All AppsNeuron Trainer HealthNeuron Trainer TradesNeuron Trainer TechNeuron Trainer NextNeuron Trainer MotionStudy GuidesTechnologyRoadmapPricingReviewsAboutFAQFor OrganizationsSupportGet the Apps →
Free CEH practice · Tech

CEH practice test: 4 free questions, and why your pass mark depends on the form

EC-Council’s CEH knowledge exam is 125 multiple-choice questions in four hours. There is no single passing score: EC-Council sets a cut score per exam form, published as ranging from 60% to 85%, so the same performance can pass one paper and fail another. The credential lasts three years, and sitting it requires official training or an approved eligibility application.

Formally the Certified Ethical Hacker (CEH). Awarding body: EC-Council. Neuron Trainer is an independent study app and is not affiliated with, endorsed by or sponsored by the organization that owns this exam.

Start the free practice test

CEH at a glance, with the source for every line

Every row below is quoted from a document published by EC-Council and carries the date we checked it. Where EC-Council publishes nothing, the row says so instead of quoting a number from somewhere else.

Questions
125 multiple-choice questions.Source: EC-Council, CEH Candidate Handbook v6, verified 7 August 2026
Time limit
4 hours.Source: EC-Council, CEH Candidate Handbook v6, verified 7 August 2026
Passing score
There is no single passing score. Cut scores vary by exam form and range from 60% to 85%.Source: EC-Council, Certified Ethical Hacker (CEH) course page, verified 7 August 2026
How long it lasts
Three years, renewable by earning 120 EC-Council Continuing Education credits within the period.Source: EC-Council, CEH Candidate Handbook v6, verified 7 August 2026
Current version
CEH v13.Source: EC-Council, Certified Ethical Hacker (CEH) course page, verified 7 August 2026
The optional practical
A separate 6-hour practical exam of 20 real-world challenges. Passing both the knowledge exam and the practical earns CEH Master.Source: EC-Council, Certified Ethical Hacker (CEH) course page, verified 7 August 2026
Eligibility
Two routes. Complete official EC-Council training, or apply to sit without it by proving at least two years of information-security work experience, remitting a non-refundable USD 100 eligibility application fee and submitting an Exam Eligibility Application Form.Source: EC-Council, CEH Candidate Handbook v6, verified 7 August 2026
Security+, for comparison
CompTIA publishes a fixed 750 on a scale of 100–900 for Security+ (SY0-701), with a maximum of 90 questions in 90 minutes.Source: CompTIA, Security+ certification page, verified 7 August 2026
Official domain weights
Not published by EC-Council. EC-Council does not publish percentage weights per domain for the CEH knowledge exam the way CompTIA, Cisco, AWS and Microsoft do. Any weighting table you find, including ours, is an interpretation rather than a published EC-Council weighting.Checked against: EC-Council, CEH Candidate Handbook v6, verified 7 August 2026
Pass rate
Not published by EC-Council. EC-Council does not publish a CEH pass rate.Checked against: EC-Council, CEH Candidate Handbook v6, verified 7 August 2026
Cost
Not published by EC-Council. EC-Council publishes no standalone CEH exam fee. Its own CEH page prices training packages rather than the exam, and routes anyone asking for a voucher price to a sales contact form, so there is no list price to quote. Ask EC-Council or your training provider for the current voucher cost.Checked against: EC-Council, Certified Ethical Hacker (CEH) course page, verified 7 August 2026

Always verify: CEH requires an eligibility application or official training before you can book, and pricing depends on the route you take. Confirm eligibility, timing and cost with EC-Council before you plan around a date.

