Certified Ethical Hacker (CEH): The Exam Details EC-Council Doesn't Put on One Page

What CEH Actually Certifies

Certified Ethical Hacker(CEH) tests whether you understand how attackers operate — reconnaissance, scanning, gaining access, maintaining access, covering tracks — well enough to find the same weaknesses before someone with worse intentions does. EC-Council markets the current version, CEH v13, under the "CEH AI" label, reflecting added modules on AI-driven attack and defense techniques layered onto the traditional 20-module curriculum. Don't let the branding confuse you: it's still the same 312-50 knowledge exam underneath, not a separate credential.

It's worth being clear about what CEH is not. It's a breadth-first certification that proves you understand the vocabulary, methodology, and tooling of ethical hacking across a wide swath of attack surfaces — network, web application, wireless, mobile, cloud, IoT. It is not, on its own, proof that you can independently break into a live system under exam pressure. That distinction matters when you're deciding whether CEH alone is enough for the job you want, or whether you'll also need the optional hands-on Practical exam or a more hands-on-focused credential like OSCP.

Who CEH Is For (and Who It's Not For)

EC-Council's own guidance recommends CEH for candidates with roughly two years of IT security experience already under their belt — security administrators, SOC analysts, network engineers moving into security-focused roles, and auditors who need to speak fluently about attacker methodology even if attacking systems isn't their day job. If you're newer than that, EC-Council explicitly steers you toward its own Ethical Hacking Essentials or Network Defense Essentials courses first, rather than jumping straight into CEH.

CEH is a poor fit if you're looking for a certification that proves hands-on penetration testing skill to a technical hiring manager who already knows the space — that audience tends to weight OSCP or similar practical-only credentials more heavily, precisely because CEH's base exam is multiple choice. CEH earns you the interview; it doesn't replace the interview.

CEH Exam Format and What Taking It Feels Like

Four hours and 125 multiple-choice questions is a long sit, and EC-Council doesn't publish a fixed number of questions per module, so you can't predict in advance how many questions will hit any one of the 20 domains. Expect a mix of straight definitional recall (what does this tool do, what port does this service use) and short scenario stems that ask you to identify an attack type or the next step in a methodology from a described situation.

The exam is closed-book and proctored, either at EC-Council's own ECC Exam Centre online or at a physical Pearson VUE testing center. There's no partial credit narrative here — you get a pass/fail result tied to a cut score that EC-Council doesn't disclose in advance, because it varies by which specific form of the exam you're handed. Practically, that means you shouldn't study to "clear 70%" as a target; study to be comfortable across all 20 modules, since a harder form of the exam could set the bar as high as 85%.

Domains and Topics Covered

EC-Council structures CEH v13 training around 20 modules, and the knowledge exam draws from this same set. EC-Council publishes a separate exam blueprint with more granular domain weightings for candidates who want that level of detail; the module list below reflects the topics themselves rather than a percentage breakdown, since weightings aren't something we're able to independently verify from EC-Council's public pages.

Cost Breakdown

This is the area where CEH gets genuinely confusing to research, and it's worth explaining why rather than just quoting a number. EC-Council has stated publicly that consumer-protection laws in various countries prevent it from mandating a fixed minimum price for its exam vouchers, since pricing is frequently bundled into training packages sold by its network of Authorized Training Centers. In practice, that means the number you'll see quoted — commonly around $1,199 USD for a standalone voucher — is a market-typical figure rather than an official published fee.

What is more fixed: candidates going the self-study eligibility route (rather than official training) pay a separate, non-refundable $100 application fee to have their work experience verified, on top of whatever the exam voucher itself costs. Official EC-Council training packages, at time of research, started around $1,699 for a single on-demand course and ran to $2,499 for live online instruction, with those packages including the application fee. The optional CEH Practical exam — the hands-on add-on required for CEH Master status — has been commonly priced around $550 separately from the knowledge exam. Retake vouchers are purchased separately by writing to EC-Council's certification team rather than through a standard self-service store price.

