CERTIFICATION GUIDE What Happens If I Fail the CEH Exam? Complete Retake Guide 2026
Choose your next step.
CEH retake guidance: waiting periods, annual attempt limits, current voucher terms, and a practical review plan.
Published by PrepForCerts · Editorial responsibility and sources · Updated
What Happens If I Fail the CEH Exam? Complete Retake Guide 2026
Check the current EC-Council retake voucher price and eligibility.
Current provider information
EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt.
The CEH is primarily a knowledge-based exam testing your understanding of hacking methodologies, attack techniques, and defensive countermeasures. Unlike OSCP or PenTest+ which emphasize practical exploitation skills, CEH focuses on recognizing attack patterns, understanding tool capabilities, and knowing the appropriate countermeasures. This distinction is important for your retake preparation—deep conceptual understanding matters more than hands-on exploitation skills.
EC-Council also offers CEH Practical, a separate 6-hour hands-on exam that tests actual penetration testing skills in a live environment. While the knowledge-based CEH exam (CEH Ansi) is what most candidates take and what this guide covers, understanding both pathways helps you plan your cybersecurity certification strategy. Passing both earns the CEH Master credential.
CEH Retake Policy Explained
Check the current EC-Council retake voucher price and eligibility.
CEH uses a scaled scoring system where the passing threshold varies between 60% and 85% depending on the difficulty of your specific exam form. This means if you scored 70% and the threshold for your form was 72%, you were extremely close. Unfortunately, EC-Council doesn't provide domain-level breakdowns like CompTIA or AWS, making it harder to identify specific weak areas from your score report alone.
For self-study candidates who didn't use EC-Council's official training, you must have met the eligibility requirements: either 2 years of information security experience or completion of an EC-Council authorized training program. If you originally qualified through experience, that eligibility remains valid for retakes.
Check the current EC-Council retake voucher price and eligibility.
The 20 CEH Modules — Detailed Breakdown
The CEH exam covers an extensive range of topics across 20 modules. Understanding which modules carry the most weight helps you prioritize your retake study:
| Module Group | Modules Covered | Key Topics |
|---|---|---|
| Reconnaissance | Footprinting, Scanning, Enumeration | OSINT, Nmap, port scanning, DNS, SNMP enumeration |
| System Attacks | System Hacking, Malware, Sniffing | Password cracking, privilege escalation, trojans, packet capture |
| Web & Application | Web Server, Web App, SQL Injection | XSS, CSRF, injection attacks, OWASP Top 10 |
| Network Attacks | DoS, Session Hijacking, Wireless | DDoS amplification, TCP hijacking, WPA3, evil twin |
| Emerging Tech | IoT, Cloud, Mobile, Cryptography | Cloud attacks, mobile threats, IoT vulnerabilities, encryption |
| Social Engineering | Social Engineering, Evading IDS/Firewalls | Phishing techniques, pretexting, IDS evasion, honeypots |
Top 6 Reasons Candidates Fail CEH
- Underestimating the breadth of 20 modules. CEH covers an enormous range of topics. Candidates who deep-dive into a few favorite modules while skipping others (especially IoT, cloud, and mobile) leave easy points on the table. Every module contributes questions, so a comprehensive approach is essential.
- Not memorizing tools and their purposes. CEH tests your knowledge of specific tools: which tool does what, what output looks like, and when each is appropriate. Know Nmap flags (-sS, -sV, -O, -A), Metasploit modules, Wireshark filters, Burp Suite features, and SQLmap usage. Tool recognition questions are among the most common on the exam.
- Confusing attack types and countermeasures. Many CEH questions present scenarios and ask you to identify the attack type OR the appropriate countermeasure. You need to match attacks to defenses accurately across all 20 modules. Create a study matrix mapping each attack to its detection method and countermeasure.
