The CEH 312-50 knowledge exam has 125 multiple-choice questions and a four-hour limit. Plan your study against EC-Council’s nine examination domains, confirm your eligibility route, and use the preparation example below to practise locating activities in the blueprint. The practical assessment is separate; passing both assessments earns CEH Master.
How the CEH knowledge exam works
The CEH credential is awarded for passing the 312-50 knowledge exam: four hours, 125 multiple-choice questions, closed book, with per-form cut scores of 60% to 85%. Version 13 refers to the current program (CEH AI); the exam blueprint is a separate document, currently labeled v5.0.
EC-Council describes the Certified Ethical Hacker as a vendor-neutral credential in the specific discipline of ethical hacking: finding weaknesses in target systems using the same knowledge and tools as a malicious attacker, but lawfully and with permission. The credential is awarded when you pass the knowledge examination, exam code 312-50. The separate hands-on practical exam is optional; passing it as well earns the CEH Master designation.
The knowledge exam is a four-hour, 125-question multiple-choice test. It is closed book, and EC-Council delivers it through the ECC Exam Centre and Pearson VUE testing centers, with a remote proctoring option that must be booked at least three days ahead. Cut scores are set per exam form and range from 60% to 85%, so the exact pass mark depends on which question bank you receive.
The v13 label refers to the CEH program, marketed as CEH AI. The examination blueprint is a separate document labelled version 5.0. Check the current program page and linked blueprint when choosing materials.
- Cut scores range from 60% to 85% and are set per exam form
- Remote proctored sessions must be booked at least three days in advance
- The practical exam is optional and leads to the CEH Master designation
Sources: Certified Ethical Hacker - EC-Council Certification Site — cert.eccouncil.org/certified-ethical-hacker.html; CEH Certification | Certified Ethical Hacker AI Course | EC-Council — eccouncil.org/train-certify/certified-ethical-hacker-ceh/; CEH Exam Blueprint v5.0 (EC-Council) — cert.eccouncil.org/wp-content/uploads/2024/04/CEH-Exam-Blueprint-v5.pdf
Eligibility routes and booking
You qualify either by attending official EC-Council training or by applying directly with at least two years of InfoSec experience and a USD 100 non-refundable fee. Applications take five to ten working days and stay valid for three months; vouchers last one year.
There are two routes to the exam. Attending official EC-Council training — through iClass, an Authorized Training Center, or an academia partner — makes you eligible without a separate application. Alternatively, you can apply directly with a minimum of two years of information security work experience.
The direct route requires a USD 100 non-refundable application fee; official training includes that fee in its price. Applications are processed in roughly five to ten working days once your verifiers respond, and an approved application stays valid for three months. Exam vouchers are valid for one year from receipt. If you do not pass, retake requests are purchased by contacting EC-Council's certification department, and some official training packages include free retakes.
Sources: Certified Ethical Hacker - EC-Council Certification Site — cert.eccouncil.org/certified-ethical-hacker.html; CEH Certification | Certified Ethical Hacker AI Course | EC-Council — eccouncil.org/train-certify/certified-ethical-hacker-ceh/
The nine blueprint domains
The CEH AI course has 20 modules, but the exam is built from nine domains in EC-Council's Exam Blueprint, currently published as v5.0. Network and perimeter hacking (24%) and reconnaissance techniques (17%) carry the most weight.
Plan your review time against the blueprint rather than the module list, because the blueprint is the official testing map. The weights below are as printed in the blueprint; the sub-domain column summarizes what each domain covers.
Two domains together account for over 40% of the exam: network and perimeter hacking at 24% and reconnaissance techniques at 17%. Web application hacking follows at 14%. The blueprint PDF linked in the sources section gives the authoritative sub-domain breakdown, so download it and use it as your checklist.
