The Last 7 Days Before CEH: Exactly What to Do (2026)

What to Study in the Last Week Before CEH — Final Review Checklist

With seven days until your Certified Ethical Hacker exam, panic is normal. But scattered studying will kill your chances. You need a surgical approach that maximizes every remaining hour.

I’ve coached hundreds through their final CEH week. The candidates who pass follow a specific daily structure that reinforces strengths while aggressively targeting weaknesses. Here’s exactly what to do each day.

Direct answer

Your last week before CEH should focus on practice exams, weakness identification, and scenario-based thinking — not learning new material. Spend 60% of your time on practice questions, 30% reviewing your weakest domains, and 10% on light conceptual review. If you’re scoring below 75% on practice exams with a week left, shift to intensive weak-area drilling rather than full-length tests.

The five CEH domains break down as: Ethical Hacking Fundamentals (15%), Reconnaissance and Scanning (20%), System Hacking and Malware (20%), Network and Web Hacking (25%), and Cryptography and Cloud Security (20%). Your final week strategy must align with these weightings.

What the last week before CEH is actually for

The last week isn’t for cramming new concepts. It’s for pattern recognition and speed building. CEH tests your ability to think like an attacker under time pressure, not your ability to memorize port numbers.

Your brain needs repetition to cement the decision trees that matter on exam day. When you see “Which tool would you use for OS fingerprinting?” your response should be automatic. This automaticity only comes from seeing similar questions dozens of times.

Most candidates waste their final week reading study guides. That’s backwards. Study guides teach concepts. Practice exams teach application. CEH is entirely about application.

The domains that trip up most candidates in the final week are Network and Web Hacking (25% of exam) and Reconnaissance and Scanning (20%). These require tool-specific knowledge that’s easily confused under pressure. System Hacking and Malware (20%) follows close behind because the attack vectors overlap.

Your final week must prioritize these high-weight, high-confusion domains while maintaining your foundation in Ethical Hacking Fundamentals (15%) and Cryptography and Cloud Security (20%).

Day 7: Full diagnostic practice exam

Take a complete 125-question practice exam under timed conditions. No breaks, no Google, no notes. This isn’t about learning — it’s about diagnosis.

Score yourself immediately and document three things:

• Overall percentage by domain
• Specific topics within weak domains
• Questions you got right but guessed on

If you score 85%+, you’re ready. Follow this schedule exactly.

If you score 75-84%, you’re close but need targeted work. Spend extra time on days 6 and 5.

If you score below 75%, your strategy changes. Skip the full practice exams on days 4 and 2. Instead, do 50-question domain-specific tests daily, focusing entirely on your lowest-scoring areas.

Pay special attention to Reconnaissance and Scanning questions. These often involve specific tool syntax that candidates mix up. Nmap commands, Wireshark filters, and vulnerability scanner outputs appear frequently.

For Network and Web Hacking, focus on attack progression. CEH loves questions about “What would be your next step after discovering…” These test logical thinking, not tool memorization.

Document every wrong answer with the reason you missed it: knowledge gap, misread question, or confused similar concepts. This feeds your study plan for days 6-3.

Day 6: Target your weakest CEH domains

Today is surgery day. Take your Day 7 results and attack your lowest-scoring domain with focused practice.

If Reconnaissance and Scanning was your weakness, drill these specific areas:

• Nmap scan types and their outputs (-sS, -sT, -sU, -sA)
• Wireshark display filters for common protocols
• SNMP enumeration techniques and community strings
• DNS enumeration methods and zone transfer attempts
• Vulnerability assessment vs. penetration testing concepts

For Network and Web Hacking weaknesses:

• SQL injection types and detection methods
• Cross-site scripting (XSS) variants and prevention
• Session hijacking techniques and countermeasures
• Wireless attack methodologies (WEP, WPA, WPS)
• Network sniffing in switched environments

System Hacking and Malware focus areas:

• Windows privilege escalation techniques
• Password cracking methods and hash types
• Rootkit detection and removal approaches
• Keylogger types and deployment methods
• Buffer overflow concepts and stack protection

Do 75 questions in your weakest domain only. Don’t aim for 100% — aim for understanding why wrong answers are wrong. CEH distractors are carefully crafted to catch partial knowledge.

