking, privilege escalation, persistence and clearing logs. |
| 5 | 7, 8 | Malware concepts, APTs, fileless malware and analysis; sniffing techniques such as MAC, DHCP and ARP attacks and DNS poisoning. |
| 6 | 9, 10, 11, 12 | Social engineering, DoS and DDoS, session hijacking, and evading IDS, firewalls and honeypots. This is the largest block on the exam. |
| 7 | 13, 14, 15 | Web server attacks, web application methodology, injection, authentication and session attacks, web APIs and SQL injection types. |
| 8 | 16, 17, 18, 19, 20 | Wireless encryption and attacks, Android and iOS, IoT and OT, cloud and containers, cryptography and PKI. |
| 9 | All | Mixed practice questions; rework the weakest domains. Make a one-page sheet of tools and what each one is used for. |
| 10 | All | Two timed sessions of 125 questions in 4 hours. Review every miss. Book the exam once you score well above 85% on new questions. |
We set the target above 85% because your exam form's cut score could sit at the top of EC-Council's 60% to 85% range. Only practise attack techniques on systems you own or have written permission to test.
How hard is CEH?
EC-Council does not publish pass rates, so we cannot give you one. What makes the CEH hard is mostly breadth, not depth:
- Wide scope. Twenty modules from footprinting to cryptography, with tools, attack names and countermeasures for each.
- Tool and term recall. Many questions test whether you know what a tool or technique does, or which phase of an attack it belongs to.
- A variable cut score. You do not know in advance whether your form needs 60% or 85%.
- Stamina. Four hours and 125 questions is long; time management matters.
The knowledge exam is multiple choice, so it is easier than a hands-on exam for most people. Candidates with a few years in security usually find the concepts familiar and spend their time on terminology. Beginners find it much harder, which is why EC-Council recommends at least two years of IT security experience.
Is CEH worth it?
It depends on where you are and what your market asks for. Our view:
- Worth it if job ads, contracts or your employer name the CEH, or if your employer pays for the training route.
- Think twice if you are new to security and paying yourself. A foundation such as CompTIA Security+ costs less and covers concepts the CEH assumes.
- Add the Practical if you want to show hands-on skill. The knowledge exam alone proves you know the material, not that you can do the work.
At USD 950 or more for the voucher, plus USD 80 a year to keep it, the CEH is not cheap. We do not quote salary figures, because we have not found an authoritative source for CEH holders specifically. Our cybersecurity certification roadmap shows where the CEH fits among other options.
Before you book: a readiness checklist
- You have decided on a route: official training, or the experience route with the USD 100 application approved. Approvals are valid for 90 days, so buy your voucher in that window.
- You have a voucher and know its type: online proctored or Pearson VUE. After purchase you have 12 months to schedule and take the exam.
- You can name the main tool for each attack phase and explain at least one countermeasure for every module.
- You have finished at least two timed, full-length practice sessions and scored well above 85% on questions you had not seen.
- You checked EC-Council's CEH page for the current version, so you are not studying an older one.
Study methods that work for the CEH
- Lab every module. Running a scan or an exploit in your own lab makes tool questions far easier to answer.
- Test yourself, do not reread. Answer questions after every module; retrieval practice beats rereading notes. See active recall.
- Build tool flashcards. Tool name on one side, purpose and attack phase on the other. Review them with spaced repetition.
- Mix domains from week 9. On the exam, topics arrive in random order.
Find your weak domains early with our free CEH practice test, and see the CEH certification hub for the full exam overview.