Free CEH practice exam 2026: 20 questions without signup

Questions on the exam

125

Time allowed

240 minutes format →

Exam fee

$1,199 — vendor, checked September 4, 2026 detail →

498 practice exam questions for CEH, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min CEH readiness check →

CEH certification: requirements, cost and exam format → ·  CEH exam format →  ·  CEH passing score →  · CEH exam cost →

Questions by domain

• Web Application Hacking — 100 questions →
• System Hacking Phases and Attack Techniques — 96 questions →
• Reconnaissance Techniques — 84 questions →
• Network and Perimeter Hacking — 81 questions →
• Mobile Platform, IoT, and OT Hacking — 38 questions →
• Cryptography — 35 questions →

Sample questions

Injection: What vulnerability category does this represent according to OWASP?

1. Injection (A03:2021) ✓

   Correct. OS command injection is a subcategory of OWASP Injection. Untrusted data sent to an interpreter (OS shell in this case) without sanitization allows the attacker to execute arbitrary commands.
2. Broken Access Control (A01:2021)

   Incorrect. Broken Access Control involves insufficient enforcement of permissions (e.g., accessing other users' data without authorization). Command injection exploits an interpreter flaw, not an access control policy failure.
3. Security Misconfiguration (A05:2021)

   Incorrect. Security misconfiguration involves improper system/application configuration (default credentials, exposed debug endpoints). The command injection here is a code-level flaw, not a configuration issue.
4. Insecure Design (A04:2021)

   Incorrect. Insecure Design covers architectural flaws in threat modeling. While poor design may have led to this function, the specific exploitable flaw is an injection vulnerability — the technical classification takes precedence.

All 100 Web Application Hacking questions →

9.0–10.0: Which CVSS v3.1 base score range does this vulnerability most likely fall into?

1. 9.0–10.0 (Critical) ✓

   Correct. Network-accessible, no authentication, no user interaction, and complete CIA impact (C:H/I:H/A:H) yields a 9.8 base score — Critical. CVSS scores highest when Attack Vector = Network, Privileges Required = None, User Interaction = None, and all three impact metrics are High.
2. 7.0–8.9 (High)

   Incorrect. High (7.0–8.9) results when there is one mitigating factor — e.g. some authentication required, local-only access, or only a single impact metric High (a confidentiality-only RCE scores 7.5). The described vulnerability has full exploitability AND complete impact across all three metrics.
3. 4.0–6.9 (Medium)

   Incorrect. Medium vulnerabilities require some prerequisites such as local access or user interaction. The described vulnerability requires neither.
4. 0.1–3.9 (Low)

   Incorrect. Low severity vulnerabilities have minimal impact or require significant prerequisites. This vulnerability meets none of those limiting criteria.

All 96 System Hacking Phases and Attack Techniques questions →

Maltego: Which OSINT tool is best suited for this task?

1. theHarvester

   Incorrect. theHarvester collects emails, subdomains, and IP addresses from public sources but outputs a flat list — it does not provide relationship mapping or graph visualization.
2. Recon-ng

   Incorrect. Recon-ng is a modular OSINT framework for gathering data but its output is tabular/database-oriented, not visual relationship graphs.
3. Maltego ✓

   Correct. Maltego is specifically designed to visualize relationships between entities (people, domains, IP addresses, organizations) through graph-based link analysis using 'transforms'.
4. Shodan

   Incorrect. Shodan is an internet-connected device search engine. It reveals exposed devices and services but does not map human/organizational relationships.

All 84 Reconnaissance Techniques questions →

To intercept traffic between the victim and the gateway: What is the primary goal of this attack?

1. To intercept traffic between the victim and the gateway (Man-in-the-Middle attack) ✓

   Correct. ARP poisoning corrupts the ARP cache on the gateway, causing it to forward traffic destined for the victim to the attacker's MAC. The attacker forwards it onward, becoming a transparent MITM.
2. To cause a Denial-of-Service by flooding the network with ARP traffic

   Incorrect. While ARP flooding can cause DoS, the described attack sends targeted gratuitous replies to specific hosts — the goal is traffic interception (MITM), not service disruption.
3. To enumerate usernames from the victim's NetBIOS name service

   Incorrect. NetBIOS enumeration uses nbtstat and UDP port 137. ARP poisoning operates at Layer 2 and has no relationship to NetBIOS name service queries.
4. To prevent the victim from connecting to the internet by corrupting routing tables

   Incorrect. ARP poisoning corrupts Layer 2 MAC address tables, not Layer 3 routing tables. Routing table manipulation requires different techniques (e.g., BGP hijacking).

