EC-Council CEH v13
EC-Council CEH v13 (exam code 312-50) is EC-Council's Certified Ethical Hacker credential, covering the attacker mindset across the five-phase ethical hacking methodology: reconnaissance, scanning, gaining access, maintaining access, and covering tracks. CEH v13 (released September 2024) is EC-Council's first AI-integrated version, weaving AI-driven reconnaissance and exploitation techniques throughout; EC-Council retired v12 voucher sales in 2025. 125 multiple-choice questions, 4 hours, passing score 60-85% depending on form. DoD 8140 approved for offensive work roles.
We could not confirm which languages this exam is offered in. Check the owner's page before you book.
Owner: EC-Council · Read: · Source: EC-Council C|EH page
Exam fee at last check: $1199, per the vendor. The official objectives are at www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/. Verified 2026-09-26.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Information Security and Ethical Hacking Overview
The five-phase ethical hacking methodology and the authorization/disclosure line that separates white hat from gray hat activity.
- Reconnaissance, scanning, gaining access, maintaining access, covering tracks
- White hat vs gray hat vs black hat, defined by authorization and disclosure process
- Social engineering principles: urgency, authority, and AI-generated pretext/deepfakes in v13
Primary sources: EC-Council CEH v13 Certification
Reconnaissance Techniques
Passive OSINT-based footprinting versus active reconnaissance, including how v13 frames LLM-accelerated OSINT synthesis.
- Passive reconnaissance (OSINT) vs active reconnaissance
- DNS enumeration and subdomain discovery
- AI-accelerated OSINT correlation and pretext generation (CEH v13 addition)
Primary sources: EC-Council CEH v13 Certification
Scanning Networks
Host discovery, port scanning techniques, and OS/service fingerprinting.
- TCP SYN scan (half-open) vs full connect scan
- Host discovery sweeps before port-level scanning
- OS and service fingerprinting via TCP/IP stack behavior
Primary sources: EC-Council CEH v13 Certification
System Hacking Phases and Attack Techniques
Privilege escalation, credential attacks, malware categories, and post-exploitation concealment.
- Privilege escalation via misconfigured scheduled tasks/services
- Pass-the-hash and other credential-reuse attacks
- Rootkits and other concealment techniques
- Malware categories: ransomware, worms, logic bombs
Primary sources: EC-Council CEH v13 Certification
Web Application Hacking
Common web vulnerability classes and how they map to the OWASP Top 10 and API Security Top 10.
- Reflected XSS and SQL injection
- Insecure Direct Object Reference (IDOR) / broken object-level authorization
- Session ID predictability and session hijacking
Primary sources: OWASP Top 10:2021, OWASP API Security Top 10
Wireless and Mobile Platform Hacking
Rogue access points and 802.11 management-frame attacks against Wi-Fi clients.
- Evil twin attacks
- Deauthentication attacks exploiting unauthenticated 802.11 management frames
Primary sources: EC-Council CEH v13 Certification
Cloud Computing and IoT Hacking
Cloud misconfiguration risk and common IoT/OT vulnerability classes.
- Cloud storage misconfiguration (overly permissive public access)
- Hardcoded default credentials in IoT devices
Primary sources: EC-Council CEH v13 Certification
Cryptography
Man-in-the-middle attacks against key exchange and password-hashing weaknesses.
- MITM attacks against key exchange (distinct from brute-force key cracking)
- Unsalted/fast hashing and rainbow table attacks against password storage
Primary sources: OWASP Password Storage Cheat Sheet
Exam-day strategy
CEH is knowledge-based multiple choice (unlike OSCP's hands-on format), so precise terminology matters: know the exact name of each attack technique, not just the general idea.
Watch for distractors that name a real but wrong technique (e.g., pass-the-hash vs SQL injection, evil twin vs deauthentication) targeting the same general scenario.
CEH v13's AI-integration content is testable: know that LLMs accelerate OSINT correlation and generate pretext content, but do not themselves bypass firewalls or replace technical exploitation.
Map each scenario to its methodology phase first (reconnaissance, scanning, gaining access, maintaining access, covering tracks); many questions are really asking which phase an action belongs to.
Pace at under 2 minutes per question across the 4-hour, 125-question exam, and flag ambiguous wording to revisit rather than stalling.
How to prepare for EC-Council CEH v13
- EVIDENCE-BACKEDPractice in the same format as the exam. How well practice matches the final test shapes how much it helps. (Yang et al., 2021)
- EVIDENCE-BACKEDStart practice questions in week one, even on topics you have not studied. Failed attempts before seeing the answer still helped learning. (Kornell et al., 2009 and others)
- EVIDENCE-BACKEDSpace your reviews over weeks instead of cramming the week before. (Cepeda et al., 2006 and others)
- PLAUSIBLEDivide the minutes by the questions before you start, and keep a margin for a second pass if the exam allows one. (Sound arithmetic; no study compared time budgets on a licensing exam.)
Why this works
EVIDENCE-BACKED At least one peer-reviewed study or official source found the effect or states the fact. A study can be small.
PLAUSIBLE Reasonable and partly studied, but not tested on exams, or the results are mixed.
Practice that matches the final test format works better than practice that does not.
Failed attempts before seeing the answer still improved later learning of the material asked about; the benefit for material not asked about was virtually nil.
Spacing beat massing across hundreds of experiments and beat cramming with flashcards; combined with retrieval it raised scores on a real high-stakes exam.
Sound arithmetic; no study compared time budgets on a licensing exam.
Sources
- Yang, C., Luo, L., Vadillo, M. A., Yu, R., & Shanks, D. R. (2021). Testing (quizzing) boosts classroom learning: A systematic and meta-analytic review. Psychological Bulletin, 147(4), 399-435. doi.org/10.1037/bul0000309
- Kornell, N., Hays, M. J., & Bjork, R. A. (2009). Unsuccessful retrieval attempts enhance subsequent learning. Journal of Experimental Psychology: Learning, Memory, and Cognition, 35(4), 989-998. doi.org/10.1037/a0015729
- Richland, L. E., Kornell, N., & Kao, L. S. (2009). The pretesting effect: Do unsuccessful retrieval attempts enhance learning? Journal of Experimental Psychology: Applied, 15(3), 243-257. doi.org/10.1037/a0016496
- St. Hilaire, K. J., Chan, J. C. K., & Ahn, D. (2024). Guessing as a learning intervention: A meta-analytic review of the prequestion effect. Psychonomic Bulletin & Review, 31(2), 411-441. doi.org/10.3758/s13423-023-02353-8
- Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin, 132(3), 354-380. doi.org/10.1037/0033-2909.132.3.354
- Kornell, N. (2009). Optimising learning using flashcards: Spacing is more effective than cramming. Applied Cognitive Psychology, 23(9), 1297-1317. doi.org/10.1002/acp.1537
- Kang, S. H. K. (2016). Spaced repetition promotes efficient and effective learning: Policy implications for instruction. Policy Insights from the Behavioral and Brain Sciences, 3(1), 12-19. doi.org/10.1177/2372732215624708
- Janes, J. L., Dunlosky, J., Rawson, K. A., & Jasnow, A. (2020). Successive relearning improves performance on a high-stakes exam in a difficult biopsychology course. Applied Cognitive Psychology, 34(5), 1118-1132. doi.org/10.1002/acp.3699
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of EC-Council. CEH is a trademark of EC-Council. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.