What our CEH question bank covers

What this app's question bank covers — our own category shares across 652 questions, not EC-Council's published blueprint.
CategoryQuestions in our bankShare of our bank
Ethical Hacking Overview
Information security, hacking concepts, methodology, legal/compliance
324.9%
Reconnaissance
OSINT, footprinting, DNS enumeration, Shodan, passive vs active
13019.9%
System Hacking & Attacks
Password attacks, privilege escalation, persistence, malware
16224.8%
Network & Perimeter Hacking
Sniffing, MITM, social engineering, IDS/firewall evasion
9815%
Web Application Hacking
OWASP Top 10 - injection, XSS, CSRF, SSRF, IDOR, auth flaws
9815%
Wireless Hacking
WPA/WPA2/WPA3 attacks, evil twin, deauth
324.9%
Mobile, IoT & OT
Mobile platform, IoT, OT, embedded device hacking
365.5%
Cloud Hacking
Cloud-specific attacks, misconfiguration, IAM abuses
324.9%
Cryptography
Crypto fundamentals, weaknesses, attacks
324.9%

Scroll the table sideways to see every column.

Try it

4 questions from our CEH bank

Questions from our ethical hacking bank, spanning reconnaissance through cryptography, with a full explanation on each.

CEH · Free practice Every answer explained. No signup, no email wall.

  1. Question 1 of 4

    A penetration tester obtains an NTLM hash for a domain administrator account from a compromised workstation's LSASS memory but cannot crack the hash into plaintext. Which technique allows the tester to authenticate to other systems using only this captured hash?
    Answer and explanation

    Correct answer: Pass-the-hash

    Pass-the-hash works because NTLM authentication accepts the hash itself as proof of identity, so a plaintext password is never required to authenticate. Pass-the-ticket instead replays Kerberos TGT/TGS tickets, not applicable since only an NTLM hash was captured. Kerberoasting extracts service account TGS material to crack offline, a different mechanism requiring an SPN. Rainbow table attacks recover plaintext from a hash offline but do not directly authenticate you to a system.

  2. Question 2 of 4

    Which statement BEST describes the primary function of the theHarvester tool during the reconnaissance phase of a penetration test?
    Answer and explanation

    Correct answer: It aggregates emails, subdomains, hostnames, and employee names from public sources such as search engines and PGP key servers

    theHarvester is an OSINT aggregation tool that pulls data from search engines (Google, Bing), PGP key servers, Shodan, and other public sources to compile email addresses, subdomains, and employee names for a target domain — entirely passive. It does not brute-force credentials against a login portal, run vulnerability scans, or sniff live network traffic; those functions belong to tools like Hydra, Nessus, and Wireshark respectively, and conflating them is a common distractor pattern on the exam.

  3. Question 3 of 4

    A tester observes network traffic showing a Diffie-Hellman key exchange between a client and server. Which condition would make the shared secret feasibly recoverable via a precomputed, logjam-style attack?
    Answer and explanation

    Correct answer: The server negotiates a commonly reused 512-bit or 1024-bit DH group

    Logjam-style attacks exploit the fact that many servers reuse a small number of standard DH primes; nation-state-level actors can precompute discrete-log tables for these shared 512-bit and 1024-bit groups, enabling near-real-time key recovery. ECDHE with P-256 uses elliptic-curve math with no equivalent widespread precomputation break at that curve strength. AES-256-GCM is the symmetric cipher, unrelated to the DH exchange itself. RSA signing key size affects certificate authentication, not the DH group's discrete-log strength.

  4. Question 4 of 4

    A tester chooses Recon-ng over manually running individual OSINT tools for a footprinting engagement. What is the PRIMARY advantage of using this framework?
    Answer and explanation

    Correct answer: It provides a modular, Metasploit-like command structure that automates and chains multiple OSINT data sources

    Recon-ng uses a console interface deliberately modeled on Metasploit, with modules, workspaces, and API key management that let a tester chain multiple OSINT sources and automatically feed results between modules, streamlining what would otherwise be manual cross-referencing. It has no built-in exploitation capability, is not a network scanner competing with Nmap's speed, and has no function for bypassing authentication controls — those distractors describe capabilities of entirely different tool categories (exploitation frameworks and scanners).