The percentages in the published blueprint total 101%; they are reproduced here without changing the issuer’s figures. Use the document’s domain and task descriptions as your coverage checklist.
| Blueprint domain | Weight | Representative sub-domains |
|---|---|---|
| 1. Information Security and Ethical Hacking | 6% | Hacking concepts, security controls, laws and standards |
| 2. Reconnaissance Techniques | 17% | Footprinting, network scanning, enumeration |
| 3. System Hacking Phases and Attack Types | 15% | Vulnerability analysis, system hacking, malware threats |
| 4. Network and Perimeter Hacking | 24% | Sniffing, social engineering, DoS/DDoS, session hijacking, IDS, firewall and honeypot evasion |
| 5. Web Application Hacking | 14% | Web servers, web applications, SQL injection |
| 6. Wireless Network Hacking | 5% | Wireless concepts, encryption, Bluetooth, countermeasures |
| 7. Mobile Platform, IoT, and OT Hacking | 10% | Android and iOS attack vectors, IoT and OT hacking |
| 8. Cloud Computing | 5% | Cloud concepts, containers, serverless, cloud attacks |
| 9. Cryptography | 5% | Encryption algorithms, PKI, cryptanalysis |
Sources: CEH Exam Blueprint v5.0 (EC-Council) — cert.eccouncil.org/wp-content/uploads/2024/04/CEH-Exam-Blueprint-v5.pdf; CEH Certification | Certified Ethical Hacker AI Course | EC-Council — eccouncil.org/train-certify/certified-ethical-hacker-ceh/
Concepts worth drilling in the heavy domains
In scanning, keep host discovery, port scanning, and banner grabbing apart; in sniffing, MAC flooding has a well-documented mechanism (switch table exhaustion) and a documented control (port security). Pair every technique with the behavior it abuses and the control that addresses it.
The blueprint splits scanning into host discovery, port and service discovery, and OS discovery through banner grabbing or fingerprinting. NIST SP 800-115 — a technical reference rather than the CEH syllabus — keeps these distinct: a port scanner remotely determines which ports on a system are open, and OS fingerprinting analyzes characteristics of packets sent by a target, such as headers and listening ports, to identify the operating system in use.
Cisco’s switching documentation describes MAC flooding as sending frames with many unique source MAC addresses to fill a switch’s MAC table. A full table may cause unknown-unicast frames to be flooded within the VLAN. The same documentation describes port security, including limits on learned addresses and configured violation actions. Review the platform’s actual conditions rather than assuming that every frame is broadcast or that one recovery method applies to every configuration.
The blueprint also names ARP poisoning, DHCP attacks, DNS poisoning, session hijacking, and IDS or firewall evasion. Use those as a coverage checklist. When studying a technique, record its purpose, assumptions and relevant controls from an appropriate technical reference. Classification in the exercise below follows the blueprint’s headings; real activities can overlap.
Sources: CEH Exam Blueprint v5.0 (EC-Council) — cert.eccouncil.org/wp-content/uploads/2024/04/CEH-Exam-Blueprint-v5.pdf; NIST SP 800-115, Technical Guide to Information Security Testing and Assessment — nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-115.pdf; CDP, LLDP, MAC, and UDLD Configuration Guide (Cisco) — cisco.com MAC address and port security configuration guide
A worked classification exercise
Classify four authorized lab activities as footprinting, network scanning, or enumeration using only placements that EC-Council's blueprint states explicitly. The answer and reasoning follow the prompt, so commit to your calls first.
This exercise checks where activities appear in EC-Council’s published blueprint. It does not predict the wording or reasoning of real examination questions. Assume written authorization for an isolated lab environment and classify each described activity using that document.
Practice exercise
A tester with written authorization works on an isolated lab network. Classify each activity as footprinting, network scanning, or enumeration, according to EC-Council's CEH Exam Blueprint v5.0. (1) A WHOIS lookup on the target's domain, plus a review of its public DNS records. (2) Probing a block of internal IP addresses to learn which hosts respond and which TCP ports are open. (3) Connecting to the SNMP service on a discovered router and retrieving its list of devices and users. (4) Opening a connection to a running service and reading the banner that reports the software name and version.
