CEH v13 Certification Guide: Exam 312-50 and Requirements

The Certified Ethical Hacker (CEH) is widely named in offensive security roles, yet many candidates do not realise it is a multiple-choice knowledge exam with a separate, optional practical, and that self-study candidates must be approved before they can sit it. This guide sets out what EC-Council publishes about CEH v13: exam 312-50, the knowledge and practical exams, the CEH Master designation, the eligibility routes and application fee, the retake rules and the three-year continuing education scheme. It adds a preparation plan, decision guidance on when CEH is the right credential, and how it compares with PenTest+ and OSCP. It describes the exam, not attack techniques. It is written for practitioners moving into offensive or defensive testing roles and for managers who fund or require the credential. Facts are as published on eccouncil.org, checked October 2026; EC-Council pages are not always consistent, so confirm with EC-Council before you book.

Key takeaways

Current version is CEH v13. EC-Council's CEH page presents v13, which it also calls "CEH AI" because it adds AI capabilities to the course; no successor was announced on the pages checked.
The core exam is knowledge-based. Exam 312-50 has 125 multiple-choice questions in 4 hours, and the pass mark is a cut score between 60% and 85% that varies by exam form.
The practical is optional but adds CEH Master. The CEH Practical is a 6-hour exam with 20 challenges on EC-Council's iLabs Cyber Range; passing both exams earns CEH Master.
Eligibility depends on route. Official training gives eligibility without a separate application; self-study candidates need two years of information security work experience and pay a non-refundable USD 100 application fee.
Renewal is 120 credits in three years. EC-Council's continuing education policy requires 120 credits per three-year window and a USD 80 annual fee, with suspension and then revocation for non-compliance.

Who the certification is for

CEH covers a broad catalogue of attack categories and the defensive view of each. EC-Council's v13 course is built around 20 modules, which it says cover more than 550 attack techniques, with 221 hands-on labs and access to more than 4,000 tools. The module list runs from footprinting, scanning and enumeration through system hacking, malware, sniffing, social engineering, denial of service, session hijacking and evasion, to web servers and applications, SQL injection, wireless, mobile, IoT and OT, cloud and cryptography.

Good fit: SOC analysts, network and systems administrators, and auditors who need a wide survey of attacker techniques and terminology, and anyone whose employer, client or contract names CEH specifically.
Good fit for defenders: breadth across many categories helps detection engineers and incident responders recognise what they are looking at. See the SOC Analyst Career Guide.
Weaker fit: experienced testers who need to prove hands-on exploitation in a proctored lab. The core CEH exam is multiple-choice; the CEH Practical or a practical-only certification such as the one in the OSCP Certification Guide carries that signal more directly.
Public sector: EC-Council's CEH Practical page states that the US Department of Defense recognises CEH Practical as meeting requirements for various cyber workforce roles. Confirm the mapping for your role with the hiring organisation.

Exam format and domains

Knowledge exam and practical exam

Item	CEH knowledge exam	CEH Practical
Exam code	312-50	Not stated on the pages checked
Required?	Yes: passing it awards CEH	Optional: passing both awards CEH Master
Format	Multiple-choice; not open book	20 practical challenges
Questions	125	20 challenges
Duration	4 hours	6 hours
Passing score	Cut score per exam form, 60% to 85%	60% to 85%
Delivery	ECC Exam Centre (EC-Council's exam portal), including remote proctoring; one EC-Council page also mentions Pearson VUE centres, another says ECC Exam Centre only	iLabs Cyber Range

The variable cut score matters: EC-Council sets a pass mark for each exam form based on the difficulty of its questions, so there is no single number to aim at. Treat a consistent 80% or more on reputable timed practice as a safer readiness target than the bottom of the range. Delivery is where EC-Council's own pages disagree, so confirm the options open to you when your eligibility is approved.

The four-phase programme

EC-Council frames CEH v13 as four phases. Only the second is the certification itself; the others are part of the training package.

