CEH is a breadth exam, not a depth one. It teaches the attacker’s toolkit from a defender’s standpoint so that you understand how attacks work across networks, web applications, wireless, cloud and more, and the knowledge exam tests recognition and understanding rather than the ability to break into a live system. Two ideas run through everything: ethical hacking is always authorised and scoped, and you study offence in order to improve defence. This guide is a full self-study course built on those two ideas. It walks through the phases of an attack and the major technology areas, explains what each technique is, why it works and how a defender detects or prevents it, and then turns the material into a week-by-week plan, a final-preparation routine and a clear picture of exam day. It is original teaching material and study guidance only. It contains no operational attack instructions and no real or simulated exam questions, and you should always confirm the current version and blueprint against the EC-Council CEH page before you book.
Chapter 1: Exam overview and how to use this guide
What the CEH actually measures
The CEH measures whether you understand the full sweep of offensive techniques well enough to recognise them, reason about them, and defend against them. The current version, CEH (formerly numbered v13, now described by EC-Council as enhanced with AI), is built around twenty modules that span reconnaissance through cryptography, but for studying it helps to group those modules two ways: by the five phases of an attack (which give the syllabus its spine) and by the technology areas the later modules cover (network, web and application, wireless and mobile, IoT and OT, cloud, and cryptography). The defining feature of CEH is breadth: any of these areas can appear, so the real challenge is covering everything rather than going deep on one.
The knowledge exam is 125 multiple-choice questions in four hours, delivered through EC-Council’s exam portal or at a Pearson VUE centre. There is no single fixed pass mark: EC-Council sets a cut score per exam form, and it states these typically fall in the 60 to 85 percent range, with the exact cut score for your form shown before you begin. Separately, EC-Council offers an optional, hands-on CEH Practical (a six-hour, twenty-challenge exam in a lab environment); passing both the knowledge exam and the practical earns the CEH Master designation. This guide focuses on the knowledge exam, which is what most candidates take first, and flags where the practical needs different preparation.
Who the exam is written for and how to be eligible
CEH sits at an intermediate level and assumes networking and security fundamentals; if those are shaky, a foundation such as Network+ or Security+ first will make CEH far easier. To be eligible you must either take official EC-Council training or apply for eligibility on the basis of two years of information-security work experience. Self-study of the concepts is entirely possible, but EC-Council generally requires the training or the experience application to let you sit the exam without their course, so build that into your plan from the start.
How to use this course
Read the chapters in order at least once. The phases build on each other, and the technology-area chapters assume the vocabulary set up earlier. Treat the bold terms as a checklist, and for each one practise saying three things in a sentence: what it is, why it works, and how a defender would detect or prevent it. That three-part framing is the heart of this course because it matches how the exam asks its questions and keeps your study ethical. Each chapter ends with the traps that catch people. The final chapters turn the content into a schedule, a final-preparation routine and a description of exam day. Where a concept is easy to misread, a short teaching example makes it concrete, but none of these are exam questions or step-by-step attack instructions: they are illustrations of how to think.
A standing note on ethics
Everything in CEH is taught for authorised, defensive use. The legal and ethical line is simple and the exam tests that you know it: you only ever test systems you own or have explicit, written authorisation to test. Throughout this guide, every offensive concept is paired with its defensive counterpart, both because that is how the exam frames it and because it is the only responsible way to learn the material.
Chapter 2: Reconnaissance, scanning and enumeration
What this stage is
The opening phases of an attack are about information gathering, and they map to the first technology-agnostic modules of CEH. Reconnaissance (also called footprinting) is collecting information about a target; scanning is probing to discover live hosts, open ports and running services; and enumeration is extracting more detailed information such as user names, shares and service details from the systems you have found. Vulnerability analysis sits alongside these, turning what you have learned into a picture of where weaknesses might be.
Why it matters
Real attacks succeed or fail on the quality of their reconnaissance, so a large share of CEH questions live in this stage, and understanding it is also the foundation for defence. The clearest distinction the exam wants is between passive information gathering, which observes without touching the target (for example using publicly available information), and active gathering, which interacts with the target and can therefore be detected. Knowing which is which tells a defender what they could realistically see.