Show answer
(1) Footprinting — Whois and DNS footprinting are listed sub-techniques under the blueprint's reconnaissance domain. (2) Network scanning — host discovery and port and service discovery are scanning sub-topics. (3) Enumeration — the blueprint lists SNMP enumeration among its enumeration techniques. (4) Network scanning — the blueprint places OS Discovery (Banner Grabbing/OS Fingerprinting) within the Scanning Networks sub-domain.
The blueprint places WHOIS and DNS footprinting under footprinting, host and port discovery under scanning, SNMP enumeration under enumeration, and banner grabbing under OS discovery within scanning. NIST’s glossary describes banner grabbing as obtaining information transmitted by a remote port when a connection begins. These answers follow the stated classification task; they do not establish mutually exclusive phases for every real assessment.
Sources: CEH Exam Blueprint v5.0 (EC-Council) — cert.eccouncil.org/wp-content/uploads/2024/04/CEH-Exam-Blueprint-v5.pdf; NIST SP 800-115, Technical Guide to Information Security Testing and Assessment — nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-115.pdf
CEH (Practical) and the Master designation
CEH (Practical) is a separate six-hour, open-book exam with 20 challenges in the iLabs Cyber Range, listed at USD 550 on EC-Council's store. Passing both exams earns the CEH Master designation.
CEH (Practical) is a separate six-hour, hands-on exam with 20 challenges in the iLabs Cyber Range. Unlike the knowledge exam, it is open book, and its cut score also ranges from 60% to 85%. EC-Council's store lists the practical exam at USD 550, and the dashboard code used to schedule it is valid for one year from receipt.
Passing both exams earns the CEH Master designation. EC-Council describes the practical as testing applied skills on live virtual machines rather than simulations: network scanning, OS banner grabbing and enumeration, system hacking, packet sniffing, web application attacks, SQL injection, and cryptography attacks.
If you took official CEH training, EC-Council's store asks you to submit your Certificate of Attendance before buying the practical dashboard code; self-study students must apply for eligibility first. Practical sessions must be booked at least three days in advance.
Sources: Certified Ethical Hacker (Practical) - EC-Council Certification Site — cert.eccouncil.org/certified-ethical-hacker-practical.html; CEH (Practical) Exam – EC-Council Store — store.eccouncil.org/product/ceh-practical-exam/; CEH Master Certification | EC-Council — eccouncil.org/train-certify/ceh-master/; CEH Certification | Certified Ethical Hacker AI Course | EC-Council — eccouncil.org/train-certify/certified-ethical-hacker-ceh/
Your preparation checklist
Confirm eligibility, map your review to all nine domains, and check mistakes against the relevant official or technical source.
Use the blueprint to track topics you have reviewed and areas that need more work. Record why a practice answer was wrong and revisit its source before repeating the question. If you also plan to take CEH Practical, include authorized hands-on preparation appropriate to that separate assessment.
- Confirm official-training eligibility or complete the experience-route application.
- Download the current examination blueprint and cover each domain.
- Use practice questions to identify gaps, then check the explanations against appropriate sources.
- Keep knowledge-exam preparation and practical-assessment preparation distinct.
Sources: CEH Certification | Certified Ethical Hacker AI Course | EC-Council — eccouncil.org/train-certify/certified-ethical-hacker-ceh/; Certified Ethical Hacker - EC-Council Certification Site — cert.eccouncil.org/certified-ethical-hacker.html; CEH Exam Blueprint v5.0 (EC-Council) — cert.eccouncil.org/wp-content/uploads/2024/04/CEH-Exam-Blueprint-v5.pdf
Sources
Facts checked:
- Certified Ethical Hacker - EC-Council Certification Site
- CEH Exam Blueprint v5.0 (EC-Council)
- Certified Ethical Hacker (Practical) - EC-Council Certification Site
- CEH Master Certification | EC-Council
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- CDP, LLDP, MAC, and UDLD Configuration Guide (Cisco)
- CEH Certification | Certified Ethical Hacker AI Course | EC-Council
- CEH (Practical) Exam – EC-Council Store