All 81 Network and Perimeter Hacking questions →

Default credentials that cannot be changed: Which vulnerability represents the HIGHEST risk?

1. Default credentials that cannot be changed ✓

   Correct. Unchangeable default credentials (OWASP IoT #1: Weak/Hardcoded Passwords) represent the highest risk because they provide persistent, trivial access to any attacker who looks up the model's default credentials — with no remediation path available to the owner.
2. Firmware updates over HTTP without integrity verification

   Incorrect. Insecure update mechanisms are serious (OWASP IoT #9) but require a network MITM position to exploit. Unchangeable default credentials provide direct, immediate access to anyone on the network with no prerequisites.
3. Exposed Telnet interface on the local network

   Incorrect. An exposed Telnet interface is a significant risk but requires credentials to log in (unless they are default/hardcoded). The Telnet exposure is less severe if strong unique credentials were possible — but combined with unchangeable defaults, it amplifies the default credential risk.
4. Lack of encrypted storage for configuration data

   Incorrect. This vulnerability is not mentioned in the scenario. Evaluating unlisted vulnerabilities against those described in the scenario is not appropriate.

All 38 Mobile Platform, IoT, and OT Hacking questions →

Symmetric encryption using AES-256: Which approach is MOST appropriate?

1. Symmetric encryption using AES-256 ✓

   Correct. Symmetric encryption (AES) uses a single key for both encryption and decryption and is extremely fast — hardware-accelerated AES can process gigabytes per second, making it ideal for bulk data encryption.
2. Asymmetric encryption using RSA-4096

   Incorrect. RSA is computationally expensive for bulk data — it is typically 1000x slower than AES for the same data volume. RSA is used for key exchange and digital signatures, not bulk data encryption.
3. Hashing using SHA-256

   Incorrect. SHA-256 is a one-way hash function — it cannot decrypt data. Hashing provides integrity verification, not confidentiality protection.
4. Asymmetric encryption using ECC-256

   Incorrect. ECC is more efficient than RSA for asymmetric operations but is still significantly slower than symmetric AES for bulk data encryption. ECC is used for key agreement and digital signatures.

All 35 Cryptography questions →

Boolean-based blind SQL injection: What type of SQL injection is this?

1. Boolean-based blind SQL injection ✓

   Correct. Boolean-based blind SQLi infers information by observing differences in application behavior (normal vs. error page) based on true/false conditions — no data is directly returned to the attacker.
2. Error-based SQL injection

   Incorrect. Error-based SQLi extracts data through database error messages (e.g., MySQL verbose errors revealing table names). In the described scenario, an error page is returned but no data is echoed in the error message itself.
3. Time-based blind SQL injection

   Incorrect. Time-based blind SQLi uses SLEEP() or WAITFOR DELAY commands to infer true/false answers through response delays. The described attack uses page behavior changes (normal/error), not timing differences.
4. Union-based SQL injection

   Incorrect. UNION-based SQLi appends a SELECT statement to retrieve and display data directly in the response. Data being echoed back is a prerequisite — which the question explicitly states does not occur here.

All 100 Web Application Hacking questions →

Rainbow table attack: This technique is known as:

1. Rainbow table attack ✓

   Correct. Rainbow tables are pre-computed lookup tables of hash values for known plaintexts. They trade storage space for cracking speed by eliminating the need to compute hashes at crack time.
2. Brute-force attack

   Incorrect. A brute-force attack computes hashes in real time during the attack, trying all combinations sequentially. Pre-computation is not involved — this is the key difference.
3. Dictionary attack

   Incorrect. A dictionary attack uses a wordlist of likely passwords but computes hashes during the attack — it does not use pre-computed lookup tables.
4. Pass-the-hash attack

   Incorrect. Pass-the-hash uses a captured hash directly for authentication without cracking it. Pre-computation of a lookup table is not involved.

