What's on the CEH Exam? The Nine Domains, Their Question Counts, and the Format

What is on the CEH exam?

The CEH exam is EC-Council's Certified Ethical Hacker knowledge exam, code 312-50. It has 125 multiple-choice questions and runs for 4 hours. Every question comes from one of nine domains in CEH Exam Blueprint v5.0, which took effect on April 10, 2024. Network and Perimeter Hacking carries the most questions, 30 of 125, and three small domains carry 6 each. EC-Council sets a cut score for each exam form, between 60% and 85%. The 6-hour CEH Practical is a different, optional exam, so nothing below about format or scoring applies to it unless the section says so.

How many questions does each CEH domain get?

The blueprint is unusual in one helpful way: it prints a question count for every sub-domain, not just a percentage. That makes the counts the most precise picture of the exam.

The printed percentages are the counts rounded to whole numbers, which is why they add up to 101% rather than 100%. For Reconnaissance Techniques, 21 ÷ 125 = 16.8%, shown as 17%. When the two disagree, trust the count.

Under each sub-domain the blueprint lists its topics, from footprinting through search engines, social networking sites, Whois and DNS to container technology, serverless computing, PKI and cryptanalysis. Read those lists as the syllabus. Paraphrasing them here would only lose detail, and the blueprint is a short document. If you want practice in proportion to the same counts, full CEH prep planned for launch sizes each domain's question set by the blueprint, from 432 Network and Perimeter Hacking questions down to 86 for each of the 6-question domains.

Which CEH modules carry the most questions?

The 20 sub-domains in the blueprint have the same names as the 20 modules of EC-Council's official CEH course, from Module 01, Introduction to Ethical Hacking, to Module 20, Cryptography. That gives you a simple rule for the CEH exam: every module is worth 6 or 7 questions.

• Five modules carry 7 questions: Introduction to Ethical Hacking, Footprinting and Reconnaissance, Scanning Networks, Enumeration, and Malware Threats.
• The other 15 carry 6: everything from Vulnerability Analysis and System Hacking to SQL Injection, IoT and OT Hacking, and Cryptography.

Five modules at 7 and fifteen at 6 make the 125 questions. So the large domains are large because they hold more modules, not because any one module dominates. Network and Perimeter Hacking is 24% of the exam because it holds five modules. Wireless Network Hacking is 5% because it holds one. In practice, every module deserves roughly the same attention. A candidate who skips Cryptography gives up about as many questions as one who skips Sniffing.

How is the CEH knowledge exam delivered and scored?

The cut score is the part that surprises people. EC-Council runs several exam forms, rates the difficulty of each question, and sets the passing score per form from those ratings, so two candidates on different forms can face different cut scores. There is no single passing percentage to aim for, so prepare for the top of the range rather than the bottom, then rehearse the clock. Four hours for 125 questions is about 1.9 minutes per question on average, and a 125-question, 4-hour timed mock exam is planned for full CEH prep for that pacing.

EC-Council's store sells separate vouchers for online proctoring and for Pearson VUE. If you book online, EC-Council asks you to run an equipment test, have identification ready, hold a valid voucher, and book the remotely proctored session at least 3 days ahead. Which voucher you need, and whether you must first apply for eligibility, depends on your route to the exam, explained in the guide to CEH exam cost and eligibility.

Is CEH v13 the version you take in 2027?

Three labels get mixed up here, and they mean different things.

1. The course version. EC-Council's CEH page says the program is "currently on Version 13" and now brands it CEH AI, with 20 modules and 221 hands-on labs. Version 13 describes the training.
2. The exam code. The certification site lists the exam as 312-50. EC-Council's candidate handbook adds that its ANAB-accredited certifications do not carry an exam version number.
3. The blueprint version. What the exam tests is set by the blueprint, now v5.0. EC-Council's CEH Candidate Handbook v7.3, issued September 21, 2026, still prints Blueprint v5.0 as its Appendix A.

For a 2027 exam date, the blueprint version is the one to check. EC-Council's CEH page says new versions are paced every 12 to 18 months, so a new course version or blueprint could arrive before your appointment. Before you book, open the blueprint link on EC-Council's CEH certification page and confirm it still says v5.0. If it does, everything in the table above applies, and full CEH prep planned for launch follows Blueprint v5.0 domain by domain.

How does the CEH Practical differ from the knowledge exam?

The CEH Practical is a separate exam, and EC-Council calls it optional. You earn the CEH credential by passing the knowledge exam alone.

In the Practical, you work on a live network of virtual machines and applications, and EC-Council's list of what it tests includes port scanning tools such as Nmap and Hping, vulnerability detection, and web application security tools. That is a hands-on skill check, while the knowledge exam asks you to recognize techniques, phases, tools and countermeasures in a written question. Prepare for them separately. EC-Council treats CEH Master as a designation for holding both, not as a certification you can buy.

How should you split CEH study time across the domains?

The counts make this easy. Divide your total hours by 125, then multiply by each domain's questions. With 60 hours, each blueprint question is worth about 0.48 hours:

Put another way, that is roughly 3 hours per module. This split is an editorial starting point, not an EC-Council rule. Move hours toward the modules where you have the least hands-on experience. If you take the direct route without official training, EC-Council expects at least two years of information security work, so your gaps are often the domains your job never touched, such as mobile, OT or cloud.

What should you do first with the CEH blueprint?

Find out where you stand before you plan. The 20 free CEH practice questions are split across the nine domains by the blueprint's counts, explain every option, and end with a breakdown by domain. Use that breakdown to pick a weak domain in the free CEH study planner, which turns your exam date and daily minutes into a dated outline.

Then keep the recall work steady. The CEH exam rewards knowing which tool, port, protocol or countermeasure belongs to which module, so short daily reviews help alongside the scenario work. For that layer, see how the 500 flashcards planned for full CEH prep are sorted by the nine domains.