CEH / EXAM GUIDE Know the format.
Build a plan for every question.
Understand CEH questions, timing, and scoring so you can practise with a clear purpose.
Published by PrepForCerts · Editorial responsibility and sources
How Many Questions Are on the CEH Exam? Everything You Need to Know
One of the most common questions candidates ask is "How many questions are on EC-Council CEH?" The answer matters more than you might think for planning your CEH preparation strategy.
The EC-Council CEH certification from EC-Council validates your expertise in this field. This guide covers 125 questions across 240 minutes, the exam-form-specific passing standard, and strategic approaches for each question type. From time management to scoring mechanics, here's everything candidates need for effective exam preparation.
Plan your next step
CEH has 125 questions and 240 minutes. This page covers the CEH knowledge exam; CEH Practical is a separate assessment. CEH uses an exam-form-specific passing standard. Check EC-Council’s current passing criteria; do not assume a fixed 70% target or a fixed number of mistakes allowed.
- Questions
- 125
- Time Limit
- 240 minutes
- Passing Score
- Varies by exam form
- Question Types
- multiple-choice questions
Provider reference: CEH uses an exam-form-specific passing standard. Check EC-Council’s current passing criteria; do not assume a fixed 70% target or a fixed number of mistakes allowed. Study schedules and practice percentages are planning examples, not official requirements or pass predictions. Confirm current fees and eligibility before purchase. Exam details · Maintenance policy
The CEH knowledge exam contains 125 multiple-choice questions with a four-hour time limit. The passing standard varies by exam form. Its breadth includes reconnaissance, scanning, system and network attacks, web and cloud topics, and ethical and legal constraints.
CEH is one of the most recognized offensive security certifications globally, validated by the U.S. Department of Defense and required for many government cybersecurity positions. Understanding the exam format, question distribution, and preparation strategies is essential for passing on your first attempt and planning for the current retake cost.
CEH Exam Format and Question Types
The CEH knowledge exam is entirely multiple-choice — there are no performance-based questions (PBQs), simulations, drag-and-drop, or hands-on labs in the knowledge exam. Every question presents four answer options with exactly one correct answer. This format is notably different from CompTIA exams (which include PBQs) and the OSCP (which is entirely hands-on).
Questions primarily test your knowledge of:
- Hacking tools and their usage: Expect questions about Nmap, Metasploit, Wireshark, Burp Suite, Hydra, John the Ripper, Aircrack-ng, and dozens of other tools.
- Attack methodologies: Reconnaissance, scanning, enumeration, gaining access, maintaining access, and covering tracks.
- Countermeasures: How to defend against each type of attack, including firewall configuration, IDS/IPS deployment, and encryption.
- Ethical and legal frameworks: Laws governing penetration testing, rules of engagement, and reporting requirements.
CEH Domain Breakdown (20 Modules)
The following training-topic list is a study checklist. It is not the current exam blueprint or an official item distribution. Use EC-Council’s current exam blueprint to confirm exam domains; no fixed number of questions per training module is promised.
| Module | Topic | Est. Questions |
|---|---|---|
| 1 | Introduction to Ethical Hacking | Varies by exam form |
| 2 | Footprinting and Reconnaissance | Varies by exam form |
| 3 | Scanning Networks | Varies by exam form |
| 4 | Enumeration | Varies by exam form |
| 5 | Vulnerability Analysis | Varies by exam form |
| 6 | System Hacking | Varies by exam form |
| 7 | Malware Threats | Varies by exam form |
| 8 | Sniffing | Varies by exam form |
| 9 | Social Engineering | Varies by exam form |
| 10 | Denial-of-Service | Varies by exam form |
| 11 | Session Hijacking | Varies by exam form |
| 12 | Evading IDS, Firewalls, and Honeypots | Varies by exam form |
| 13 | Hacking Web Servers | Varies by exam form |
| 14 | Hacking Web Applications | Varies by exam form |
| 15 | SQL Injection | Varies by exam form |
| 16 | Hacking Wireless Networks | Varies by exam form |
| 17 | Hacking Mobile Platforms | Varies by exam form |
| 18 | IoT and OT Hacking | Varies by exam form |
| 19 | Cloud Computing | Varies by exam form |
| 20 | Cryptography | Varies by exam form |
Time Management Strategy for 125 Questions
With 240 minutes for 125 questions, you have approximately 1 minute and 55 seconds per question. This is generous compared to most IT certification exams. However, effective time management still matters because some questions require careful reading of scenario-based prompts.