What actually trips people up on CEH

You cannot aim at a percentage

Cut scores are set per exam form and range from 60% to 85%, so a score that passes one form may fail another. The only sane strategy is to be comfortably strong everywhere rather than optimizing to a threshold. Treat 85% as your target and the variance stops mattering.

Tools are examined by exact function, not by category

theHarvester aggregates emails, subdomains and names from public sources and is entirely passive. Recon-ng is a Metasploit-style framework that chains OSINT modules. Nmap scans. Hydra brute-forces. Wireshark sniffs. The distractors deliberately swap one tool’s job for another’s, and vague familiarity is not enough.

Credential attacks have precise names

Pass-the-hash reuses an NTLM hash directly because NTLM accepts it as proof of identity. Pass-the-ticket replays Kerberos tickets. Kerberoasting extracts service-account material to crack offline. Rainbow tables recover plaintext from hashes. When the scenario says an NTLM hash that could not be cracked, three of those are wrong.

Passive and active reconnaissance is a hard boundary

A lot of questions turn on whether a technique touches the target. OSINT gathering, WHOIS and public search are passive. Port scanning, banner grabbing and enumeration are active. The exam uses this distinction to separate otherwise similar answers.

The crypto questions are about implementation failures

Not the mathematics. Logjam works because servers reuse a small set of standard 512-bit and 1024-bit Diffie-Hellman groups, making precomputation viable. Know the named weaknesses and what condition enables each one.

A 10-week study plan

Ten weeks, because the syllabus is wide and tool-specific. Our CEH bank holds 652 questions covering the attack lifecycle from reconnaissance through cloud and cryptography.

Weeks 1–2: reconnaissance and footprinting

Our second largest area at 130 questions, behind system hacking. OSINT sources and tools, the passive versus active boundary, WHOIS and DNS enumeration, and what each named utility returns.

Weeks 3–4: scanning, enumeration and system hacking

Our largest area at 162 questions. Scanning technique and evasion, service enumeration, then privilege escalation, credential attacks and the pass-the-hash family, and maintaining access.

Weeks 5–6: network and perimeter

98 questions in our bank, level with web application hacking. Sniffing, social engineering, denial of service, session hijacking, and evading IDS, firewalls and honeypots.

Weeks 7–8: web applications and wireless

Web server and application attacks, SQL injection, then wireless protocols and their attacks.

Weeks 9–10: mobile, IoT, cloud and cryptography, then simulate

Cover the remaining areas, then sit 125-question, four-hour simulations. Aim for consistent high accuracy rather than a target percentage, because the real cut score moves between forms.

Is CEH hard?

CEH is long rather than deep: 125 questions across four hours, so the clock is not the hard part. The unusual difficulty is that you cannot know your target. EC-Council rotates exam forms and sets a cut score per form, published as ranging from 60% to 85%, so the same performance could pass one paper and fail another. The only sane response is to prepare to the top of that range.

The content difficulty is naming precision. The exam names specific tools and expects you to know exactly what each does: theHarvester aggregates public OSINT passively, Recon-ng chains OSINT modules in a Metasploit-style console, Nmap scans, Hydra brute-forces. Distractors are built by swapping one tool’s function for another’s, so approximate familiarity is not enough.

EC-Council also does not publish percentage weights per domain, unlike CompTIA, Cisco, AWS and Microsoft. That means no one, including us, can tell you authoritatively how much of the exam is web application hacking. Any weighting table you find is an interpretation of the module list. EC-Council publishes no pass rate either.

Our bank of 652 questions carries 396 at difficulty 3 or 4, weighted toward system hacking at 162 questions and reconnaissance and network hacking at 130 and 98. That is our own reading of the syllabus, and EC-Council publishes no weighting to check it against.

How the CEH differs from the exams beside it

CEH is the only exam in our Tech family whose awarding body states the pass mark itself varies by exam form: EC-Council rotates forms and sets a cut score per form, anywhere from 60% to 85%. Cisco, by contrast, simply does not disclose a CCNA pass mark at all. Either way you cannot target a number the way you can with the fixed 750 CompTIA publishes for Security+. EC-Council also publishes no domain weights. It is also the only one gated by an application: EC-Council’s handbook sets out two routes, official training or an application backed by two years of information-security experience and a USD 100 application fee. And it is tool-heavy in a way nothing else here is, naming specific utilities and expecting you to know what each one actually does.