How to study it
Learn the stage as a funnel that narrows from broad to specific. Reconnaissance casts wide and is often passive; scanning interacts with the network to find live systems and open services; enumeration drills into those services for usable detail; and vulnerability analysis ranks what is exploitable. For each step, pair it with its defensive mirror. Reconnaissance is countered by limiting the information you expose publicly. Scanning is countered by closing unnecessary ports and services and by monitoring for the traffic patterns scanning produces. Enumeration is countered by tightening service configuration and access. As a teaching example of the passive/active line, gathering a company’s information from public records leaves no trace on its systems and is passive, whereas sending probes to its network to see which ports respond is active and is exactly the kind of activity intrusion detection is designed to catch. That contrast, not the name of any one tool, is what the exam rewards.
Pitfalls in this stage
The most common mistake is collapsing the passive/active distinction, which the exam tests directly. The second is memorising tool names as a flat list instead of understanding what each category of tool does, so you can recognise the right kind of tool for a task. Guard against both by reasoning from purpose and from detectability rather than from product names.
Chapter 3: System hacking, gaining and maintaining access
What this stage is
The middle phases are where an attacker turns a discovered weakness into a foothold and then keeps it. Gaining access is exploiting a vulnerability to get in; maintaining access is how an attacker persists once inside; and covering tracks is how they try to hide their activity afterwards. CEH’s system-hacking module also covers supporting ideas such as privilege escalation (gaining higher rights than you were meant to have) and the role of malware (trojans, worms, ransomware and the like) in establishing or extending access.
Why it matters
This is the conceptual heart of “hacking” and a rich source of exam questions, but it is also where the defender’s view matters most, because every persistence and track-covering technique has a detection counterpart. The exam consistently rewards understanding the defensive response, which is why this guide presents the stage conceptually rather than as instructions.
How to study it
Hold the sequence in mind: access, then persistence, then concealment, each with its mirror. Gaining access through a vulnerability is countered by patching, hardening and least privilege, so the weakness is not there to exploit. Privilege escalation is countered by the principle of least privilege and by separating duties so a single compromised account cannot do everything. Maintaining access depends on persistence mechanisms, which defenders counter by monitoring for unexpected changes and unusual activity. Covering tracks typically means tampering with logs, which is exactly why the exam stresses protecting and centralising logs and monitoring them, so that an attacker cannot quietly erase the evidence. Understand malware by category and behaviour rather than by specimen: what a trojan, a worm or ransomware each does, and how endpoint protection and monitoring detect them. As a teaching example of the defensive logic, if an attacker’s last step is to delete log entries to hide what they did, the defence designed to defeat that is sending logs to a separate, protected system in real time, so the record exists somewhere the attacker cannot reach. The exam wants the principle, not a procedure.
Pitfalls in this stage
The first pitfall is studying these techniques without their defences, which both misses how the exam asks questions and crosses the ethical line this certification is built on. The second is treating malware as a set of names to memorise rather than behaviours to recognise. Keep the offence-and-defence pairing in front of you for every concept here.
Chapter 4: Network attacks, web and application attacks
What this stage is
This chapter covers two large families of technique. The network family includes sniffing (capturing network traffic), on-path interception of communications, session hijacking, denial-of-service and distributed denial-of-service attacks, social engineering, and evading defensive systems such as intrusion detection systems, firewalls and honeypots. The web and application family includes attacks on web servers and web applications, with injection-style attacks against poorly validated input as a central example.
Why it matters
Networks and web applications are where most real-world attacks land, so this is one of the most heavily represented parts of the exam. It is also where the defender’s toolkit, monitoring, segmentation, input validation and user awareness, most directly maps onto the offensive concepts, making the offence-and-defence framing especially productive here.
How to study it
Take the network family first and learn each concept with its detection or prevention. Sniffing and on-path attacks rely on being able to see or sit between traffic, which is why encrypting data in transit and segmenting networks are the standard defences. Session hijacking abuses a valid session, countered by protecting and properly expiring session tokens. Denial of service overwhelms a service to make it unavailable, countered by capacity, filtering and upstream protection, and the distinction the exam wants is simply that a distributed attack comes from many sources at once, which makes it harder to filter. Social engineering targets people rather than systems, and its only real defence is awareness and verification, which is why the exam treats user training as a genuine security control. Recognise too that attackers try to evade defences, which is the reason layered detection exists.
