Skip to content
CertGPS

Certified Ethical Hacker

Tests recognition of attack techniques across nine domains in a 125-question exam, with an optional six-hour hands-on Practical leading to CEH Master

IntermediateEC-Council

The exam

Exam cost
$950
Study time
4-6 months
Passing score
60% to 85%, set per exam form
Valid for
3 years

Before you book

  • Required: official EC-Council CEH training, or two years of information security work experience
  • Self-study route: approved eligibility application with a $100 non-refundable fee
  • Optional: CEH Practical exam, which with the knowledge exam earns CEH Master

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Ethical Hacker

    You are here

  2. OffSec Certified Professional

    Advanced

    Next step. Replaces CEH's multiple-choice questions with 24 proctored hours compromising machines

Study guide

Last updated

CEH v13 Study Guide: The Exam, the Practical, and What Each Route Costs

The Certified Ethical Hacker (CEH) credential from EC-Council shows that you know the attacker's methods by name and by phase, from footprinting a target to clearing the logs afterwards. The current version, v13, which EC-Council also sells as "CEH AI", is a four-hour exam of 125 multiple-choice questions. Settle your route before you study, because it sets the bill: EC-Council's training packages start at $1,699, while the self-study route costs a $100 application fee plus a $950 voucher.

Who CEH suits, and who should pick something else

CEH earns its keep when a job posting or a contract names it. EC-Council states that both the knowledge exam and the CEH Practical are approved under US Department of Defense (DoD) 8140, which matters if you work on defense or government contracts. It also suits security operations center (SOC) analysts, auditors and system administrators who need a working vocabulary of attack techniques across networks, web applications, wireless, cloud and operational technology (OT), without yet doing penetration tests for a living. EC-Council's self-study route asks for two years of information security work, which is a fair guide to the intended candidate.

If your goal is to prove you can break into machines, the knowledge exam won't show it. OSCP gives you 24 proctored hours to compromise standalone machines and an Active Directory set. PenTest+ covers similar ground with performance-based items, and GPEN is the GIAC equivalent.

The two CEH v13 exams at a glance

Knowledge exam (312-50)CEH Practical
Format125 multiple-choice questions20 challenges on live virtual machines in the iLabs Cyber Range
Time4 hours6 hours
Passing scoreSet per exam form, between 60% and 85%Set per exam form, between 60% and 85%
Voucher price$950 remote-proctored; $1,199 at a Pearson VUE center$550 remote-proctored
EligibilityOfficial EC-Council training, or two years in information security plus a $100 non-refundable applicationSame as the knowledge exam
ResultCEHCEH Master, once both exams are passed
Validity3 years; 120 continuing education credits and an $80 annual feeSame scheme

Training route, self-study route, and the Practical

On the training route, EC-Council's own packages are listed from $1,699 for single on-demand access and from $2,499 for live online classes. Finishing official training makes you eligible without an application, and the package is built around EC-Council's four-step "Learn, Certify, Engage, Compete" program: 20 modules with labs, the exams, a mock engagement, and a year of monthly capture-the-flag challenges.

The self-study route takes paperwork. You send the eligibility form to EC-Council, pay the $100 fee, and wait; the candidate handbook says decisions usually take five to ten business days. An approval lasts 90 days, so buy the voucher inside that window. The voucher then gives you 12 months to sit the exam, and EC-Council will extend an unused one by three months for $49 or by a year for $99.

The Practical is optional. It hands you a simulated corporate network and asks you to scan it, enumerate users, crack hashes, exploit web applications, run SQL injection and break weak cryptography. Six hours for 20 challenges is about 18 minutes each. EC-Council recommends taking it only after the current CEH course or equivalent, and it is the only part of CEH that shows you can do the work rather than recognize it.

If you fail, the retake rules are strict. The second attempt needs no wait, the third, fourth and fifth each need 14 days, and after five attempts in 12 months you're locked out for a year. You can't resit a version you've already passed.

The nine domains and their weights

EC-Council's exam blueprint v5.0 has been in effect since April 10, 2024, and it's the one the 312-50 exam uses today:

  • Information Security and Ethical Hacking Overview: 6%
  • Reconnaissance Techniques (footprinting, scanning, enumeration): 17%
  • System Hacking Phases and Attack Techniques (vulnerability analysis, system hacking, malware): 15%
  • Network and Perimeter Hacking (sniffing, social engineering, denial of service, session hijacking, evading intrusion detection systems (IDS), firewalls and honeypots): 24%
  • Web Application Hacking (web servers, web applications, SQL injection): 14%
  • Wireless Network Hacking: 5%
  • Mobile Platform, IoT, and OT Hacking: 10%
  • Cloud Computing: 5%
  • Cryptography: 5%

Network and Perimeter Hacking is the heaviest domain because it bundles five sub-domains, and the blueprint gives every one of its 20 sub-domains six or seven questions. In practice that makes the exam evenly spread: denial of service carries as many questions as SQL injection, and no single topic can rescue a weak area elsewhere. Expect questions on which tool or flag does what, which scan type a firewall will drop, and which phase an action belongs to.

The "AI" in the marketing lives mostly in the course. EC-Council lists AI-assisted reconnaissance and vulnerability assessment tools in the v13 modules, but the blueprint has no AI domain, so study the nine domains above first.

How to prepare

Work from the blueprint's sub-domain bullets, not a book's table of contents. With 125 questions spread evenly across 20 sub-domains, a gap in wireless or cryptography costs as much as a gap in scanning.

If you take the official course, its 221 labs are the most direct preparation, and you'll still want time with the tools outside the course. On the self-study route, build a small lab: a Kali Linux attack box, a deliberately vulnerable Windows host and a vulnerable web application. Run Nmap scans of every type against it and note which the host firewall blocks. Capture and read traffic in Wireshark, crack hashes you've extracted yourself, and walk through SQL injection by hand before using sqlmap. That lab work also covers most of the Practical.

For reading, the Sybex CEH Certified Ethical Hacker v13 Study Guide by William Panek was published in May 2026 and includes online practice tests. Check which CEH version any other book targets before you buy it. We'd budget roughly half your time for reading and question practice, a third for lab work, and the rest for timed sets of 125 questions in four hours, since the exam pace is just under two minutes per question.

Renewal and next steps

CEH is valid for three years. To renew it, you earn 120 continuing education credits in each three-year cycle under EC-Council's CPE policy and pay an annual $80 continuing education fee, which keeps the certification extended year by year. Report credits by February 1 of the following year. Miss the 120 credits and you're suspended for up to 12 months, after which the certification is revoked and you'd have to pass the current exam again.

Where to go next depends on why you took CEH:

  • OSCP for the 24-hour hands-on exam described above.
  • GPEN if your employer funds SANS training and wants a GIAC credential.
  • PNPT from TCM Security: five days of testing, two days to write the report, then a live debrief with assessors, for $499 including training.

Our view

CEH is respected by HR filters and procurement rules more than by penetration testers. Its strength is coverage and recognition: DoD 8140 approval, accreditation by the ANSI National Accreditation Board (ANAB) and a name that recruiters know. It's criticized for testing recall of tools and terms in multiple-choice form, and for a price that is high for what the knowledge exam measures. If a role or contract requires CEH, the $950 remote voucher on the self-study route is the cheapest way in, and adding the $550 Practical gives the credential some practical weight. If nobody requires it, we'd put the money toward OSCP or PNPT.

Sources