EC-Council certification practice
Practise Certified Ethical Hacker CEH across all 13 official exam domains — Footprinting, Reconnaissance and Scanning, Enumeration and System Hacking, Malware, Social Engineering and Network Attacks, Web Application and Injection Attacks, and more — with original exam-style questions, full explanations, and wrong-answer analysis. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
Ways to study CEH
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
New here? Start with this
Start with a 25-question practice test
Covers all 13 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified Ethical Hacker CEH exam.
Exam cost
$950 USD / ~£750
Duration
240 minutes
Question count
125 questions
Passing score
60–85% (varies by form)
Validity
3 years
Delivered by
EC-Council Exam Portal / Pearson VUE
Online proctored
Yes — available
Retake policy
14 days between attempts; fees apply
Question formats
The EC-Council Certified Ethical Hacker (CEH) validates knowledge of attack techniques, hacking tools, and countermeasures used by malicious actors. Candidates learn to think and act like a hacker to better defend organizational systems. The v12 curriculum covers 20 modules including reconnaissance, scanning, exploitation, malware threats, and cloud hacking. It is widely recognized by employers and government agencies as a benchmark for offensive security knowledge.
Official prerequisite
Two years of information security work experience (waived with official EC-Council training).
Recommended experience
CompTIA Security+ or Network+ level knowledge; familiarity with Linux and networking fundamentals.
2+ years in IT security or completion of an official CEH training course.
Should you skip this exam?
Absolute beginners with no networking or security background; those seeking a purely defensive credential.
Courseiva study tip
Combine the official courseware with hands-on labs in a virtual environment; memorize tool syntax (Nmap, Metasploit, Wireshark) rather than just theory.
UK salary range
£45,000–£70,000
US salary range
$75,000–$120,000
Job roles that cite CEH v12
What certification to take next
The exam voucher costs approximately $950 USD. If you attend official EC-Council training, the voucher is typically included. Retake vouchers cost extra.
The passing score varies by exam form and ranges from 60% to 85%. EC-Council uses a cut-score method so there is no single fixed number.
The CEH exam contains 125 multiple-choice questions with a 4-hour (240-minute) time limit.
CEH covers 20 domains including footprinting, scanning networks, enumeration, vulnerability analysis, system hacking, malware threats, sniffing, social engineering, denial-of-service, session hijacking, web server and application attacks, SQL injection, cryptography, and cloud security.
It is considered moderately hard. The breadth of topics is large and many questions test scenario-based reasoning rather than pure memorization, requiring hands-on lab practice.
CEH is valid for 3 years. Renewal requires earning 120 EC-Council Continuing Education (ECE) credits over the 3-year cycle.
Security analysts, network engineers, and aspiring penetration testers who want a vendor-neutral offensive security credential recognized by governments and enterprise employers.
See how CEH v12 stacks up against related certifications.
100% free — no account required
Everything on Courseiva for CEH is free — no subscription, no trial, no email wall.
Courseiva Exam Intelligence
Data confidence: BuildingDerived from Courseiva's continuously updated practice dataset: 870 exam-style questions. Updated 2 July 2026.
Question difficulty mix
Average time per question: 81s
13
Exam domains
official blueprint domains covered by the bank
870
Questions
exam-style questions in the CEH bank
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CEH Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a 20-question session with a full explanation after each answer.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 25
A 25-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified Ethical Hacker CEH spans 13 official exam domains (Footprinting, Reconnaissance and Scanning, Enumeration and System Hacking, Malware, Social Engineering and Network Attacks, and more). Questions test whether you can apply each objective in a realistic scenario, not just recall a definition.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CEH questions linked to Footprinting, Reconnaissance and Scanning.
Practise CEH questions linked to Enumeration and System Hacking.
Practise CEH questions linked to Malware, Social Engineering and Network Attacks.
Practise CEH questions linked to Web Application and Injection Attacks.
Practise CEH questions linked to Introduction to Ethical Hacking.
Practise CEH questions linked to Scanning Networks and Enumeration.
Practise CEH questions linked to Vulnerability Analysis and System Hacking.
Practise CEH questions linked to Advanced Topics: Wireless, Cloud, IoT, Cryptography.
Practise CEH questions linked to Footprinting and Reconnaissance.
Practise CEH questions linked to Network and Web Application Attacks.
Practise CEH questions linked to Wireless, IoT and Cloud Security.
Practise CEH questions linked to Cryptography and Malware Analysis.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 8 of 58 tests. See all 58 CEH practice tests →
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Practise CEH questions in this domain →
Deep-dive questions
The most-searched CEH questions — each with a detailed explanation, worked example, and full answer breakdown.
Term reference
These terms appear frequently in CEH questions. Understanding them precisely reduces guessing and improves scores.
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
OSINT Techniques
OSINT techniques are methods used to collect information from publicly available sources for security assessments or investigations.
Zero Day Vulnerabilities
A zero day vulnerability is a security flaw in software or hardware that the vendor does not yet know about and has not fixed, making it extremely dangerous because attackers can exploit it before a patch exists.
Steganography
Steganography is the practice of hiding a secret message inside an ordinary, non-secret file such as an image, audio, or video to keep the message hidden from casual observers.
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
Exploit Databases
An exploit database is a curated collection of known software vulnerabilities, proof-of-concept exploit code, and security research findings used by ethical hackers and security professionals to test and defend systems.
Rootkit Installation
Rootkit installation is the process by which an attacker places hidden malicious software on a system to gain persistent, stealthy administrative access while avoiding detection by the operating system and security tools.
File Inclusion Attacks
File inclusion attacks exploit web application vulnerabilities to load remote or local files, often allowing attackers to execute code, steal data, or compromise a server.
Learn the concepts
18 book-style chapters cover every CEH objective in plain English. Read the theory here, then test it with practice questions.
Chapter 1
Introduction to Ethical Hacking
12 min read
Chapter 2
Footprinting and Reconnaissance
12 min read
Chapter 3
Scanning Networks
12 min read
Chapter 5
Vulnerability Analysis
12 min read
Chapter 6
System Hacking
12 min read
Chapter 7
Malware Threats
12 min read
Chapter 8
Sniffing
12 min read
Chapter 9
Social Engineering
12 min read
Free study guide
The Courseiva CEH study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Original exam-style questions — not copied from any exam or dump site. Open a question for the full answer breakdown.
A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap techn…
A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?
Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)
Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)
A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?
A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?
Related certifications
Studying for CEH? These related EC-Council certifications share concepts and are common next steps.
All EC-Council certifications →Courseiva provides free Certified Ethical Hacker CEH (CEH) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with EC-Council.