CEH v13 February 8, 2026 11 min read

CEH v13 Practice Test 2026: Free Questions & Exam Prep Guide

Reviewed by certified IT professionals • About our team

Your complete guide to preparing for the EC-Council Certified Ethical Hacker v13 exam. Exam format, key modules, the best practice test strategies, and a proven study plan to pass on your first attempt.

CEH v13 practice test and exam preparation guide for 2026

Table of Contents

CEH v13 Exam Overview

The Certified Ethical Hacker (CEH) v13 from EC-Council is the world’s most recognized ethical hacking certification. It validates your ability to think like a hacker—legally—to find vulnerabilities before the bad guys do. If you’re targeting a career in penetration testing, red teaming, or security consulting, the CEH is often the first certification hiring managers look for.

CEH v13 is the latest version, released in 2024, with significant updates including AI-powered attack techniques and AI-driven defensive tools. It’s a major step up from v12 and reflects how the threat landscape has evolved. For official details, visit the EC-Council CEH certification page.

Who is this for? Security analysts, penetration testers, SOC analysts, network administrators moving into security, and anyone who wants to prove they can identify and exploit vulnerabilities in a professional, ethical context. EC-Council recommends 2+ years of IT security experience.

Exam Format & Key Stats

125
Questions
240
Minutes (4 hours)
60-85%
Passing Score (varies)
$650
Exam Cost (USD)

Unlike most certifications with a fixed passing score, the CEH uses a variable cut score that adjusts based on the difficulty of your specific question set. Harder question pools require a lower percentage (around 60%), while easier sets require up to 85%. This means you can’t afford to skip any topic—you won’t know your threshold until you see your result.

At $650 per attempt, the CEH is not cheap. Factor in the cost of training bundles (often $1,900-$3,500+) and you’re making a serious investment. Don’t walk into this exam unprepared—quality practice tests can save you hundreds on retakes.

Key Modules & Topics

The CEH v13 covers 20 modules spanning the entire ethical hacking methodology. Here are the areas most heavily tested:

Footprinting & Reconnaissance Module 2

Gathering intel on target systems before an attack. OSINT techniques, DNS enumeration, WHOIS lookups, social media mining, and Google dorking. Expect multiple questions on different recon tools and techniques.

Scanning Networks & Enumeration Modules 3-4

Nmap scan types (SYN, TCP connect, UDP, stealth), port states, banner grabbing, SNMP enumeration, NetBIOS, and LDAP. Know the difference between various Nmap flags and when to use each scan type.

System Hacking & Malware Modules 5-7

Password cracking techniques (brute force, dictionary, rainbow tables), privilege escalation, maintaining access, covering tracks, and malware types (trojans, viruses, ransomware, fileless malware). Heavy question area.

Web Application & SQL Injection Modules 14-15

OWASP Top 10, SQL injection types (in-band, blind, out-of-band), XSS attacks, CSRF, session hijacking, and web server vulnerabilities. Increasingly important as web apps dominate the attack surface.

Cryptography Module 20

Symmetric vs asymmetric encryption, hashing algorithms (MD5, SHA-256), PKI, digital signatures, SSL/TLS, and crypto attacks. Know the difference between encryption algorithms and when each is appropriate.

Cloud Security & AI Threats Modules 17, 19

New in v13: AI-driven attack techniques, prompt injection, adversarial ML, plus cloud-specific attacks (S3 bucket misconfigurations, container escapes, serverless vulnerabilities). This is where v13 really differs from v12.

Practice CEH v13 Exam Questions

Unlike generic question dumps, ExamCert provides detailed explanations for every answer—understand attack techniques, not just memorise answers.

Start Practicing Now

Plan Your Study Journey

Use our free tools to optimize your preparation

Practice Test Strategy

The CEH covers an enormous breadth of topics across 20 modules. Here’s how to use practice tests effectively:

Why Generic Brain Dumps Fail

The CEH question pool rotates frequently, and EC-Council actively updates questions for v13. Sites offering “real exam questions” are typically sharing outdated v12 content with unverified answers. Worse, they train you to pattern-match rather than understand concepts. When the exam presents a scenario you haven’t memorised, you’re stuck.

