CPEH

It is a multiple-choice exam covering the ten domains in the official blueprint, from ethics and scoping through exploitation, post-exploitation and reporting. Questions are scenario-based rather than pure definitions. Confirm the current item count, time limit and delivery method on the certifying body's website, since those details are published there and can change between versions.

Candidates with real lab time generally find it manageable; those who only read a study guide often struggle. The hard part is discrimination - several answers are technically valid tools, and you must pick the one that fits the stated phase, target and constraint. Depth of hands-on practice predicts performance better than the number of practice tests taken.

Most working candidates need roughly two to three months of part-time study, weighted toward lab work rather than reading. If you are new to Linux, networking or the command line, allow longer and front-load those fundamentals. Build a repeatable routine: one phase per week, then a full end-to-end engagement and a written report in the final weeks.

Follow the engagement lifecycle: ethics and legal scope first, then reconnaissance, scanning and enumeration, then exploitation of systems, networks and web applications, then post-exploitation and covering tracks, and reporting last. Cryptography and wireless can be slotted in wherever they connect to a lab you are already running, which makes the concepts stick better than studying them in isolation.

Not to a developer standard, but you should be able to read and modify short scripts in Bash and Python, understand HTTP requests and responses, and interpret SQL and a little JavaScript. Many exam scenarios describe a payload or query and ask what it does; being able to trace the logic matters more than writing code from scratch.

Retake rules, waiting periods and any associated fees are set by the certifying organization and are not fixed across versions. Check its official website or your account portal for the current policy before scheduling. If a retake is needed, review your score report for weak domains and rebuild lab exercises around them rather than rereading the whole guide.

Scoring is criterion-referenced, meaning you are measured against a standard rather than against other candidates. The passing score is set by the certifying body and is published on its website along with any domain-level weighting. Treat the official outline as your source of truth and do not rely on figures quoted in forums, which are frequently outdated.

Three recur. First, memorizing tool flags instead of understanding which phase a technique belongs to. Second, skipping reporting and remediation, which are easy marks that candidates neglect. Third, misreading scenario constraints - scope, authorization, or whether stealth is required - and choosing an aggressive technique the question explicitly rules out. Read the whole stem before the options.

There is no universally enforced hands-on prerequisite, but the questions assume familiarity with real tools and outputs. Candidates without lab experience tend to lose time interpreting unfamiliar command output. Even a small home lab with a couple of virtual machines and a deliberately vulnerable application closes most of that gap.

Verify the exam version and blueprint on the certifying body's site before booking, and re-check it if you delay your exam date. Tool behavior changes quickly, so prefer documentation from the tool's own project over third-party tutorials. Note the version of everything in your lab so your practice notes stay reproducible.