Questions people actually ask about the CEH

What is the passing score for the CEH exam?

There is no single one. EC-Council sets a cut score per exam form, and published cut scores range from 60% to 85%. Because forms rotate, you cannot know which threshold you will face, so aim for the top of that range.

How many questions is the CEH exam?

125 multiple-choice questions in four hours, per EC-Council’s candidate handbook. That is a far longer sitting than any CompTIA exam on these pages, and the clock is rarely what fails people.

How long is CEH valid?

Three years. You renew by earning 120 EC-Council Continuing Education credits within the three-year period, after which the certification extends for another three years.

What is the difference between CEH and CEH Master?

CEH is the 125-question knowledge exam. CEH Master requires passing that plus a separate 6-hour practical exam of 20 real-world challenges in a cyber range. The practical is optional.

Do you need training before you can sit CEH?

Not necessarily, but there is an eligibility step either way. EC-Council’s candidate handbook gives two routes: complete official training, or prove at least two years of information-security experience, pay a non-refundable USD 100 application fee and submit an eligibility form. Build that lead time in.

How long should you study for CEH?

Ten weeks, because the syllabus is wide and names specific utilities: two on reconnaissance, two on scanning and system hacking, two on network and perimeter, two on web and wireless, two on the remainder plus full-length timed runs.

Is CEH harder than Security+?

It is longer and broader, at 125 questions over four hours against the 90 questions in 90 minutes CompTIA publishes for Security+, and far more tool-specific. Security+ has the higher fixed bar at 750 of 900. CEH’s difficulty comes from breadth, the naming precision, and not knowing your cut score in advance.

Are these real CEH exam questions?

No. All 652 are our own, written from EC-Council’s published CEH module list. EC-Council’s candidate agreement prohibits reproducing live items and can revoke a certification. Because CEH names specific tools, our explanations say what each utility actually does rather than only marking an answer correct.

Practice another Tech exam

IT, cloud & cybersecurity. Every one of these pages is built the same way: sourced facts, an honest admission where the sponsor publishes nothing, and free practice questions.

The app

The CEH app is still in development

The ethical hacking app carries 652 questions covering the attack lifecycle from reconnaissance through system hacking, web applications, wireless, cloud and cryptography, each with a full written explanation. It includes Smart Quiz, Topic Drill, a fixed-length 125-question Exam Simulator on a 240-minute clock matching EC-Council’s exam length, and an AI tutor. It is not on the App Store yet.

  • Smart Quiz — keeps returning to the categories you keep missing
  • Topic Drill — one category at a time, on its own
  • Exam Simulator — a fixed-length timed paper (125 questions in 240 minutes, as this app sets it). It does not get harder as you go; the length and the mix are fixed.
  • AI tutor — re-explains any question in plain English
  • Progress tracking, reported per category
  • Study reminders
  • Light and dark themes

The app calls you ready at 70% on its own simulator. That is an in-app practice target we chose, not EC-Council's passing standard.

Not on the App Store yet. This one is still in development, so there is nothing to download today. The practice questions above are the whole of what we can give you right now, and they are free and complete. See where it sits in the queue, or browse the apps that are live.

Aim for 85%, not the minimum.

EC-Council sets a different cut score per exam form, anywhere from 60% to 85%. The app is in development; the practice questions and verified CEH facts on this page are free now.

See the apps that are live

Sources, and when we last checked them

This page was last reviewed on . The 8 facts quoted above were last checked against their sources on . Where EC-Council publishes nothing, the table above says so rather than guessing.

CEH and Certified Ethical Hacker are trademarks of EC-Council. Neuron Trainer is an independent study aid and is not affiliated with, endorsed by, or sponsored by EC-Council.