EC-Council Certified Ethical Hacker (CEH)
Exam overview, official domain weights and free sample questions. Subscribers get 230 practice questions, 125 flashcards, 5 labs, a study guide and video lessons for this exam.
Exam at a glance
- Exam code
- 312-50 (CEH v13)
- Questions
- 125
- Time
- 240 minutes
- Question types
- multiple choice (knowledge exam), optional separate 6-hour practical exam with 20 challenges for CEH Master
- Passing score
- Varies by exam form. Typical cut scores range from 60% to 85%
- Exam fee
- not published for the exam alone. Official training bundles start at $1,699 (on-demand). The eligibility application fee is $100 for candidates who don't take official training
- Delivery
- training center, EC-Council remote proctoring, Pearson VUE testing centers
- Prerequisites
- Either official training (no application needed), or an approved eligibility application ($100 fee, experience-based). EC-Council recommends at least 2 years of IT security experience
- Renewal
- not published on the pages checked (EC-Council Continuing Education)
- Version notes
- not published
From the official exam page (checked 2026-11-09). Always confirm details with the vendor: official exam page, official objectives.
Domains and weights
- M01 Introduction to Ethical Hacking
- M02 Footprinting and Reconnaissance
- M03 Scanning Networks
- M04 Enumeration
- M05 Vulnerability Analysis
- M06 System Hacking
- M07 Malware Threats
- M08 Sniffing
- M09 Social Engineering
- M10 Denial-of-Service
- M11 Session Hijacking
- M12 Evading IDS, Firewalls, and Honeypots
- M13 Hacking Web Servers
- M14 Hacking Web Applications
- M15 SQL Injection
- M16 Hacking Wireless Networks
- M17 Hacking Mobile Platforms
- M18 IoT and OT Hacking
- M19 Cloud Computing
- M20 Cryptography
Free sample questions
Original questions in the style of the exam. Pick an answer to see the explanation.
During an authorized red-team engagement, the team embeds a remote-access payload inside a macro-enabled spreadsheet that looks like a vendor invoice, but hasn't sent it yet. Which Cyber Kill Chain phase is this?
A tester types site:target.com filetype:xlsx "confidential" into a search engine to find exposed spreadsheets. What technique is this?
After dumping an NTLM hash from one workstation, a tester authenticates to a file server as that user without ever cracking the password. Which technique is this?
Unlock every question, lab and guide
Full access to all 20 certifications for $4.99/month. Cancel anytime.