Recommended Approach
- First pass (150 minutes): Work through all 125 questions at a steady pace. Answer questions you are confident about immediately and flag uncertain ones for review.
- Second pass (60 minutes): Return to flagged questions with fresh perspective. Re-read the question stem carefully — CEH questions often include subtle keywords that change the correct answer.
- Final review (30 minutes): Verify no questions are left unanswered. Double-check any answers you changed during the second pass.
Common Question Patterns
CEH questions frequently follow these patterns:
- "Which tool would you use to..." — Tests your knowledge of specific hacking tools and their purposes.
- "An attacker has performed X. What type of attack is this?" — Tests attack classification and methodology.
- "What is the best countermeasure for..." — Tests defensive knowledge and mitigation strategies.
- "During a penetration test, you discover..." — Scenario-based questions testing practical judgment.
With 125 questions in 240 minutes, time management is critical. Here's how to approach it:
Calculate Your Average Time Per Question Divide your total time by the number of questions to get your baseline pace. For EC-Council CEH, this works out to approximately 115 seconds per question on average.
Strategy for Maximum Efficiency: 1. First Pass (60% of time): Answer all questions you're confident about. Mark difficult questions for review. 2. Second Pass (30% of time): Return to marked questions and work through them carefully. 3. Final Review (10% of time): Check your answers, especially where your reasoning was uncertain.
Don't Get Stuck
If you spend more than 2 minutes on any single multiple-choice question without progress, mark it and move on. Spending too much time on difficult questions can prevent you from answering easier questions you know well.
CEH Exam Cost and Registration
The cost of taking the CEH exam varies based on your training path:
| Option | Cost | Includes |
|---|---|---|
| EC-Council Official Training + Exam | Check current provider price | Instructor-led or self-paced training, exam voucher, labs |
| Exam Voucher Only (with approved application) | Check current provider price | Exam voucher only — requires 2 years of infosec experience |
| Application Fee (self-study path) | $100 | Non-refundable application review fee |
| Retake Voucher | Check current provider price | Varies by program and waiting period |
Self-study eligibility: If you choose not to take EC-Council's official training, you must submit an application proving at least 2 years of information security work experience. EC-Council reviews the application and charges a non-refundable $100 fee. If approved, you can purchase the exam voucher separately for the current regional price.
CEH vs. Other Ethical Hacking Certifications
| Certification | Questions | Time | Format | Cost | Focus |
|---|---|---|---|---|---|
| CEH | 125 | 240 min | Multiple-choice | Check current provider price | Broad ethical hacking |
| CompTIA PenTest+ | Up to 85 | 165 min | MC + PBQs | Check current provider price | Penetration testing methodology |
| OSCP | N/A | 23h 45m | Hands-on lab | Check current provider price | Practical exploitation |
| GPEN (SANS) | 82 | 180 minutes | Multiple-choice and CyberLive practical items | Check current provider price | Advanced penetration testing |
| eJPT | 45 questions (2026 update) | Check current exam attempt | Hands-on lab | Check current provider price | Entry-level pentesting |
CEH is the most widely recognized ethical hacking certification for compliance and HR requirements. OSCP is preferred for technical credibility among red team professionals. PenTest+ offers the best value for money at $404 with a vendor-neutral approach. Your choice depends on whether you need the certification for job requirements (CEH), practical skill validation (OSCP), or career entry (PenTest+ or eJPT).
How to Prepare for the CEH Exam
Study Timeline
An example plan for candidates with existing security knowledge (Security+ level or equivalent) is 6–10 weeks of dedicated study. Complete beginners should allow 3-4 months to build foundational networking and security knowledge first.
Recommended Study Resources
- EC-Council iLabs: Hands-on virtual labs covering all 20 modules — essential for understanding tool usage even though the exam is multiple-choice.
- Matt Walker's CEH All-in-One Guide: Comprehensive textbook covering all exam objectives with practice questions per chapter.
- Practice exams: Take at least 3-4 full-length practice tests under timed conditions. Aim for consistent scores of 80%+ before scheduling the real exam.
