The Certified Ethical Hacker exam from EC-Council is taken by security analysts, network administrators and penetration testers who need to show they understand how attackers work. This page sets out the exam format using EC-Council's published facts and links each official content area to one of our free practice sets. It also works through three sample questions, explaining why each wrong option is wrong.
Facts verified Oct 25, 2026 against EC-Council. Dates that have passed are removed automatically.
Facts verified Oct 25, 2026 against EC-Council. Dates that have passed are removed automatically.
| Item | Detail | Official source |
|---|---|---|
| Number of questions | 125 multiple-choice questions | EC-Council |
| Time limit | 4 hours | EC-Council |
| Passing score | Cut score varies by form, typically 60%–85% | EC-Council |
| Exam fee (eligibility application) | $100 non-refundable application fee | EC-Council |
| Retake policy | Up to 4 re-attempts in one year | EC-Council |
| Delivery | Training center, EC-Council remote proctoring, or VUE test centers | EC-Council |
| Eligibility | 2 years of IT security experience, or official training | EC-Council |
Facts verified Oct 25, 2026 against EC-Council. Dates that have passed are removed automatically.
According to EC-Council, “This 4-hour exam with 125 multiple-choice questions will test your skills in:”[1]
The Certified Ethical Hacker credential checks whether you can think like an attacker so that you can defend systems. It covers reconnaissance, scanning, system and web application attacks, wireless and mobile threats, cloud computing and cryptography. The exam lasts 4 hours and has 125 multiple-choice questions. EC-Council says you can take it at a training center, online through EC-Council's remote proctoring service, or at over 4,500 VUE testing centers worldwide.
There is no single fixed pass mark. EC-Council uses more than one exam form, and the cut score depends on the form you get. Typical passing cut scores range from 60% to 85%. Be careful with any source that gives one exact passing score.
To qualify, you need either official EC-Council training or two years of work experience in an information security role. If you qualify through experience, you send EC-Council an eligibility application and pay a non-refundable $100 application fee. If you fail, you can retake the exam up to 4 times in one year.
Exam pricing, waiting periods between attempts and other policy details can change. Check the current terms on EC-Council's official certification site before you book.
The content areas below are copied from the official Certified Ethical Hacker content outline published by EC-Council. The right-hand column shows which of our practice sets covers it.
| Official content area | Practice on this site |
|---|---|
| Information Security and Ethical Hacking Overview[3] | Certified Ethical Hacker MCQ Practise the basic terms: the CIA triad, the hacking phases, types of threat actors, and the legal and authorization limits that separate ethical hacking from crime. |
| Reconnaissance Techniques[3] | Certified Ethical Hacker Footprinting and ... Practise telling passive footprinting sources such as WHOIS, DNS and public records apart from active scanning and enumeration methods. |
| System Hacking Phases and Attack Techniques[3] | Certified Ethical Hacker System Hacking an... Practise the order of gaining access, escalating privileges, keeping access and covering tracks, plus how common malware families behave. |
| Network and Perimeter Hacking[3] | Certified Ethical Hacker Session Hijacking... Practise sniffing, session hijacking and the methods attackers use to get past IDS, firewalls and honeypots, and know which defence counters each one. |
| Web Application Hacking[3] | Certified Ethical Hacker Web Application S... Practise spotting injection, cross-site scripting, broken authentication and server misconfiguration from short scenario descriptions. |
| Wireless Network Hacking[3] | Certified Ethical Hacker Wireless and IoT ... Practise wireless encryption weaknesses, deauthentication and evil twin attacks, and the tools used to capture and crack handshakes. |
| Mobile Platform, IoT, and OT Hacking[3] | Certified Ethical Hacker Wireless and IoT ... Practise the attack surfaces of mobile apps, connected devices and industrial control systems, and why patching and segmentation matter more there. |
Prepare for the Certified Ethical Hacker exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: What is a deauthentication attack in wireless hacking?
Answer: A. Sending forged deauth frames to disconnect clients from a legitimate AP, enabling further attacks
Explanation:
A is correct. On wireless networks without management frame protection, deauthentication frames are not encrypted or authenticated. An attacker can forge them using the access point's address and disconnect clients. When the clients reconnect, the attacker can capture the handshake and crack the password offline, or draw the clients to an evil twin access point.
Rule to remember: a deauthentication attack is usually a step toward something else. It forces a reconnection that the attacker can watch or redirect.
Question: Which firewall evasion technique uses a series of intermediate hosts to hide the true source of an attack?
Answer: C. Proxy Chaining
Explanation:
C is correct. With proxy chaining, the attacker sends traffic through a series of proxy servers. The target sees only the last proxy's address, and each extra hop makes the true source harder to trace.
Rule to remember: if the question is about hiding who is attacking, think proxies or anonymizers. If it is about hiding what is sent, think fragmentation or tunneling.
Question: What is the difference between active and passive reconnaissance?
Answer: A. Active directly interacts with the target system; passive gathers information without direct contact
Explanation:
A is correct. Active reconnaissance makes direct contact with the target, for example through port scans, ping sweeps or vulnerability scans, so it can be logged and detected. Passive reconnaissance gathers information without sending traffic to the target's systems. It uses sources such as WHOIS records, search engines, job postings and social media.
Rule to remember: ask whether the target could see your packets. If it could, the reconnaissance is active.
Start with one untimed pass through the Certified Ethical Hacker MCQ set to see which areas feel weakest. Ignore the score at this stage, but mark every question you guessed, even the ones you got right.
Before test day, confirm your eligibility approval, delivery option and ID requirements directly with EC-Council.
The Certified Ethical Hacker exam has 125 multiple-choice questions and a time limit of 4 hours. That leaves enough time to flag hard questions and come back to them, but it is still worth doing at least one timed practice run so the pace feels familiar on test day.
It depends on the exam form you receive. EC-Council says typical passing cut scores range from 60% to 85%, because different forms have different difficulty. Because you cannot know your form's cut score in advance, aim to score well above the low end of that range in practice.
No, but you need one of two routes. You can complete official EC-Council training, or you can show two years of work experience in an information security role. The experience route requires an eligibility application and a non-refundable $100 application fee. Check the current application steps on EC-Council's certification site.
Yes. EC-Council offers the exam through its own remote proctoring service. You can also take it at a training center or at one of over 4,500 VUE testing centers worldwide. Check EC-Council's system and room requirements before choosing the remote option.
EC-Council allows up to 4 re-attempts in one year. Retake fees and any waiting period between attempts are set by EC-Council and can change, so confirm them on the official site before rebooking. Use the time between attempts on the domains where your practice scores were lowest.
No. We wrote our practice questions ourselves with AI tools, and they are not taken from any real exam. They are built around the official content areas so you can test your understanding and find weak spots. Use them together with EC-Council's own outline and courseware, not instead of them.