What Actually Works

  • Concept-first practice: Use practice tests that explain why each answer is correct and why alternatives are wrong. Understanding the attack methodology matters more than memorising tool names.
  • Module-by-module approach: Don’t take random mixed quizzes until you’ve studied each module individually. Identify your weak modules first, then strengthen them with targeted practice.
  • Timed full-length tests: Take at least 3 full-length practice exams (125 questions, 4 hours) before your real exam. The 4-hour duration is a marathon—mental fatigue is real.
  • Hands-on labs: The CEH tests tool knowledge. Set up a home lab with Kali Linux and practice using Nmap, Metasploit, Burp Suite, Wireshark, and John the Ripper on deliberately vulnerable VMs (like DVWA or HackTheBox).

Study Plan for CEH v13

Weeks 1-3: Foundation & Recon

  • Study Modules 1-4 (Introduction, Footprinting, Scanning, Enumeration)
  • Set up Kali Linux in a VM and practice Nmap, Nikto, and WHOIS tools
  • Complete module-specific practice questions after each module

Weeks 4-6: Attack Techniques

  • Study Modules 5-10 (System Hacking, Malware, Sniffing, Social Engineering, DoS, Session Hijacking)
  • Practice with Metasploit on vulnerable VMs (Metasploitable, DVWA)
  • Focus on understanding attack methodologies, not just tool syntax

Weeks 7-9: Web, Cloud & Specialised Topics

  • Study Modules 11-20 (Firewall evasion, Web servers, Web apps, SQL injection, Wireless, IoT, Cloud, AI, Cryptography)
  • Practice SQL injection and XSS on DVWA or WebGoat
  • Study the new v13 AI/ML security content carefully—it’s fresh and heavily tested

Weeks 10-12: Review & Practice Exams

  • Take 3-4 full-length timed practice exams
  • Review every incorrect answer and study the underlying concepts
  • Focus on your weakest modules for final-week revision
  • Memorise key port numbers, tool purposes, and attack categories

CEH v13 Practice Questions with Explanations

Comprehensive practice tests covering all 20 CEH v13 modules. Know the “why” behind every attack technique.

Start Free Practice

Frequently Asked Questions

How many questions are on the CEH v13 exam?

The CEH v13 (312-50) contains 125 multiple-choice questions. You have 4 hours (240 minutes) to complete the exam, giving you roughly 1 minute 55 seconds per question. The generous time limit means speed isn’t the main challenge—breadth of knowledge is.

What is the CEH v13 passing score?

The passing score varies between 60% and 85% depending on the difficulty of your specific question pool. EC-Council uses a scaled scoring system, so harder question sets have a lower threshold. You won’t know your cut score until you see your results.

How much does the CEH v13 exam cost?

The exam voucher alone is $650 USD. EC-Council training bundles (iClass, iLearn, or official bootcamps) range from $1,900 to $3,500+ and include the voucher. If you’re self-studying, you can apply for eligibility through EC-Council with proof of 2+ years of security experience.

Is the CEH v13 exam hard?

Moderately difficult. The breadth of 20 modules is the main challenge—you need to know something about everything from social engineering to cryptography to cloud security. With 2-3 months of focused study and quality practice tests, most candidates can pass on their first attempt.

What’s new in CEH v13 compared to v12?

CEH v13 adds significant coverage of AI-powered attack techniques and AI-driven security tools. It also expands content on cloud security, IoT hacking, and includes updated tool coverage. The overall structure remains 20 modules with 125 questions, but the AI content is genuinely new and heavily tested.

ExamCert

ExamCert Team

Cybersecurity professionals dedicated to helping you pass your certification exams. We update our content weekly to match current exam patterns.

Ready to Pass the CEH v13?

Get practice questions with detailed explanations covering all 20 CEH modules

Start Practice Exam Read Complete Guide

Start Your CEH v13 Preparation Today

Join thousands who passed with ExamCert. Practice questions with detailed explanations and 100% money-back guarantee.

Get CEH v13 App More Articles

Practice Questions

Question 1

During a penetration test, you discover an open port 445. Which tool would be MOST effective for enumerating Windows shares?

A. Nmap with -sV flag
B. enum4linux
C. Netcat
D. Nikto

enum4linux is specifically designed for enumerating information from Windows and Samba systems via SMB (port 445). It can list shares, users, groups, and password policies. Nmap can detect the service but enum4linux provides deeper SMB enumeration.