- Tool familiarity: Even though you won't use tools during the exam, knowing what each tool does, its command syntax, and typical output is essential for answering questions correctly.
Key Tools to Memorize
The following tools appear most frequently on the CEH exam:
- Nmap: Network scanning and port discovery. Know scan types (-sS, -sT, -sU, -sV, -O) and their purposes.
- Metasploit: Exploitation framework. Understand modules, payloads, and meterpreter commands.
- Wireshark: Packet capture and analysis. Know common filters and protocol analysis.
- Burp Suite: Web application testing. Understand proxy, scanner, and intruder modules.
- Aircrack-ng: Wireless network cracking. Know WEP vs. WPA/WPA2 attack methods.
- SQLmap: Automated SQL injection. Understand injection types and database enumeration.
CEH Certification Maintenance
CEH certification is valid for 3 years. To maintain it, you must:
- Earn 120 EC-Council Continuing Education (ECE) credits within the 3-year cycle (40 per year is a planning average).
- Pay an annual maintenance fee of $80/year ($240 total over 3 years).
- Submit credits through the EC-Council ASPEN portal.
Eligible training, conferences, webinars, published research, and teaching can support continuing education. A newer eligible exam may earn credits under EC-Council’s rules, but another certification does not automatically renew CEH.
EC-Council CEH Exam Structure Overview
The EC-Council CEH exam is designed to thoroughly assess your knowledge and skills. Here's the complete breakdown of what you'll face:
Total Questions: 125 Time Allowed: 240 minutes Passing Score: Varies by exam form Number of Exams: 1
The exam is administered by EC-Council and can be taken at authorized testing centers or online with live proctoring. The questions are designed to test both theoretical knowledge and practical application of concepts.
Types of Questions You Will See
The EC-Council CEH exam includes multiple-choice questions. Understanding each question type helps you prepare effectively:
Multiple-Choice Questions (MCQ) The majority of questions are traditional multiple-choice with four answer options. Read the item and select the single best answer.
Question Distribution by Domain
Questions are distributed across all exam domains based on their weight in the exam objectives. Higher-weighted domains have more questions. Review the official exam objectives to understand the percentage breakdown for each domain.
Scoring and Passing Requirements
Understanding how EC-Council CEH scoring works helps you set realistic goals:
Scoring: The provider uses the scoring standard for its exam. Do not infer the value of an individual question from domain weights or convert a scaled score into a raw percentage. Answer each item to the best of your knowledge.
Understanding the passing standard: CEH uses an exam-form-specific passing standard. Check EC-Council’s current passing criteria; do not assume a fixed 70% target or a fixed number of mistakes allowed.
Score Report
After the exam, you receive a score report showing your performance by domain. If you don't pass, this report helps identify weak areas for focused study before your retake. Use the available report feedback to identify study topics; it is not a raw percentage breakdown.
How to Prepare for 125 Questions
Preparing for 125 questions across all domains requires a strategic approach:
1. Master the Exam Objectives Every question is tied to the official exam objectives. Get the current objectives from EC-Council and use them as your study checklist.
2. Practice with Realistic Questions Complete at least 500+ practice questions before your exam. Focus on questions that match the exam format, including multiple-choice questions.
3. Time Your Practice Exams Take full-length practice exams under timed conditions. This builds stamina and helps you calibrate your pacing for the real exam.
4. Focus on Weak Domains Use practice test results to identify domains where you score below 80%. Concentrate additional study time on these areas.
5. Understand, Don't Memorize With 125 questions covering diverse scenarios, memorization alone won't work. Focus on understanding concepts so you can apply them to novel situations.
More study tips
Understand attack vectors and countermeasures equally well.
EC-Council tests recognition of vulnerabilities and appropriate responses.
Know the difference between active and passive reconnaissance techniques.
EC-Council CEH emphasizes methodology and phases of ethical hacking—know the sequence.
Hands-on hacking skills are tested, but so is understanding of legal and ethical boundaries.
Practice with tools mentioned in the courseware—questions often reference specific tool capabilities.
Mistakes to check
Not practicing with realistic scenario-based questions that mirror exam difficulty.
Failing to manage stress and mental fatigue during lengthy exams.
Ignoring the "soft" skills and governance aspects that advanced certs emphasize.