Create a one-page summary of concepts you consistently miss. This becomes your Day 2 review sheet.

Day 5: Scenario-based question strategy review

CEH isn’t just about knowing tools — it’s about knowing when to use them. Day 5 focuses on the “next step” questions that separate passing from failing.

Practice the attack kill chain:

1. Reconnaissance (passive and active information gathering)
2. Scanning (network discovery and enumeration)
3. Gaining access (exploitation and privilege escalation)
4. Maintaining access (backdoors and persistence)
5. Covering tracks (log clearing and evidence removal)

Each phase has preferred tools and techniques. When a question describes a scenario, identify which phase you’re in, then select the appropriate response.

Common scenario patterns:

• “After discovering an open port 445, what should you do next?” (SMB enumeration)
• “The penetration test requires stealth. Which scan type is most appropriate?” (TCP SYN scan)
• “You need to maintain persistence on a Windows system. What would you implement?” (Registry modification or service creation)

Do 100 mixed questions today, but focus on multi-step scenarios. Read each question twice before answering. CEH questions often contain crucial details in seemingly innocent phrases.

Pay attention to legal and ethical constraints mentioned in questions. “You are authorized to test only the web application” changes which tools and techniques are appropriate.

Time yourself strictly. You have 1.92 minutes per question on the actual exam. Build comfort with this pace.

Day 4: Second practice exam and wrong-answer analysis

Another full 125-question practice exam under exam conditions. Compare results to Day 7.

Your score should improve by 5-10 points. If it didn’t, you’re not drilling weak areas effectively. Spend the rest of Day 4 on 50 questions in your persistently weak domain.

If your score improved as expected, spend the afternoon analyzing every wrong answer from both practice exams. Look for patterns:

• Do you consistently miss tool-specific questions?
• Are you misreading scenario details?
• Do you confuse similar attack types?
• Are you overthinking straightforward questions?

Create three lists:

1. Knowledge gaps: Concepts you genuinely don’t understand
2. Recognition errors: Things you know but didn’t recognize in context
3. Careless mistakes: Questions you knew but answered incorrectly

Tomorrow’s study targets list #1. Day 2 addresses list #2. List #3 becomes your exam day reminders.

Focus extra attention on Cryptography and Cloud Security if it’s consistently problematic. This domain covers:

• Symmetric vs. asymmetric encryption use cases
• Hash function properties and applications
• PKI components and certificate management
• Cloud security models and shared responsibility
• Data protection methods in cloud environments

Day 3: CEH-specific topic consolidation

Today consolidates the high-frequency topics that appear across multiple domains. These cross-cutting concepts often determine pass/fail.

Social engineering tactics appear in reconnaissance, system hacking, and web application contexts. Know the differences between:

• Phishing, spear phishing, and whaling
• Pretexting vs. baiting vs. quid pro quo
• Physical security bypass techniques
• Email header analysis for fraud detection

Log analysis and forensics spans multiple domains:

• Windows Event Log categories and significance
• Linux log file locations and purposes (/var/log structure)
• Network traffic analysis indicators
• Anti-forensics techniques and detection

Compliance and legal frameworks:

• PCI DSS requirements for payment systems
• GDPR data protection principles
• SOX IT controls and documentation
• Legal considerations for penetration testing

Do 75 mixed questions focusing on these cross-cutting topics. When you miss a question, trace it back to the fundamental concept being tested.

Create a two-page “cheat sheet” of easily confused concepts:

• TCP vs. UDP characteristics and uses
• Symmetric vs. asymmetric encryption scenarios
• Black box vs. white box vs. gray box testing
• Vulnerability assessment vs. penetration testing vs. red team engagement

This cheat sheet becomes your Day 1 review material.