Phase	What EC-Council describes	Why it matters to a candidate
Learn	20 modules, 221 labs, 550+ attack techniques, 4,000+ tools	The syllabus the knowledge exam draws on
Certify	4-hour knowledge exam; optional 6-hour practical for CEH Master	The credential decision: CEH alone or CEH Master
Engage	A four-phase mock ethical hacking engagement in a cyber range, capturing flags in each phase	Useful rehearsal for the practical exam
Compete	A year of access to 12 four-hour capture-the-flag challenges with monthly themes and a leaderboard	Keeps skills current after the exam

EC-Council links an exam blueprint from its certification page; the blueprint's domains and weights were not in the page text checked for this guide, so download the current blueprint for 312-50 and use it as your checklist rather than relying on third-party summaries.

Where identity fits

Several CEH modules, including system hacking, session hijacking, web applications and cloud, are at heart about stolen or misused credentials. Defenders who take CEH get more value by relating each module to the identities it abuses: shared admin accounts, long-lived tokens, service accounts and cloud roles. See the Privileged Access Management Guide.

Where CEH skills map in control frameworks

Framework	Reference	Relevance
NIST SP 800-53 Rev 5	CA-8 Penetration Testing	CEH Master holders can contribute to authorised testing programmes
NIST SP 800-53 Rev 5	RA-5 Vulnerability Monitoring and Scanning	Scanning and vulnerability analysis modules
NIST SP 800-53 Rev 5	CA-2 Control Assessments	Breadth of attack knowledge helps assessors test whether controls work
NIST CSF 2.0	ID.RA-01	Vulnerabilities in assets are identified, validated and recorded
NIST CSF 2.0	ID.IM-02	Improvements are identified from security tests and exercises

Prerequisites and experience

EC-Council's certification page lists three routes to sit the knowledge exam. Candidates must meet one of them.

Route	Requirement	Application fee
Official training	Attend official EC-Council training, directly or through an Authorized Training Center	Included in the training fee; no separate application
Self-study with experience	At least two years of work experience in information security, verified through EC-Council's eligibility application	USD 100, non-refundable
Earlier CEH holder	Hold CEH from version 1 to 7	Waived

Timing: EC-Council says eligibility applications are usually processed within 5 to 10 working days once your verifiers respond, and an approved application is valid for three months. Line up your referees before applying.
Vouchers: exam vouchers are valid for one year from receipt, so do not buy one long before you plan to sit.
Remote proctoring: remote sessions must be booked at least three days in advance; you need an equipment test, valid ID and a valid voucher.
Minors: EC-Council requires a signed parent or guardian consent letter and a supporting letter from an accredited institution.
Recommended background: EC-Council's CEH page recommends at least two years of IT security experience even for trained candidates. Networking, Windows and Linux administration and basic web knowledge make the module content far easier.

Preparation plan

The plan assumes eight to ten hours a week and covers both official training and the self-study route. Hands-on practice must stay inside the labs provided or your own environment. See the Cyber Ranges, CTFs and Hands-On Training Guide.

Choose the route (week 0): decide between official training and self-study. If self-study, submit the eligibility application and USD 100 fee first, because approval lasts only three months.
Get the blueprint (week 0): download EC-Council's current 312-50 blueprint and check that any third-party material is written for v13.
Baseline (week 1): take a timed diagnostic and record scores by module group to find your weakest areas.
Module study (weeks 2 to 8): work through the 20 modules. For each, note what the attack is, the conditions that allow it, and how a defender detects and prevents it; the exam asks about detection and prevention as well as attack vectors.
Labs (weeks 3 to 9, overlapping): use the official labs or your own isolated lab to make each module concrete. If you plan CEH Master, give the cyber range engagement priority.
Timed practice (weeks 9 to 10): sit at least two full mocks of 125 questions in 4 hours, aiming well above the 60% floor.
Sit the knowledge exam (week 11): run the remote equipment test in advance if testing remotely.
Practical (optional, after passing): schedule the 6-hour CEH Practical once you can complete range challenges reliably within time.

If you fail: EC-Council's retake policy allows an immediate second attempt, then a 14-day wait before each further attempt up to the fifth. A candidate may not take a given exam more than five times in 12 months. Retakes need an ECC Exam Centre voucher, which EC-Council sells at a discounted price, and EC-Council strongly advises official hands-on training after a third failure. You cannot retake the same exam version after passing it.