Approaching the exam as a technical test when it often emphasizes management and strategy.
Over-relying on deep technical knowledge without understanding broader organizational context.
Underestimating the length and intensity of advanced certification exams.
Ready to Practice EC-Council CEH Questions?
Test your knowledge with CEH practice questions. Practise the tested concepts and identify areas for improvement.
Frequently Asked Questions
What is the total question count for CEH?
The EC-Council CEH exam features 125 questions. You have 240 minutes to complete all questions. Follow the provider’s current candidate guide for the exam format.
Does CEH include unscored questions?
EC-Council may include unscored "beta" or "pilot" questions for future exam development. Since you can't identify which questions are unscored, treat every question as if it counts toward your final CEH score.
What question formats does CEH use?
The EC-Council CEH exam includes multiple-choice questions. Read each multiple-choice item carefully and select the best answer.
What is the CEH time limit?
With 125 questions in 240 minutes, you have approximately 115 seconds per question on average. Budget extra time for complex scenarios and review.
Does CEH allow reviewing previous questions?
Yes, EC-Council CEH allows marking questions for review and returning to them later. Many successful candidates answer confident questions first, then revisit challenging ones.
What's the margin for error on CEH?
CEH uses an exam-form-specific passing standard. Check EC-Council’s current passing criteria; do not assume a fixed 70% target or a fixed number of mistakes allowed.
Is every CEH exam different?
Yes, EC-Council CEH draws questions from a large pool and randomizes order. An exam form can vary, but do not assume every question will be new. Prepare against the objectives instead of memorizing earlier items. This prevents memorization of specific question sequences.
How many questions are on the CEH exam?
The CEH knowledge exam contains 125 multiple-choice questions to be completed in 240 minutes (4 hours).
What is the CEH passing score?
CEH uses a passing standard that varies by exam form. Do not convert it into a fixed 70% target or a fixed number of mistakes allowed.
CEH uses an exam-form-specific passing standard. Check EC-Council’s current passing criteria; do not assume a fixed 70% target or a fixed number of mistakes allowed.
Does CEH have a practical exam?
Yes. CEH offers an optional CEH Practical exam — a 6-hour hands-on lab — for candidates pursuing the CEH Master designation. The knowledge exam is multiple-choice only.
Is CEH harder than Security+?
CEH focuses on offensive-security tools and techniques, while Security+ covers broader security foundations. Their score systems cannot be compared as raw percentages; choose based on your study goals and experience.
How much does the CEH exam cost?
The CEH exam voucher alone costs the current regional price depending on whether you purchase training bundles. EC-Council requires authorized training or a verified application for self-study candidates.
Can I take CEH without training?
Yes, but you must submit an application proving at least 2 years of information security experience and pay a non-refundable $100 application fee. Approved applicants can then purchase the exam voucher separately.
How long should I study for CEH?
An example plan for candidates with Security+ or equivalent experience is 6–10 weeks of dedicated study. Complete beginners should allow 3-4 months to cover networking fundamentals and security concepts before CEH-specific material.
Does CEH expire?
Yes. CEH certification is valid for 3 years. You must earn 120 ECE credits within the 3-year cycle and pay an annual maintenance fee of $80/year to maintain certification.
Practice CEH Questions
Test your ethical hacking knowledge with practice questions covering ethical-hacking study topics.
Start Free Practice Test →Related Resources
Related CEH resources
Practice and exam format
- PenTest+ Question Count
- OSCP Question Count
- Free EC-Council CEH Practice Test
Test your knowledge with realistic exam questions.
Complete certification overview and career benefits.
- A+ Exam: Up to 90 per exam Questions (2026)
How many questions
- Security+ Exam: Up to 90 Questions (2026)
How many questions
- Network+ Exam: Up to 90 Questions (2026)
How many questions
Study and requirements
- What If I Fail CEH?
If you fail
- How to Pass EC-Council CEH
Study strategies and exam tips.
- CompTIA A+ Exam Objectives Explained (2026 Domain Guide)
Exam objectives
- CompTIA Network+ Exam Objectives & Domains (2026)
Exam objectives
- CEH Without Experience: 2026 Guide
Without experience
Renewal and next steps
- Does CEH Expire?
CEH renewal requirements and validity period.
Does it expire?
- OSCP vs CEH Comparison