Day 2: Light review and mental preparation

Resist the urge to cram today. Your brain needs consolidation time. Do 50 practice questions maximum — just enough to maintain rhythm.

Review your cheat sheet from Day 3 and your weakness summary from Day 6. Read through them twice, then put them away.

Instead, focus on exam logistics:

• Confirm your testing center location and parking
• Gather required identification documents
• Plan your arrival time (30 minutes early minimum)
• Review the testing center’s prohibited items list

Do a final check of common CEH tool command syntax:

• Nmap: nmap -sS -O target (SYN scan with OS detection)
• Netcat: nc -l -p 1234 (listener on port 1234)
• John the Ripper: john --wordlist=passwords.txt hashes.txt
• Sqlmap: sqlmap -u "http://target/page?id=1" --dbs
• Metasploit: Basic msfconsole workflow (use, set, exploit)

Don’t memorize full command references — know enough to recognize correct syntax in multiple choice options.

Practice relaxation techniques you’ll use during the exam. Deep breathing, progressive muscle relaxation, or brief mental breaks between question sections.

Get 8+ hours of sleep. Sleep deprivation destroys pattern recognition — exactly what CEH tests.

Day 1 (exam eve): What to do and what to avoid

What to do:

• Light physical exercise (walk, yoga, stretching)
• Review your two-page cheat sheet once
• Prepare everything for tomorrow (clothes, documents, snacks)
• Eat a normal dinner and stay hydrated
• Confirm your alarm and backup alarm

What NOT to do:

• Study new material or take practice exams

• Discuss the exam with other candidates (breeds anxiety)

• Stay up late “reviewing just one more thing”

• Consume excessive caffeine or alcohol

• Try to “peak” your knowledge (you’re already prepared)

• Second-guess your preparation strategy

Go to bed by 10 PM. Set two alarms. Wake up naturally refreshed, not jarring yourself awake at 5 AM for “last-minute review.”

Exam day strategy: First 15 minutes determine everything

Your first 15 minutes set the psychological tone for the entire exam. Most candidates rush in and immediately feel overwhelmed. Don’t be most candidates.

Minutes 1-2: Read the exam instructions completely. CEH has specific rules about navigating between questions and time limits. Understanding these prevents costly mistakes.

Minutes 3-5: Do a quick brain dump on the scratch paper provided. Write down the hardest-to-remember items from your cheat sheet:

• Port numbers for less common services (LDAP 389, SNMP 161/162, NetBIOS 139)
• Hash algorithm outputs (MD5 32 chars, SHA-1 40 chars, SHA-256 64 chars)
• Wireless security protocol chronology (WEP → WPA → WPA2 → WPA3)

Minutes 6-15: Answer the first 10 questions at a comfortable pace. Don’t skip any — build confidence with questions you definitely know. If you encounter a difficult question in this set, make your best guess and mark it for review. Don’t let early difficult questions destroy your confidence.

Question triage system: Mark questions in three categories:

• Confident: Answer immediately, don’t second-guess
• Uncertain: Answer with best guess, mark for review
• No clue: Eliminate obviously wrong answers, guess from remaining options, mark for review

Time management is crucial. You have 240 minutes for 125 questions. Spend no more than 3 minutes on any single question during your first pass.

For scenario-based questions, identify the attack phase first, then eliminate answers that don’t fit that phase. CEH loves to include technically correct answers that apply to the wrong phase of an attack.

Practice realistic CEH scenario questions on Certsqill — with detailed explanations that show exactly why each answer is right or wrong.

Post-exam mindset: What your performance actually means

CEH uses scaled scoring from 200-1000, with 700 as the passing threshold. Your raw score (percentage correct) gets adjusted based on question difficulty, so a 72% raw score might translate to 750 scaled — a solid pass.

