The Certified Ethical Hacker (CEH™) certification from EC-Council is one of the best-known credentials in offensive security. It tells employers that you understand how attackers find, exploit, and hide in systems, and how to use that knowledge to defend them. With 125 questions, four hours of testing, and a blueprint that runs from footprinting to cryptography, the exam can feel enormous at first. The good news is that EC-Council publishes exactly what it tests and how many questions come from each area.

In this guide, we’ll walk you through the exam format, all nine domains in the current blueprint, the official resources worth bookmarking, and the questions candidates ask most often.

What Is the EC-Council CEH Exam?

The CEH is EC-Council’s core ethical hacking certification. An ethical hacker uses the same tools and techniques as a malicious attacker, but with written permission and a defined scope, so the organization can find and fix weaknesses before someone else exploits them.

The current training program is CEH v13, which EC-Council markets as AI-powered. It’s organized into 20 modules that follow the attack lifecycle: reconnaissance, scanning, enumeration, gaining access, maintaining access, and covering tracks. Passing the knowledge exam (exam code 312-50) earns you the CEH certification. You can add an optional hands-on exam, the CEH Practical, later to earn the CEH Master designation.

What Is the CEH Exam Format?

Here’s the knowledge exam at a glance, based on EC-Council’s CEH v13 program page and the CEH Exam Blueprint v5.0:

  • Exam code: 312-50.
  • Questions: 125 multiple-choice questions.
  • Time: 4 hours (240 minutes).
  • Delivery: Online through the ECC Exam Center with EC-Council’s remote proctoring, or in person at a Pearson VUE test center.
  • Passing score: EC-Council uses several exam forms and sets a cut score for each one. Depending on the form you receive, the cut score ranges from 60% to 85%.
  • Results: You’ll see a pass/fail result as soon as you submit, along with a transcript showing feedback by skill area.
  • Eligibility: Complete official EC-Council training, or apply with at least two years of information security work experience.

That’s almost two minutes per question. The real challenge is the breadth of tools, attacks, and countermeasures you need to tell apart.

What Content Outline Does the CEH Exam Use?

The current exam is built on the CEH Exam Blueprint v5.0, effective April 1, 2024. It divides the 125 questions into nine domains and 20 topics, and lists the exact number of questions for each. EC-Council rounds the percentages, so they add up to slightly more than 100%.

  • 1. Information Security and Ethical Hacking Overview: 6% (7 questions)
  • 2. Reconnaissance Techniques: 17% (21 questions)
  • 3. System Hacking Phases and Attack Techniques: 15% (19 questions)
  • 4. Network and Perimeter Hacking: 24% (30 questions)
  • 5. Web Application Hacking: 14% (18 questions)
  • 6. Wireless Network Hacking: 5% (6 questions)
  • 7. Mobile Platform, IoT, and OT Hacking: 10% (12 questions)
  • 8. Cloud Computing: 5% (6 questions)
  • 9. Cryptography: 5% (6 questions)

Domain 1: Information Security and Ethical Hacking Overview (6%)

This domain sets the vocabulary for the rest of the exam. It covers the single topic “Introduction to Ethical Hacking.”

  • Information security fundamentals, such as the CIA triad, threats, vulnerabilities, and attack vectors.
  • Hacking methodologies and frameworks, including the phases of hacking and models like the Cyber Kill Chain.
  • Information security controls, plus laws and standards such as PCI DSS, HIPAA, SOX, and GDPR.

Study tip: Learn the phases in order. Many later questions ask which phase an activity belongs to.

Domain 2: Reconnaissance Techniques (17%)

Reconnaissance is about learning as much as possible about a target before attacking it. The domain splits evenly across three topics: Footprinting and Reconnaissance, Scanning Networks, and Enumeration (7 questions each).

  • Passive and active footprinting through search engines, web services, social networks, websites, email, WHOIS, and DNS.
  • Host discovery, port and service scanning, OS fingerprinting, and scanning beyond IDS and firewalls.
  • Enumerating NetBIOS, SNMP, LDAP, NTP, NFS, SMTP, and DNS, along with the countermeasures for each.

What questions look like: Expect to identify an Nmap scan type from its flags or its packet behavior, such as a SYN (half-open) scan versus a full TCP connect scan.

Domain 3: System Hacking Phases and Attack Techniques (15%)

This domain covers what happens once you have a foothold. Topics include Vulnerability Analysis (6), System Hacking (6), and Malware Threats (7).

  • Vulnerability assessment concepts, classification, types of assessments, tools, and reports, including CVSS scoring.
  • Gaining access through password cracking and exploitation, then privilege escalation, maintaining access, hiding files, persistence, and clearing logs.
  • Malware and advanced persistent threat (APT) concepts, trojans, viruses, worms, fileless malware, malware analysis, and anti-malware countermeasures.

Study tip: Keep the password attack types straight: dictionary, brute force, rule-based, and rainbow table attacks, and why salting defeats precomputed hashes.

Domain 4: Network and Perimeter Hacking (24%)

The largest domain has five topics with 6 questions each: Sniffing, Social Engineering, Denial-of-Service, Session Hijacking, and Evading IDS, Firewalls, and Honeypots.