Question 2

Which attack allows an attacker to intercept and modify communications between two parties who believe they are directly communicating with each other?

A. Session hijacking
B. Man-in-the-Middle (MitM)
C. Replay attack
D. DNS poisoning

Man-in-the-Middle attacks involve intercepting and potentially modifying communication between two parties. Techniques include ARP spoofing, DNS spoofing, SSL stripping, and rogue access points. Session hijacking typically takes over an existing session rather than intercepting from the start.

Question 3

What is the primary purpose of using a VPN during a penetration test?

A. To increase bandwidth for data exfiltration
B. To anonymize the source of attack traffic
C. To encrypt payloads to avoid detection
D. To bypass antivirus software

VPNs anonymize the attacker's source IP address during penetration tests, preventing attribution to the testing team's actual location. This also simulates real-world external attacks. VPNs don't inherently bypass AV or increase bandwidth significantly.

Question 4

Which SQL injection technique retrieves data by observing differences in the application's response based on TRUE or FALSE conditions?

A. Union-based SQLi
B. Error-based SQLi
C. Blind Boolean-based SQLi
D. Time-based Blind SQLi

Blind Boolean-based SQL injection infers data by sending queries that result in different application behavior (e.g., different page content) for TRUE vs FALSE conditions. It's used when the application doesn't display error messages or direct query results.

Question 5

A web application uses a JWT (JSON Web Token) for authentication. Which vulnerability should you test first?

A. SQL injection in the token payload
B. Token signature verification bypass (alg:none)
C. XSS through token reflection
D. LDAP injection in authentication backend

JWT signature verification bypass (setting algorithm to 'none') is a critical vulnerability specific to JWT implementations. If the server doesn't properly validate the algorithm field, an attacker can forge tokens with arbitrary payloads. This should be tested before generic vulnerabilities.

Question 6

During reconnaissance, which Google dork would help find publicly exposed database backups?

A. site:example.com filetype:sql
B. inurl:admin login
C. intitle:index.of password.txt
D. cache:example.com

The 'site:' operator limits results to a specific domain, and 'filetype:sql' finds SQL files which often contain database dumps. This is effective for finding exposed backups. While 'intitle:index.of' can find directory listings, 'filetype:sql' is more targeted for databases.

Question 7

What technique should a penetration tester use to maintain access after initial compromise while avoiding detection?

A. Create a new administrator account
B. Install a kernel rootkit
C. Add an SSH key to authorized_keys for an existing low-privilege user
D. Replace system binaries with backdoored versions

Adding an SSH key to an existing low-privilege user's authorized_keys is stealthy because: 1) it doesn't create suspicious new accounts, 2) it doesn't modify system files, 3) it blends with normal SSH traffic. Kernel rootkits and binary replacement are high-risk and easily detected by modern EDR.

Question 8

Which tool is BEST suited for password cracking when you have the hash but no other information about the password?

A. Hashcat with dictionary attack
B. John the Ripper with incremental mode
C. Hydra with brute force
D. Medusa with wordlist

John the Ripper's incremental mode performs true brute-force, systematically trying all character combinations. It's best when you have no information about the password. Dictionary attacks (Hashcat, wordlists) are faster but require assumptions about password composition. Hydra/Medusa are for online attacks, not hash cracking.

Question 9

What is the primary difference between active and passive reconnaissance?

A. Active reconnaissance is illegal; passive reconnaissance is legal
B. Active reconnaissance directly interacts with the target; passive reconnaissance uses publicly available information
C. Active reconnaissance uses automated tools; passive reconnaissance is manual
D. Active reconnaissance requires credentials; passive reconnaissance does not

Passive reconnaissance gathers information without directly interacting with the target (OSINT, Google dorking, WHOIS, DNS lookups). Active reconnaissance directly engages the target (port scanning, vulnerability scanning), which can be detected and logged. Legality depends on authorization, not technique.

Question 10

Which Windows command would you use to view all active network connections and listening ports?

A. ipconfig /all
B. netstat -ano
C. net view
D. route print

'netstat -ano' displays all active connections and listening ports (-a), shows addresses numerically (-n), and displays the process ID (-o) for each connection. This is essential for post-exploitation network reconnaissance to identify services and processes.