Prerequisites and Eligibility

There's no formal prerequisite exam, but CEH isn't open-enrollment the way some entry-level certifications are. To sit the exam, you need one of the following:

• Two years of documented work experience in an information security domain, verified through an application process that takes roughly 5 to 10 business days once your references respond, plus the $100 non-refundable application fee

• Completion of official EC-Council training (through iClass or an Authorized Training Center), which bypasses the separate application process entirely

• A previously held CEH certification from versions 1 through 7, which qualifies you for a waived application fee

An approved application is only valid for 3 months, and your purchased exam voucher expires 1 year from the date you receive it — both details worth building into your prep timeline if you're not testing immediately after approval.

How the Exam Is Scored and What Passing Requires

CEH uses what EC-Council calls a "cut score" model rather than a single fixed passing percentage. Every question carries its own difficulty weighting, set through beta testing with subject-matter experts, and those weightings roll up into a cumulative cut score for whichever specific form of the exam you're given. Because forms rotate, your personal passing threshold could land anywhere between 60% and 85% — you won't know which until your results are calculated. This is a deliberate design choice to keep difficulty comparable across different question banks, not an oversight, but it does mean you can't bank on a single target percentage the way you might for an exam with a published fixed cut score.

CEH vs. CEH Practical vs. CEH Master

Passing the 312-50 knowledge exam alone earns you the standard CEH certification. EC-Council also offers an optional CEH Practical exam — 6 hours, 20 hands-on challenges against live virtual machines and networks in EC-Council's iLabs Cyber Range, also scored on the same 60–85% cut-score model. Pass both the knowledge exam and the Practical, and you earn the CEH Master credential, which is the version of CEH that leans more heavily into demonstrated hands-on skill rather than multiple-choice recall. If your target employer or role specifically wants proof of hands-on capability, CEH Master (or a separate practical-only credential) closes a gap the base CEH exam leaves open.

Renewal and Continuing Education

CEH certifications are valid for 3 years from the date earned. To stay active, you need to accumulate 120 Continuing Professional Education (CPE) credits within that 3-year window — earned through activities like attending security conferences, publishing security research, completing higher-education coursework, or passing a newer version of the CEH exam itself (worth 120 credits on its own). On top of the credit requirement, certified members owe an annual continuing-education fee: $80 per year if CEH is your only CPE-scheme certification, or $20 per year if you hold other EC-Council certifications outside that scheme. Credits are earned and logged on a calendar-year basis, and EC-Council requires them registered through its Aspen portal by February 1 of the following year — miss that window consistently and your certification moves into suspended status rather than expiring outright, with a defined grace period to catch up before revocation.

How CEH Compares to OSCP and CompTIA's Security Certifications

CEH's closest philosophical rival is Offensive Security's OSCP, and the comparison usually comes down to format rather than subject matter: CEH is a timed multiple-choice exam that rewards broad knowledge across 20 domains, while OSCP is an extended hands-on exam that rewards demonstrated exploitation skill against a small number of live targets. Employers with in-house technical security teams often weight OSCP more heavily for individual-contributor penetration testing roles precisely because it can't be passed on memorization alone. CEH tends to open doors faster — its breadth and DoD 8140 recognition make it a common baseline requirement in job postings — while OSCP tends to carry more weight once you're already in the room being technically evaluated. A fair number of security professionals treat CEH as a stepping stone rather than an endpoint: pass CEH first for the resume screen and DoD-adjacent baseline requirements, then pursue OSCP for technical credibility.

Against CompTIA's security track, CEH sits above Security+ in specificity and below it in accessibility — Security+ assumes less prior experience and costs meaningfully less, but doesn't focus specifically on offensive methodology the way CEH does. CompTIA's PenTest+ is the more direct competitor in subject matter, though it's generally regarded as a notch below CEH in industry name recognition despite covering similar ground.

A Preparation Timeline

For someone who already meets the informal two-years-experience bar EC-Council recommends, 8 to 12 weeks of structured study covering all 20 modules is a reasonable target, especially if you're combining official courseware with hands-on lab time rather than reading alone. Candidates coming in lighter on practical networking and security fundamentals often need closer to 4 to 6 months, since CEH's breadth means a weak foundation in even one or two domains (cryptography and wireless networking are commonly cited as trouble spots for newer candidates) can cost enough questions to fail an exam form with a higher cut score. Because EC-Council's official training is frequently delivered as an intensive 5-day boot camp with the exam sat on the final afternoon, some candidates compress their timeline dramatically by front-loading self-study before attending — arriving at the boot camp already familiar with the material rather than seeing it for the first time.