- Ignoring the ethical/legal framework. Several questions test your understanding of ethical hacking methodology, laws (CFAA, GDPR, SOX), rules of engagement, and when specific actions are legal vs illegal. These "easy" questions are free points that many candidates lose by skipping this topic.
- Poor time management over 4 hours. With 125 questions in 4 hours, you have roughly 1.9 minutes per question. The exam length leads to mental fatigue—pace yourself and take brief mental breaks every 30-40 questions to maintain focus.
- Studying outdated material. EC-Council updates the CEH exam regularly. Candidates using old study guides may miss newer topics like cloud-native attacks, API security vulnerabilities, Smart Practice attack tools, and modern wireless security standards (WPA3).
Building a Tool Knowledge Matrix
One of the most effective retake strategies is creating a comprehensive tool matrix. CEH questions frequently present a scenario and ask "which tool would you use?" Here are the critical tool categories:
| Phase | Key Tools | Know This |
|---|---|---|
| Reconnaissance | Maltego, theHarvester, Shodan, Recon-ng | OSINT gathering, email harvesting, exposed services |
| Scanning | Nmap, Hping3, Nessus, OpenVAS | Port scanning flags, vulnerability scanning, stealth scans |
| Exploitation | Metasploit, SQLmap, Burp Suite, BeEF | Framework usage, SQL injection, XSS exploitation |
| Post-Exploitation | Mimikatz, Empire, BloodHound, Cobalt Strike | Credential dumping, lateral movement, persistence |
| Password Cracking | John the Ripper, Hashcat, Hydra, Cain & Abel | Dictionary vs brute force, rainbow tables, hash types |
| Wireless | Aircrack-ng, Kismet, Wifite, Fluxion | WPA/WPA2 cracking, deauth attacks, evil twin |
| Sniffing | Wireshark, tcpdump, Ettercap, dSniff | Packet capture, ARP poisoning, MITM attacks |
14-Day CEH Recovery Study Plan
| Days | Focus | Activities |
|---|---|---|
| 1-2 | Self-assessment | Note which modules felt weakest during exam, build your tool knowledge matrix spreadsheet |
| 3-5 | Weak module deep-dive | Study your 5 weakest modules intensively. Focus on tools, attack types, and countermeasures |
| 6-8 | Web & cloud attacks | Master OWASP Top 10, cloud attack vectors, API security, container vulnerabilities |
| 9-10 | Emerging tech & legal | Study IoT/mobile security, cryptographic algorithms, legal framework (CFAA, GDPR) |
| 11-13 | Full practice exams | Take 3+ full-length timed practice exams. Review every wrong answer thoroughly |
| 14 | Light review + retake | Review tool matrix, rest your mind, retake with confidence |
CEH vs Other Security Cert Retake Policies
| Certification | Wait | Retake Cost | Retakes |
|---|---|---|---|
| CEH | 14 days | Check the current EC-Council retake voucher price and eligibility. | EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt. |
| CompTIA PenTest+ | 14 days | $404 | EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt. |
| OSCP | Varies | $249+ | EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt. |
| CISSP | 30-90 days | $749 | 4/year |
| CompTIA Security+ | 14 days | $404 | EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt. |
Check the current EC-Council retake voucher price and eligibility.
CEH Career Value: Is It Worth Retaking?
Absolutely. CEH remains one of the most recognized cybersecurity certifications globally, and here's why it's worth the retake effort:
- DoD 8570/8140 Compliance: CEH satisfies IAT Level III, IASAE I-II, and CSSP Analyst roles. Many government and military positions require specifically CEH—not PenTest+ or other alternatives.
- Global Recognition: CEH is recognized in 145+ countries and accepted by organizations like GCHQ, NSA, and numerous international defense agencies.
- Salary Impact: CEH holders earn a median salary of $95,000-$110,000 in the US, with government/defense sector positions often paying 10-15% more due to the clearance + certification combination.
- Career Mobility: CEH opens doors to roles including Penetration Tester, Security Analyst, SOC Analyst, Vulnerability Assessor, and Information Security Manager.