All 96 System Hacking Phases and Attack Techniques questions →

CEH exam: the facts

How many questions are on the CEH exam?

125, as published by the exam vendor.

How long is the CEH exam?

240 minutes. Across 125 questions that is about 115 seconds per question.

What topics does the CEH exam cover?

9 domains: Network and Perimeter Hacking, Reconnaissance Techniques, System Hacking Phases and Attack Techniques, Web Application Hacking, Mobile Platform, IoT, and OT Hacking, Information Security and Ethical Hacking Overview, Cryptography, Cloud Computing, Wireless Network Hacking. Weights: Network and Perimeter Hacking 24%, Reconnaissance Techniques 17%, System Hacking Phases and Attack Techniques 15%, Web Application Hacking 14%, Mobile Platform, IoT, and OT Hacking 10%, Information Security and Ethical Hacking Overview 6%, Cryptography 5%, Cloud Computing 5%, Wireless Network Hacking 5%.

How many CEH practice exam questions does Certsqill have?

498, spread across 6 exam domains. Every one shows all options, which is correct, and why each of the others is not.

What CEH exam questions look like

The CEH knowledge exam is 125 multiple-choice questions in four hours, which leaves a little under two minutes per question. Most certified ethical hacker exam questions are short scenarios: a scan output, an attacker’s next move or a defender’s observation, followed by a question about which tool, technique or phase fits.

That is why the explanations matter more than the score. The wrong options in CEH test questions are rarely random; they are usually a real tool or technique that would be right one step earlier or later in the attack. Reading why each of them is wrong is how you learn to tell the steps apart.

How to study with CEH practice questions

A practical way to study is to work in rounds rather than straight through the bank:

Because EC-Council sets the pass mark per exam form, somewhere between 60% and 85%, no practice percentage proves you will pass. A consistent result across every domain, not one high overall score, is the better sign that you are ready.

• First round: answer certified ethical hacker practice questions domain by domain, without time pressure, and read the explanation for every option — including on the ones you got right.
• Second round: go back to the domains with the lowest readiness score and study the underlying topic, not just the questions you missed.
• Final round: mixed sets under exam timing, so that switching between topics at speed feels normal by exam day.

CEH v13 exam dumps and EC-Council’s rules

CEH v13 dumps are sold as copies of live exam questions. Apart from the fact that you cannot know whether they are accurate, EC-Council’s certification exam policy is explicit: all candidates must agree to a non-disclosure agreement that requires them to keep exam content confidential, and it lists using “brain-dump” material and disseminating actual exam content among the forms of misconduct.

The sanctions it names are serious. A candidate may be decertified, may have test scores and certifications revoked, and may be permanently prohibited from taking any future EC-Council certification exam. For a credential that employers check, that is a high price for a shortcut.

The practice questions on Certsqill are expert-developed against EC-Council’s published syllabus, not taken from the live exam, so using them does not touch the non-disclosure agreement.

CEH practice: questions people ask

Are CEH v13 exam dumps allowed?

No. EC-Council’s exam policy lists using “brain-dump” material as misconduct, and sanctions can include revoked certifications and a permanent ban from future EC-Council exams. Checked 9 October 2026.

How many questions are on the CEH exam?

The knowledge exam is 125 multiple-choice questions in four hours. The optional practical exam is 20 challenges in six hours. Source: EC-Council, checked 9 October 2026.

What score on CEH practice questions means I am ready?

There is no single number, because EC-Council sets the cut score per exam form between 60% and 85%. Aim for consistent results in every domain rather than one high overall average.

Do the practice questions explain the answers?

Yes. Every question explains each answer option — why the correct one is right and why each of the others is wrong — and your results feed a readiness score per domain.

CEH in detail

• How much is the CEH exam? →
• CEH certification requirements and how to become a certified ethical hacker →
• CEH salary and jobs: what the Certified Ethical Hacker credential is worth →
• CEH study guide: the v13 modules and how to prepare →
• CEH training and courses: official options, online and boot camp →