For the web and application family, the unifying idea is that untrusted input must never be trusted. Injection-style attacks, of which SQL injection is the classic example, work when an application passes user-supplied input to a back-end system without proper validation, and the defence is consistent input validation and safe handling of that input. Study these as cause and cure: the cause is unvalidated input, the cure is validating and sanitising it. As a teaching example of the pattern, when a scenario describes an application misbehaving because of crafted input, the underlying failure is missing input validation, and that, rather than any single payload, is what the exam is testing you to recognise.
Pitfalls in this stage
A frequent error is dismissing social engineering as not really technical and therefore under-studying it, when the exam treats it as a core attack vector with awareness as its control. Another is learning injection attacks as something to perform rather than as a class of flaw caused by trusting input, which is the understanding the exam actually checks. A third is missing the simple but tested distinction between denial of service and its distributed form.
Chapter 5: Wireless, mobile, IoT and OT, cloud, and cryptography
What this stage is
The later modules extend the same thinking to specific technology areas: wireless network security, mobile platform threats, IoT and OT (the security of connected devices and operational-technology systems), cloud computing threats and controls, and core cryptography concepts and the attacks against them. These areas are individually smaller but collectively significant, and they are where breadth most often costs marks.
Why it matters
These topics reflect how modern environments actually look, full of wireless access, mobile devices, connected hardware and cloud services, so the exam includes them to test whether your understanding generalises beyond traditional networks. Cryptography in particular underpins much of security, so a working grasp of it pays off across the whole exam.
How to study it
Treat each area as the familiar offence-and-defence pairing applied to a new setting. For wireless, the issues are weak encryption and unauthorised access points, and the defences are strong wireless encryption and monitoring for rogue access points. For mobile, the concerns are insecure apps, lost or stolen devices and weak controls, addressed by device management, encryption and app vetting. For IoT and OT, the recurring problem is devices that are hard to patch and often shipped with weak defaults, so the defences centre on network segmentation, changing defaults and monitoring. For cloud, lean on the same shared-responsibility thinking that runs through cloud security generally: misconfiguration and unclear ownership are the dominant risks, and the defences are correct configuration and understanding who secures what.
For cryptography, aim for conceptual fluency rather than mathematics. Understand the difference between symmetric encryption (one shared key, fast, good for bulk data) and asymmetric encryption (a public/private key pair, used for key exchange and digital signatures), what hashing is for (verifying integrity, a one-way function, not a way to hide data reversibly), and the broad shape of attacks against weak or poorly implemented cryptography. As a teaching example of the level expected, knowing that hashing proves a message has not changed but cannot be reversed to recover the message, while encryption protects confidentiality and can be reversed with the key, is the kind of distinction the exam tests, rather than any algorithm’s internals.
Pitfalls in this stage
The dominant pitfall is under-studying these areas because they come last and feel peripheral, which leaves easy breadth marks on the table. Within cryptography, the common confusions are symmetric versus asymmetric use cases and treating hashing as a form of encryption. Cover every area at least once and keep the use cases straight.
Chapter 6: The CEH mindset, ethics and managing the breadth
The skill that determines most CEH results is not deep exploitation skill, it is disciplined breadth plus the habit of thinking like a defender. This chapter is about how to choose answers and how to keep the wide syllabus under control.
What the CEH mindset is
The CEH mindset is defender-first and concept-first. For any offensive technique, the exam expects you to know what it is, why it works, and above all how it is detected or prevented, because the purpose of the certification is to make you a better defender. Most questions reward recognising the right concept or the right defence rather than recalling a specific tool or command, so understanding beats memorisation.
How to choose the best answer
Approach each question by first identifying which phase or technology area it belongs to, then asking what the concept actually is and what its defensive counterpart would be. When a question is about defence, prefer the control that addresses the root cause: validating input rather than just filtering one symptom, segmenting and monitoring rather than hoping a single device catches everything, training and verification against social engineering. When a question names tools, choose by category and purpose rather than by familiarity with one product. As a teaching example of the pattern, faced with a question about preventing a class of input-based web attack, the answer that fixes the cause (validating and sanitising input) beats one that merely blocks a single known string, because the exam rewards addressing the underlying weakness.