- Stepping Stone: CEH knowledge directly feeds into more advanced certifications like CEH Practical, CPENT, LPT, and even OSCP, making it a valuable foundation investment.
Prepare for Your CEH Retake
Practice with adaptive CEH questions across all 20 ethical hacking domains.
Start Free CEH Practice Test →Quick Answer
The first CEH retake has no waiting period. After the second and later failures, wait 14 days. EC-Council allows a maximum of five attempts within 12 months, with a 12-month wait before the sixth attempt. Check the current retake voucher price.
A failed EC-Council CEH attempt isn't the end—it's valuable data. Here's how to use your CEH score report to guarantee success next time.
Understanding the retake process helps you approach your next CEH attempt with confidence. This guide covers exactly what happens after failing, the official EC-Council retake policy, and proven strategies for passing on your next attempt.
Use the objectives for your booked exam and your own skill gaps to choose study resources. This guide does not establish a pass rate, salary outcome, or holder count.
Ready to Pass EC-Council CEH?
Don't let one failed attempt define your certification journey. Practice with realistic questions and build the confidence you need to pass on your next try.
What to Do Right After Failing
First: Do Not Panic
Failing EC-Council CEH feels devastating in the moment, but it is more common than you think. The original guide does not establish a measured pass rate.
The First 24 Hours:
Step 1: Process the Disappointment - Allow yourself to feel frustrated. It is natural. Avoid making hasty decisions about giving up. Remember this is a setback, not a verdict on your abilities.
Step 2: Save Your Score Report - Screenshot or save the score breakdown immediately. This report is your roadmap for improvement. Note specific domain percentages for targeted study.
Step 3: Take a Brief Break - Step away from study materials for 24-48 hours. Clear your head before analyzing what went wrong. Return with fresh perspective and renewed focus.
What NOT to Do:
- Do not book a retake immediately without a plan
- Do not blame the exam, testing center, or bad luck
- Do not return to the same study approach that did not work
- Do not give up entirely on the certification
Official EC-Council CEH Retake Policy
Waiting Period Requirements:
Specific Rules:
- First retake: Wait 14 days
- Subsequent retakes: Typically same waiting period applies
- Calendar days, not business days
- No exceptions for extenuating circumstances
Retake Costs:
- First Retake: Full exam fee ($950-1199 USD)
- Second Retake: Full exam fee ($950-1199 USD)
- Third+ Retakes: Full exam fee ($950-1199 USD)
Check the current EC-Council retake voucher price and eligibility.
What Carries Over: Nothing. Each attempt is independent. Previous scores do not affect new attempts. Fresh question pool each time.
The waiting period is actually a blessing. It forces adequate preparation time, prevents wasting money on unprepared attempts, and allows for meaningful score analysis.
Analyzing Your Score Report
Your score report is the most valuable study tool you will receive. Here is how to use it:
Score Report Components:
- Overall Score: Your numerical score vs. passing threshold
- Domain Breakdown: Performance in each exam domain
- Identifies strongest and weakest areas
Interpreting Domain Scores:
- Below 50%: Major gap, complete re-study needed
- 50-65%: Weak area, focused review required
- 65-80%: Adequate, light review to reinforce concepts
- Above 80%: Strong, maintain but do not neglect
Creating Your Improvement Plan:
Priority 1: Lowest-Scoring Domains - These likely cost you the exam. Dedicate 50% of study time here. Use different resources than before.
Priority 2: Middle-Scoring Domains - Small improvements equal significant point gains. Focus on specific weak topics within domains.
Priority 3: High-Scoring Domains - Do not abandon these entirely. Quick reviews to maintain knowledge. About 10% of study time.