The exam doesn’t tell you your raw percentage, only your scaled score. Don’t try to calculate how many questions you got wrong during the exam. Focus on each question independently.

If you finish with time remaining, use it strategically:

1. Review marked questions where you genuinely weren’t sure
2. Double-check questions where you might have misread key details
3. Don’t change answers unless you have a compelling reason

Changing answers based on “gut feeling” usually hurts more than it helps. Your first instinct, backed by preparation, is typically correct.

If you don’t pass, the score report will show your performance by domain. This becomes your blueprint for focused retake preparation. Most candidates who retake after following a structured plan pass on their second attempt.

Common last-week mistakes that kill CEH attempts

Mistake #1: Learning new material With one week left, your knowledge foundation is set. New concepts won’t stick and will confuse existing knowledge. Stick to reinforcement and application practice.

Mistake #2: Ignoring time pressure Taking untimed practice exams doesn’t prepare you for the psychological pressure of the countdown timer. Every practice session should be timed.

Mistake #3: Focusing on memorization over understanding CEH tests application and reasoning. Memorizing port lists without understanding when those services matter will fail you on scenario questions.

Mistake #4: Avoiding weak areas It’s tempting to practice what you already know well. This builds false confidence while leaving gaps exposed. Force yourself to work on uncomfortable topics.

Mistake #5: Changing strategy based on one bad practice exam A single poor practice test doesn’t invalidate your entire preparation. Look for patterns across multiple tests before adjusting your approach.

Mistake #6: Social media and forums Avoid CEH discussion groups during your final week. Other candidates’ panic and misinformation will undermine your confidence. Trust your preparation plan.

Your final week is about execution, not experimentation. Follow the daily structure, trust your preparation, and maintain confidence in your systematic approach.

FAQ

Q: If I’m consistently scoring 70-75% on practice exams with a week left, should I postpone?

Don’t postpone unless you’re scoring below 65%. The final week’s focused drilling typically adds 10-15 points to practice exam scores. Follow the intensive weak-area drilling strategy outlined for Day 7 scores below 75%. Many candidates pass the real exam after scoring 70-75% on practice tests — the scaled scoring often works in your favor.

Q: Which CEH practice exams most accurately reflect the real exam difficulty?

Boson ExSim and MeasureUp practice exams best match CEH’s question complexity and scenario depth. Avoid brain dump sites — they use outdated questions and teach pattern matching instead of understanding. The real exam focuses heavily on scenario-based questions that require multi-step thinking, not straight memorization.

Q: How much time should I spend on the 20 hardest practice questions versus doing more full-length tests?

Spend 70% of your time on full-length tests and 30% drilling missed questions. Deep analysis of wrong answers teaches pattern recognition better than volume testing. Create a document of every question you miss with the specific reason why — this targeted review is more valuable than attempting hundreds of additional questions.

Q: What if I keep confusing similar tools like Nessus vs. OpenVAS vs. Nikto during practice?

Create a comparison chart with tool-specific use cases: Nessus (comprehensive vulnerability assessment), OpenVAS (open-source vulnerability scanning), Nikto (web server vulnerability testing). Focus on when to use each tool rather than memorizing features. CEH questions often ask “which tool is BEST for…” requiring you to match tool capabilities to specific scenarios.

Q: Should I review CEH study guides or focus entirely on practice questions in the final week?

Focus 90% on practice questions and 10% on targeted concept review. Study guides teach concepts you should already know. Practice questions teach application and reveal knowledge gaps. Only return to study guides for specific concepts you consistently miss in practice tests — and only for those specific topics.

Related Articles

• I Failed Certified Ethical Hacker (CEH): What Should I Do Next?
• Can You Retake CEH After Failing? Retake Rules Explained (2026)
• CEH Score Report Explained: What Your Result Really Means
• How to Study After Failing CEH: Your Recovery Plan for the Retake
• Why Do People Fail CEH? 8 Common Mistakes to Avoid