Ethics as part of the exam
The ethical and legal content is not background, it is tested, and it is also the foundation of the whole field. Know that ethical hacking is always authorised and scoped, that you only test systems you own or are explicitly permitted to test, and recognise the categories the exam uses, such as authorised testers versus malicious attackers. Treat this as a real domain, not a disclaimer.
Managing the breadth
Because any area can appear, cover the whole syllabus on a schedule rather than over-investing in the parts you find interesting, and use cumulative review so the early phases stay fresh while you learn the later technology areas. Pair concept study with safe, legal lab practice where you can, since the techniques stick far better when you have seen them work in an environment you are authorised to use, and even the knowledge exam is easier when the concepts are not purely abstract. Identify your weakest area early so it gets attention while there is time.
Chapter 7: Study plan and timeline
With the content understood, the work is pacing it so the breadth gets covered and the offence-and-defence habit is built over weeks rather than crammed. Two things drive the plan: the wide, even spread of the syllabus and your starting point.
Cover everything, weighted by your gaps
There is no single heavy domain to chase the way there is in some exams; instead the discipline is steady coverage of all the phases and technology areas. Spend roughly even time across them, then add hours wherever you are weakest, which for many candidates is the later technology areas (wireless, IoT and OT, cloud) and cryptography. Keep reconnaissance, scanning and the system-hacking concepts fresh through cumulative review, because they anchor the rest.
Choose a timeline
Match the plan to your background. With an existing security background, a compressed plan of about four weeks at roughly fifteen hours a week is realistic: march through the attack phases and the technology areas with lab practice alongside, and finish with timed reviews. A balanced default is around eight weeks at eight hours a week, covering a couple of modules a week, reinforcing each with safe, legal lab work, and saving timed mocks for the end. Anyone newer to offensive security should take a steadier twelve weeks at around five hours a week, building the networking and security fundamentals before the tool-heavy modules so the later material has something to attach to. To turn whichever timeline you pick into dated weeks for your own start date, use the free study-plan generator.
Build judgement throughout, not at the end
Move from reading to answering practice questions across every topic area as soon as you have covered a phase, not on the final weekend, because the habit of pairing each technique with its defence has to be built up. Each time you miss a question, revisit not just the technique but how it is detected or prevented, since that is the reasoning the exam rewards. If you are still deciding whether CEH is the right next step against a cheaper entry point or a more senior credential, weigh it against your goal before committing the weeks of study.
Chapter 8: Final preparation, exam day, and format
Final preparation
In the last week or two, shift from topic study to full-length, timed reviews across all topic areas, treating each as both an endurance run and a diagnosis. Because breadth is the real test, note which area leaks marks and go back to it, and for every missed question articulate the defensive counterpart, not just the attack. Confirm that your materials match the current CEH version and blueprint, since EC-Council updates the coverage over time, and avoid any site offering “real exam questions”, which breach EC-Council policy and copyright and tend to teach the wrong things anyway. If you are aiming at the CEH Master designation, remember that the practical is a separate, hands-on, lab-based exam that needs genuine practice in an authorised lab rather than more multiple-choice review.
Eligibility and the practical track
Keep the eligibility step in view: you sit the exam either through official EC-Council training or by an eligibility application based on two years of security experience, so make sure that is settled before you book. Decide early whether you want the knowledge exam alone or the full Master track, because the two need different final preparation, recognition-and-reasoning practice for the knowledge exam, and hands-on lab skill for the practical.
Exam day and format
On the day, the knowledge exam is 125 multiple-choice questions in four hours, proctored online through EC-Council’s portal or at a Pearson VUE centre, with a cut score set per form in the 60 to 85 percent range and shown to you before you start. Pace yourself so the breadth does not run away from you, read each question to fix which phase or technology area it is testing, and choose by concept and defence rather than by a half-remembered tool name. Apply the same disciplined reasoning you practised: identify the technique, recall why it works, and reach for the answer that addresses the root cause or the correct defence. Having practised at full length across every area, the format will feel familiar rather than overwhelming, which is exactly the advantage you built over the weeks of study.