Red Flags in Score Reports:
- Multiple domains below 50%: Foundational issues
- All domains borderline: Test-taking strategy problems
- One domain catastrophic: Missed major topic area
Recovery Study Strategy
Returning to the same study method that led to failure is the most common mistake. Here is what to change:
Rule 1: Different Resources If you used video courses, add textbooks or official guides. If self-study, consider instructor-led training. Add multiple practice test sources instead of just one. Switch from passive reading to active labs and practice.
Rule 2: More Hands-On Practice Theory memorization often fails under exam pressure. Increase practical experience. Lab time should be 40-50% of total study. Practice troubleshooting scenarios. Build, break, and fix systems repeatedly.
Rule 3: Targeted Weakness Focus Your weak domains need disproportionate attention:
- Weak domains (below 60%): 50% of time
- Medium domains (60-75%): 35% of time
- Strong domains (above 75%): 15% of time
Rule 4: Practice Exam Strategy Use multiple practice exam sources. Take under realistic conditions (timed, no breaks). Use unfamiliar practice questions to identify weak topics, explain your reasoning, and practise within the exam time limit. No practice percentage guarantees a pass. Analyze every wrong answer thoroughly.
Sample 4-Week Recovery Plan:
- Week 1: Deep dive into lowest-scoring domain
- Week 2: Second-lowest domain plus review of first
- Week 3: Remaining weak areas plus full practice exams
- Week 4: Intensive practice testing plus weak spot review
Why Candidates Fail EC-Council CEH
Understanding why you failed helps prevent repeating mistakes:
Pattern 1: Insufficient Preparation Time Signs: Rushed through study material, skipped hands-on labs, scheduled exam before feeling ready. Fix: Add 2-4 weeks to original study timeline.
Pattern 2: Wrong Study Resources Signs: Resources did not match exam objectives, outdated materials, concepts seemed unfamiliar on exam. Fix: Verify resources align with current exam blueprint.
Pattern 3: Memorization Without Understanding Signs: Struggled with scenario-based questions, could not apply concepts to new situations, strong on definitions but weak on application. Fix: Focus on understanding "why" behind concepts.
Pattern 4: Test Anxiety or Poor Strategy Signs: Score close to passing threshold, ran out of time, changed correct answers to wrong ones, blanked on familiar material. Fix: Practice exam-taking strategies and time management.
Pattern 5: Underestimating Exam Difficulty Signs: Assumed experience would carry you through, limited formal preparation, surprised by question depth. Fix: Treat certification exams as serious assessments requiring dedicated study.
Your Timeline to Passing
Based on your score and situation, here is what to expect:
If You Were Close (Within 5% of Passing):
- Timeline: 2-4 weeks
- Focus: Weak domains only, practice test refinement
- Confidence: High, you nearly had it
If You Were Moderate (5-15% Below Passing):
- Timeline: 4-6 weeks
- Focus: Comprehensive weak area review, expanded resources
- Confidence: Achievable with focused effort
If You Were Far Below (15%+ Below Passing):
- Timeline: 6-10 weeks
- Focus: Foundational rebuild, different study approach
- Confidence: Requires significant changes to method
Milestone Checkpoints:
- Week 1-2: Complete score analysis, gather new resources, create targeted study plan
- Week 3-4: Deep dive on weakest domains, begin practice exams
- Week 5-6: Full practice exams under test conditions, consistent scores above passing threshold, schedule retake with confidence
When to Schedule Your Retake: Use unfamiliar practice questions to identify weak topics, explain your reasoning, and practise within the exam time limit. No practice percentage guarantees a pass.
Expert Tips
- Hands-on hacking skills are tested, but so is understanding of legal and ethical boundaries.
- Practice with tools mentioned in the courseware—questions often reference specific tool capabilities.
- EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt.
- Consistently score 10% above passing on practice exams before reattempting.
Common Mistakes to Avoid
- Underestimating scenario-based questions that require applying concepts creatively.
- Not allocating enough time for hands-on lab practice alongside theoretical study.
- Scheduling a retake immediately after the waiting period ends.