Small vs large employers: official training starts at a high price (EC-Council lists starting prices of USD 1,699 for a single on-demand course and USD 2,499 for live online), so small employers often fund the self-study route with the USD 100 application fee. Large organisations with many candidates can negotiate training through authorised centres and run cohorts.

Measuring readiness

Module coverage: share of the 20 modules you can explain, including detection and prevention, without notes.
Timed mocks: full 125-question mocks inside 4 hours, scoring consistently above 80%.
Weakest module score: no module group far below the rest before booking.
Range performance: for CEH Master candidates, challenges solved per hour in the cyber range against the practical's 20 challenges in 6 hours.
After certification: credits logged each calendar year against the 120 needed over three years.

Cost, renewal and continuing education

Item	Rule or amount (as published by EC-Council, checked October 2026)
Official training	Starting prices: USD 1,699 single on-demand course; USD 2,499 single live online course; USD 3,999 unlimited on-demand courses
Eligibility application	USD 100, non-refundable, for self-study candidates; included in official training; waived for CEH v1 to v7 holders
Exam-only voucher	Price not stated on the EC-Council pages checked; ask EC-Council or an authorised centre
Retake voucher	Sold at a discounted price (amount not stated)
Renewal cycle	Three years from the date of certification
Credits required	120 per three-year window, earned per calendar year and registered by 1 February of the following year
Annual fee	USD 80 per year for members holding at least one certificate in the scheme
Non-compliance	Suspension if 120 credits are not met; reinstatement possible within 12 months by meeting the requirement and paying the fee; revocation after that, requiring the exam to be retaken; written appeal within 90 days of notice

EC-Council's policy page describes the rules under both ECE and CPE headings, and lists CEH under both. Check your status in EC-Council's member portal to confirm which scheme applies to your certificate.

Common failure patterns

Applying too early: self-study candidates who apply and then delay find their three-month eligibility approval has lapsed.
Treating 60% as the target: the cut score for your exam form may be much higher, up to 85%.
Learning tool names, not concepts: with 4,000+ tools in the course, memorising names is hopeless; the exam tests threats, detection, prevention and methodology.
Assuming CEH proves hands-on skill: employers and candidates who equate the multiple-choice CEH with a practical exam set wrong expectations; CEH Master needs the practical too.
Practising on systems without permission: outside the labs and your own environment, practice is unauthorised access in most jurisdictions.
Missing the annual credit deadline: credits are recorded by calendar year with a 1 February cut-off, and unpaid annual fees or missing credits lead to suspension.

Where it fits on the career path

CEH is usually taken after a foundational credential and some security experience, and is common in both offensive and defensive careers.

Credential	Format in brief	Choose it when
EC-Council CEH	125-question multiple-choice exam; optional 6-hour practical for CEH Master	An employer or contract names CEH, or you want a broad survey of attack categories
CompTIA PenTest+	Multiple-choice and performance-based questions in 165 minutes	You want vendor-neutral engagement coverage including scoping and reporting; see the CompTIA PenTest+ Guide
OffSec OSCP	Hands-on practical exam	You need to prove hands-on exploitation; see the OSCP Certification Guide
GIAC GPEN	Proctored exam on GIAC's objectives	Your employer funds SANS-style training; see the GIAC GPEN Guide

Before it: a foundation such as Security+. See the CompTIA Security+ Guide.
After it: testers usually move to practical exams and specialist web, cloud or red team work (see the Red Teaming Guide); defenders move to incident handling and threat hunting.

EC-Council does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For role progression, see the Penetration Tester Career Guide and the Cybersecurity Careers Guide.

Practitioner checklist

Decide between official training and the self-study route before spending money.
If self-study, line up verifiers for your two years of experience, then apply and pay the USD 100 fee.
Book the exam within the three-month eligibility window and the one-year voucher validity.
Download the current 312-50 blueprint and confirm all third-party material is for v13.
Study each module for detection and prevention, not just the attack.
Sit two timed 125-question mocks and aim well above 60%.
Decide whether you need CEH Master and plan the 6-hour practical accordingly.
After passing, log credits every calendar year and pay the annual fee to avoid suspension.

CEH Certification Guide: Exam, Requirements and Preparation