The CEH — Certified Ethical Hacker — is an intermediate-level cybersecurity credential issued by EC-Council. It's one of the most recognized certifications in the security industry for professionals who work in penetration testing, vulnerability assessment, and offensive security roles.
Before you can sit for the CEH exam, you need to meet EC-Council's eligibility requirements. Unlike some certifications that only ask for an application fee, the CEH has both educational and experience requirements that screen out candidates who aren't ready for the exam's technical depth. Here's what you need to know before you apply.
EC-Council offers two pathways to CEH exam eligibility:
If you complete the official CEH training through an EC-Council Authorized Training Center (ATC) or through EC-Council iLearn (their online platform), you're eligible to take the exam without any prior work experience requirement. The training itself is your proof of preparation.
Official CEH training typically runs 5 days in an instructor-led format and costs between $1,500–$3,000 depending on the provider. The cost is significant, but it's the fastest path to exam eligibility if you don't already have 2+ years in the field.
If you're self-studying or using non-EC-Council training materials, you need to submit an application demonstrating:
EC-Council reviews these applications manually. Approval isn't guaranteed — they verify that your experience is genuinely relevant to the CEH domains (penetration testing, network security, vulnerability assessment, etc.). Generic IT support experience doesn't automatically qualify.
If your application is approved, you'll receive an eligibility code that allows you to register for the exam through ECC Exam (EC-Council's testing portal) or through Pearson VUE.
The CEH exam (312-50) is a 4-hour, 125-question multiple choice exam delivered through ECC Exam or Pearson VUE. The questions test your knowledge of ethical hacking concepts, tools, techniques, and methodologies across 20 domains.
Passing threshold: 70% or above. That translates to roughly 88 correct answers out of 125. The score isn't curved — EC-Council uses a fixed cutoff, not a relative standard.
The CEH v13 (current version) covers 20 knowledge domains. The most heavily tested areas include:
Gathering intelligence about a target before an attack — OSINT, DNS enumeration, WHOIS lookups, Google hacking, social engineering. This is the first phase of any penetration test and gets significant coverage on the exam.
Port scanning with Nmap, OS fingerprinting, banner grabbing, vulnerability scanning with tools like Nessus. You need to know both the methodology and the specific tools used in real-world engagements.
Extracting detailed information from a system after initial contact — NetBIOS enumeration, LDAP enumeration, SNMP enumeration, DNS zone transfers.
Understanding the vulnerability assessment lifecycle, common vulnerability scoring systems (CVSS), and how to use automated scanning tools to identify exploitable weaknesses.
Password cracking (dictionary attacks, rainbow tables, hash cracking), privilege escalation, maintaining access, clearing tracks. This domain tests knowledge of attack techniques that ethical hackers need to understand to defend against.
Types of malware — viruses, worms, Trojans, ransomware, rootkits — and how they operate. Analysis techniques and countermeasures.
Phishing, spear phishing, vishing, pretexting — human-based attack vectors that bypass technical controls. Increasingly relevant as social engineering drives the majority of real-world breaches.
Man-in-the-middle attacks, cookie theft, TCP session hijacking, countermeasures. This domain gets heavier coverage than many candidates expect.
Encryption algorithms (AES, RSA, DES), PKI, digital signatures, SSL/TLS, common cryptographic attacks. The exam doesn't go deeply into cryptographic mathematics, but you need solid conceptual understanding.
OWASP Top 10, SQL injection, XSS, CSRF, command injection — web application vulnerabilities are a significant portion of the exam given their prevalence in real-world attack scenarios.
The CEH gets compared to CompTIA PenTest+ and the OSCP (Offensive Security Certified Professional) frequently. Here's the honest picture:
The CEH is a knowledge-heavy exam with significant breadth. Here's what works:
The CEH certification is a meaningful investment — in time, money, and effort. Before you sit the exam, you should be comfortable across all 20 domains, especially the ones that carry the most questions. That means exposure to real security tools and techniques, not just reading about them.
Our CEH practice tests cover the core domains tested on the 312-50 exam: footprinting, scanning networks, system hacking, session hijacking, cryptography, and more. Use them to identify where you're strong and where you need more work — then direct your remaining study time accordingly.
Don't underestimate the breadth of the CEH. Twenty domains over 125 questions means you can't afford to ignore any section. The candidates who pass are the ones who've covered everything at least once, drilled their weak areas repeatedly, and gone into the exam having done enough practice tests that the question style feels familiar, not foreign.