- Not analyzing domain-level performance to guide study focus.
Ready to Start Your Certification Journey?
Practice with real exam-style questions and track your progress.
Additional details from the guide
- Last updated: March 9, 2026
- Pass Rate
- 1.4
- Avg Attempts
- How Many Questions on CEH Exam?
- CEH exam structure and question count.
- This guide was last updated on September 8, 2026
Frequently Asked Questions
How long to wait to retake CEH?
Check the current EC-Council retake voucher price and eligibility.
What does a CEH retake cost?
Check the current EC-Council retake voucher price and eligibility.
What is the CEH passing score?
60-85% depending on exam form difficulty. EC-Council uses scaled scoring, so the threshold varies per form. Two candidates can have different passing thresholds.
How many questions are on the CEH exam?
125 questions in 4 hours covering 20 ethical hacking modules. This gives you roughly 1.9 minutes per question.
Is CEH worth it after failing?
Check the current EC-Council retake voucher price and eligibility.
Is CEH or PenTest+ better?
CEH is knowledge-based and meets DoD requirements. PenTest+ is more hands-on and practical. Government roles often require CEH specifically; private sector may prefer PenTest+ or OSCP for demonstrating practical skills.
Does CEH expire?
Yes. CEH requires 120 ECE (EC-Council Continuing Education) credits over 3 years and an annual membership fee of $80 to maintain certification. This totals $240 in maintenance fees per 3-year cycle.
How long do I have to wait to retake EC-Council CEH?
The first CEH retake has no waiting period. After the second and later failures, wait 14 days. EC-Council allows a maximum of five attempts within 12 months, with a 12-month wait before the sixth attempt. Check the current retake voucher price.
How much does a EC-Council CEH retake cost?
A EC-Council CEH retake costs Full exam fee ($950-1199 USD). This is the same as the original exam fee. Some employers reimburse retake costs, and retake insurance may be available when purchasing your initial voucher.
How many times can I retake EC-Council CEH?
EC-Council permits the first retake without a waiting period. After the second and later failures, wait 14 days. A maximum of five attempts is allowed within 12 months; a 12-month wait applies before the sixth attempt.
What percentage of people fail EC-Council CEH on the first try?
This guide does not establish a measured failure rate. The exam has a The original guide does not establish a measured pass rate.
Will my employer know I failed EC-Council CEH?
No, your exam results are confidential. EC-Council does not share individual scores with employers. You only share your certification status after passing. Failed attempts remain private unless you choose to disclose them.
Do I get a different exam when I retake EC-Council CEH?
Yes, you will receive a different set of questions from the EC-Council CEH question pool. While topics remain the same, specific questions are randomized. This prevents memorization strategies and ensures fair assessment.
Can I use my original voucher for a EC-Council CEH retake?
No, vouchers are single-use. You need to purchase a new voucher or pay the full exam fee of Full exam fee ($950-1199 USD) for your retake. However, some voucher packages include retake insurance that covers one free retake if purchased in advance.
Practice and exam details
- EC-Council CEH Practice Test
Prepare for your retake with realistic EC-Council CEH practice questions.
- How Many Questions on CEH Exam?
CEH exam structure and question count.
How many questions
- Ceh Practice Test
Smart Practice practice questions
Complete guide and requirements
Study tips and exam strategies
- CompTIA A+ Exam Objectives Explained (2026 Domain Guide)
Exam objectives
- CompTIA Network+ Exam Objectives & Domains (2026)
Exam objectives
Explore more
- Certifications/Cybersecurity
Explore all EC-Council certifications.
- Does CEH Expire? 2026 Renewal Guide
Does it expire?
- CEH Without Experience: 2026 Guide
Without experience
- Failed A+? Retake Policy & Tips (2026)
If you fail
- Failed Security+? Retake Policy & Tips (2026)
If you fail
- Failed Network+? Retake Policy & Tips (2026)
If you fail