EC-Council Certified Ethical Hacker (CEH) Expert Exam Topics & Test Questions

Five Star Reviews

"Quality shines through feedback."

Cups of Coffee

"Fuel for late-night study sessions."

Lives Changed

"Learning transforms futures."

Pass Percentage

"Preparation is the key to success."

Five-Star Raves

"Mom says we're ‘pretty good,’ too."

Cups of Coffee Consumed

"Uptime: 99.9% caffeine."

Lives (and LinkedIns) Upgraded

"Side effects may include better offers."

Pass Rate Shenanigans

"We can’t take the test for you. Yet."

Questions Served

"Practice makes progress."

Practice Exams

"Every test is a step closer."

Study Hours Logged

"Consistency beats intensity."

Active Learners

"Together we grow stronger."

Certifications Earned

"Proof of knowledge, power for growth."

Communities Built

"Learning is stronger together."

Mock Exams Taken

"Simulation builds confidence."

Career Boosts

"Knowledge opens new doors."

EC-Council Certified Ethical Hacker (CEH) v13 Exam Objectives

Exam Basics

Format: ~125 multiple-choice questions
Time limit: up to 4 hours
Delivery: Pearson VUE or ECC Exam Center (proctored)
Passing score: variable cut score (typically ~60%–85%)
Audience: entry to intermediate security professionals (ethical hacking fundamentals required)

Domain 1: Reconnaissance & Intelligence Gathering (~20%)

Ethical hacking phases, footprinting methods (OSINT, DNS, WHOIS, search operators)
Active vs. passive recon, threat modeling, attack surface mapping
Scanning prep and enumeration targets (hosts, ports, services, banners)
Common tools: theHarvester, Maltego, Recon-ng, NSlookup/Dig, Nmap host discovery

Domain 2: Scanning, Enumeration & Vulnerability Analysis (~25%)

Nmap scan types (TCP connect, SYN, UDP, Xmas), service/version detection, scripts
Enumeration of SMB, SNMP, LDAP, SMTP, FTP, HTTP; banner grabbing
Vulnerability assessment with CVSS basics; scanners (Nessus/OpenVAS), false positives
Password attacks & cracking: wordlists, rules, Hashcat/John, Kerberoasting, Pass-the-Hash

Domain 3: Exploitation & Post-Exploitation (Systems, Network & Web) (~35%)

System hacking: privilege escalation, credentials dumping (Mimikatz), persistence & covering tracks
Network attacks: sniffing, MITM, ARP/DNS poisoning, DoS/ DDoS fundamentals, session hijacking
Web attacks: OWASP Top 10, SQLi (error/union/blind), XSS, CSRF, auth/logic flaws, file upload
Exploitation frameworks & tooling: Metasploit, Burp Suite, sqlmap, Hydra/Medusa, Responder, BloodHound
Wireless & mobile: evil twin, cracking/handshakes, WPA/WPA2/WPA3, Bluetooth basics; Aircrack-ng/Kismet

Domain 4: Cloud, IoT/OT, Cryptography & Reporting (~20%)

Cloud security basics: IAM misconfigurations, storage exposure, metadata/instance roles abuse
IoT/ICS/SCADA awareness: common protocols (Modbus, MQTT), device discovery & risks
Malware basics: trojans, worms, ransomware, botnets; traffic/indicator recognition
Crypto concepts: symmetric vs asymmetric (AES/RSA), hashes, PKI, TLS, common misuse
Engagement lifecycle: legal/ethics, ROE/NDAs, evidence handling, reporting & remediation guidance

Out of Scope

Exploit development at the assembly level and 0-day research
Advanced reverse engineering and in-depth forensics
Vendor-specific deep cloud architecture design
Production red-team operations outside ethical/legal scope
Extensive coding; focus is on tools, techniques and methodology

How to Prepare

Study the official CEH v13 exam blueprint and module outcomes
Build hands-on practice: labs/cyber-ranges with Nmap, Wireshark, Metasploit, Burp Suite, Hashcat
Memorize common ports/protocols, TCP flag behavior, HTTP status codes and SQLi/XSS payload patterns
Review CVSS basics, MITRE ATT&CK technique families, and standard reporting structure
Take full-length practice tests; analyze every miss and replicate the technique in a lab

CEH - EC-Council Certified Ethical Hacker Expert Practice Exams