  • MAC flooding, DHCP attacks, ARP poisoning, spoofing, and DNS poisoning, plus sniffing detection and countermeasures.
  • Social engineering techniques, insider threats, impersonation on social networks, and identity theft.
  • DoS and DDoS attack techniques, botnets, and protection tools.
  • Session hijacking, plus how attackers evade IDS, firewalls, and honeypots.

What questions look like: A scenario describes a symptom, such as a switch suddenly forwarding traffic to every port, and asks you to name the attack or the control that stops it.

Domain 5: Web Application Hacking (14%)

Web attacks are spread across Hacking Web Servers, Hacking Web Applications, and SQL Injection (6 questions each).

  • Web server attacks, attack methodology, and patch management.
  • Web application threats such as broken access control, injection, and session management flaws, plus attacks on APIs, webhooks, and web shells.
  • SQL injection types (in-band, blind, and out-of-band), methodology, evasion, and countermeasures such as parameterized queries.

Study tip: Map each attack to the OWASP Top 10 category it falls under. It helps you sort similar-sounding answer choices.

Domain 6: Wireless Network Hacking (5%)

This domain covers wireless concepts, encryption (WEP, WPA, WPA2, and WPA3), wireless threats such as rogue access points and evil twins, a wireless hacking methodology, Bluetooth attacks like bluejacking and bluesnarfing, and countermeasures.

Domain 7: Mobile Platform, IoT, and OT Hacking (10%)

Split between Hacking Mobile Platforms and IoT and OT Hacking (6 questions each), this domain covers Android and iOS attack vectors, mobile device management, IoT attack surfaces, and operational technology such as industrial control systems (ICS) and SCADA.

Study tip: Remember that OT environments put availability and safety first, so the “best” answer often avoids anything that could disrupt a running process.

Domain 8: Cloud Computing (5%)

This domain covers cloud service and deployment models, container technology, serverless computing, cloud threats and attacks, and cloud security controls, including the shared responsibility model.

Domain 9: Cryptography (5%)

Cryptography covers encryption algorithms, hashing, cryptography tools, public key infrastructure (PKI), email and disk encryption, cryptanalysis, and countermeasures. Expect details like key lengths and which algorithms are symmetric or asymmetric.

How Should You Use the CEH Blueprint to Build a Study Plan?

Because the blueprint lists exact question counts, you can plan with more precision than most exams allow.

  1. Take a baseline. Answer a mixed set of practice questions before you start so you know where you stand in each domain.
  2. Weight your time. Domains 2, 3, and 4 together account for 70 of the 125 questions. Give them the biggest blocks of study time.
  3. Don’t skip the small domains. Wireless, Cloud Computing, and Cryptography are 6 questions each, but together that’s 18 questions, which can decide a close result.
  4. Map every miss. Tag missed questions by blueprint topic, such as “Sniffing” or “SQL Injection,” so patterns show up quickly.
  5. Get hands-on. Run Nmap, Wireshark, and other common tools in a lab you own. Tool-output questions are easier when you’ve seen the output yourself.

Official CEH Resources

Frequently Asked Questions About the CEH Exam

What score do I need to pass the CEH exam?
There isn’t one fixed passing score. EC-Council sets a cut score for each exam form based on its difficulty, and those cut scores range from 60% to 85%. Aim to score well above 85% in practice so you’re covered no matter which form you get.

How soon will I get my CEH exam results?
Immediately. You’ll see whether you passed when you submit the exam, along with a transcript that shows how you did in each skill area.

What happens if I don’t pass the CEH exam?
Under EC-Council’s retake policy, you can retake the exam right away after your first attempt. After that, you must wait 14 days between attempts, and you can take the exam no more than five times in 12 months. Each retake requires a new voucher.

Do I have to take an official course to sit for the CEH exam?
No. Official training makes you eligible to test, but you can also apply with at least two years of information security work experience and a $100 non-refundable eligibility application fee.

How long is the CEH credential valid?
Your certification runs on a three-year cycle. To renew, you earn 120 EC-Council Continuing Education (ECE) credits over three years and pay an annual membership fee.

Is CEH v13 a different exam from the blueprint v5.0?
No. CEH v13 is the training program version, and Blueprint v5.0 is the document that defines what the 312-50 exam tests. As of October 2026, v5.0 (effective April 1, 2024) is still the current published blueprint. Check EC-Council’s site before you schedule in case a newer version is released.

What’s the difference between CEH and CEH Practical?
The CEH is the 125-question multiple-choice knowledge exam. The CEH Practical is an optional six-hour, hands-on exam with 20 challenges in a live cyber range. Pass both, and you earn the CEH Master designation.

Start Preparing for the CEH Exam With Pocket Prep

When you’re ready to put the blueprint to work, Pocket Prep’s EC-Council CEH practice questions give you 1,600 exam-style questions across all nine domains, each with a detailed explanation of why the right answer is right and the others aren’t. Start with a Weakest Subject quiz to see where you stand, then use Timed Quiz sets to build pacing. Steady practice adds up, and you can walk in on exam day ready.