Certified Ethical Hacker (CEH): Exam Format, Requirements and Degree Paths

The Certified Ethical Hacker (CEH) is a credential from EC-Council that shows you can find weak points in computer systems the way an attacker would, then report them so they can be fixed. EC-Council describes a 4-hour knowledge exam with 125 multiple-choice questions and a 6-hour practical exam with 20 real-world challenges.

What Does the CEH Certification Prove?

The CEH proves that you know how attacks work and can look for weak points deliberately. The word “ethical” matters. Ethical hackers work with permission, within a defined scope, and report what they find to the organization that owns the system.

It sits in the middle of the certification ladder. Our certification data classes it as intermediate, above a foundational credential such as CompTIA Security+ and below an advanced one such as the ISC2 CISSP. That’s a useful way to place it. You don’t start with it, and you don’t need it to reach the top.

Employers read CEH as evidence of offensive-security vocabulary and method. It’s often paired with roles that test systems, such as penetration testing, and with analyst jobs where understanding an attacker’s moves makes defense better.

How Is the CEH Exam Structured?

EC-Council’s page describes two parts. The knowledge exam lasts 4 hours and has 125 multiple-choice questions. The practical exam lasts 6 hours and has 20 real-world challenges.

The two parts measure different things. The knowledge exam checks what you know. The practical exam checks whether you can do it, which is closer to how an employer thinks about the job. A candidate with only the first part has shown knowledge, and one with both has shown knowledge and applied skill.

Exam details change as issuers update their programs, so confirm the current format on EC-Council’s page before you register. We list what the page says as of October 2026.

Who Can Take the CEH?

EC-Council states there are no specific prerequisites. It strongly recommends a minimum of 2 years of experience in IT security before you attempt the certification.

That recommendation is worth taking seriously. The exam assumes you already understand networks, operating systems and common security tools. If you’re new to IT, you’ll find the material much harder than someone who has administered systems for a couple of years.

For students, the practical route is to earn a degree or complete coursework that teaches the fundamentals, then take the exam when you’ve had hands-on practice. A program with labs, a capstone or an internship builds the experience the recommendation refers to.

Which Online Degrees Prepare You for the CEH?

Fourteen programs we compare name CEH in their coursework or preparation. They span every level, which is helpful if you’re starting from different places.

At the associate level, Northern Virginia Community College’s online A.A.S. in cybersecurity lists CEH among the certifications it aligns with, along with Security+ and CISSP. It also lists a 24/7 virtual lab and courses such as Network Attacks, Computer Crime and Hacking and Malware Analysis. St. Petersburg College’s associate degree, Wilmington University’s associate degree and Zane State College’s associate of applied business also name it.

At the bachelor’s level, Park University, Excelsior University and the University of Phoenix do. Phoenix lists a Computer Forensics Lab, courses aligned to EC-Council exams and discounts on third-party exam fees.

Which Master’s Programs Mention the CEH?

Several master’s programs name it. Franklin University’s M.S. in cybersecurity lists Ethical Hacking among its courses, and it grants credit for prior learning to students who already hold a current CEH. The program’s page says the credential aligns with Ethical Hacking (ISEC 670), which translates into 4 credit hours toward the degree.

St. Bonaventure University’s master’s names CEH alongside CISSP, AWS Certified Security Specialty, Certified Network Defender and OSCP, and it uses cloud-based labs for hands-on practice. Mercyhurst University’s master’s lists Ethical Hacking and Penetration Testing among its courses, uses online cyber ranges, and partners with EC-Council Academia for discounted certification resources.

Other master’s programs that name CEH include American National University, Tulane University, West Virginia University and Yeshiva University. Our online cybersecurity degrees with certifications list shows all of them with prices and delivery.

How Does a Degree Help With the CEH?

A degree supplies what the exam assumes. Networking, operating systems, scripting and security principles take time to learn, and a structured program teaches them in an order that builds.

Programs with labs help more. Hands-on practice with scanning, exploitation and reporting is the closest thing to the practical exam. Look for programs that describe their labs, such as cyber ranges, virtual labs and cloud-based labs, not just lecture courses.

Credit for prior learning can also save money. Franklin’s policy shows how it works: if you already hold a current CEH, the program awards credit toward a course. If you’re planning to earn the certification first, ask your target program whether it offers similar credit, because policies differ by school.

Cost matters too. Franklin charges $690 a credit and lists total tuition of $24,840 for its 36-credit master’s, and St. Bonaventure charges $805 a credit for 30 credits, or $24,150 in total tuition, plus a $20 fee per credit hour. Mercyhurst charges $1,132 a credit. Prices differ widely, so compare before you commit.

How Should You Prepare for the CEH?

Start with fundamentals. You should be comfortable with how networks move data, how operating systems manage users and permissions, and how common services such as web servers and DNS work. If those feel shaky, build them first, because the exam builds on them.

Then practice in a lab. A home lab, a cyber range or a school’s virtual lab lets you scan, test and write up what you find without risking real systems. The practical exam gives you 6 hours and 20 challenges, so you want your methods to be automatic by the time you sit it.

Finally, practice reporting. Ethical hackers are paid to find problems and explain them clearly. A short write-up of what you found, how you found it and how to fix it is a skill employers value, and it’s a good portfolio piece even if you never take the exam.

If you’re studying through a degree, plan your term around the lab courses. Taking a course such as Ethical Hacking and Penetration Testing or Network Attacks, Computer Crime and Hacking shortly before the exam keeps the material fresh.

Which Degree Level Fits a Future Ethical Hacker?

The right level depends on where you are now. Prices below are total tuition from each school’s published figures and don’t include fees.

Associate degrees are the quickest way in. Zane State College’s associate of applied business in cybersecurity lists total tuition of $14,235 and an internship program with local firms. Wilmington University’s associate degree charges $439 a credit for 60 credits, a total of $26,340.

At the bachelor’s level, the University of Phoenix lists $398 a credit and $47,760 in total tuition for 120 credits, and Excelsior University lists $510 a credit and $61,200. Excelsior’s program is asynchronous with 8-week terms and doesn’t require programming experience.

Master’s programs suit people who already hold a bachelor’s degree. They run from the $24,150 St. Bonaventure charges to the $40,752 Mercyhurst lists, and Mercyhurst also doesn’t require prior programming experience.

If you want help comparing, our online associate degrees in cybersecurity and online master’s in cybersecurity lists put the details side by side.

What Should You Ask a Program About the CEH?

Programs use different words, so ask directly. Does the curriculum prepare you for the CEH, or does it only mention it? Which courses teach the material, and are there hands-on labs in them?

Ask whether the program offers credit for a current CEH, as Franklin does, or discounts on exam fees, as Phoenix lists. Ask whether an internship, externship or capstone lets you apply what you’ve learned. And ask about the format. Excelsior is asynchronous, while other programs run on set terms, and that affects whether you can study around a job.

Finally, ask how recent graduates have used the credential. Employers hire for different reasons, and a program that can describe what its graduates do is likely to prepare you for the same.

What Jobs Does the CEH Support?

The CEH fits roles where you test or analyze security. Information security analysts, whom BLS describes as monitoring networks, checking systems for vulnerabilities and recommending improvements, use attacker-style thinking every day. The median pay for that category is $129,180 as of May 2025.

Penetration testing is the clearest fit. BLS has no separate category for penetration testers, and the closest federal group is “Computer Occupations, All Other,” which has a median of $116,580. That’s a catch-all category, so treat the figure as a loose guide, not a target.

If you want the analyst route, read our information security analyst career guide. If you’re starting out, our entry-level cybersecurity jobs guide explains how to build a first-job case.

Is the CEH Worth It for Career Changers?

It can be, but not as a first step. If you’re coming from another field, the fastest way to make the CEH useful is to build the IT and security basics first. A foundational credential and a degree or certificate program give you the base the exam assumes.

After that, the CEH helps you tell a clear story. You can say you understand how attacks work and have proven it on a practical exam. That story is stronger when it comes with a lab write-up or an internship.

Be realistic about timing, too. EC-Council recommends two years of IT security experience, so a career changer may reach the exam later than a student who has worked in IT. That’s fine. The credential keeps its value, and you’ll pass more comfortably with the experience behind you.

How Does the CEH Compare With Security+ and CISSP?

Each credential has a different job. CompTIA Security+ is foundational. It has a maximum of 90 questions over 90 minutes, and CompTIA recommends Network+ and two years of experience in a security or systems administrator role. It covers broad security basics.

The CEH is narrower and more offensive. It focuses on how attackers find and exploit weak points, and it adds a hands-on exam.

The ISC2 CISSP is advanced and broad, with a requirement of five years of cumulative full-time experience in two or more of its domains. Our CISSP requirements guide explains it.

A common order is Security+ first for the basics, CEH when you want offensive skills, and CISSP when you’ve got years of experience and want to move into leadership.

What Are the Downsides of Chasing the CEH?

A certification isn’t a skill by itself. If you memorize answers without practicing, you’ll struggle in an interview where someone asks you to walk through a scan. Employers can tell.

It also takes time and money. EC-Council recommends two years of experience, and preparation takes study on top of that. Exam fees and training costs vary, so check EC-Council’s site for the current price before you plan a budget.

Finally, a certification doesn’t replace a degree for many jobs. BLS lists a bachelor’s degree as the typical entry-level education for analysts. The best approach for most people is to combine a degree, hands-on practice and one well-chosen certification.