PECB Certified Lead Ethical Hacker

PECB describes two parts: a practical exam and report writing. In the practical part you must compromise at least two target machines through penetration testing, and the process must be documented in a written report. Both halves matter, so a clean compromise with a thin write-up is a real risk.

Yes. PECB states the exam is open book and that candidates may use training course materials and personal notes during the examination process. That rewards organised notes and fast lookup over memorisation, so build an index of commands, tool syntax, and report templates before exam day.

Expect it to feel harder in a different way. There are no answer options to guide you: you must actually gain access to live targets and then explain, in writing, what you did and why. Candidates comfortable with labs and documentation usually adapt faster than those who have only studied theory.

PECB states that candidates who completed the training course but failed the exam are eligible to retake it once for free within a 12-month period from the initial date of the exam. Confirm the current terms with PECB before relying on this, as policies can be revised.

The published agenda runs five days: introduction to ethical hacking, the reconnaissance phase, the exploitation phase, post-exploitation and reporting, and the certification exam on day five. The exam itself is preceded by lab work, so treat the earlier days as your main preparation window rather than the exam day.

Start with reconnaissance and information gathering, then threat modeling and vulnerability identification, because exploitation decisions depend on what you found. Move to exploitation, privilege escalation, and pivoting, and practise reporting throughout rather than saving it for the end. Reporting is a scored domain in its own right.

PECB lists knowledge of information security concepts and principles plus advanced operating system skills as the main requirement, and recommends knowledge of computer networks and programming concepts. Practical familiarity with Linux and common tooling will make the lab sessions far more productive.

PECB lists two levels. The Provisional Ethical Hacker requires the exam plus signing the PECB Code of Ethics and the CLEH Code of Conduct, with no professional or project experience. The Lead Ethical Hacker requires five years of experience, including two years in penetration testing and cybersecurity, plus 300 hours of project experience.

Two stand out: failing to fully compromise the required number of targets, and producing a report that lists tools without explaining scope, methodology, findings, evidence, and remediation. Practise writing findings as you exploit, capture command output and screenshots immediately, and keep a consistent structure across every target.

PECB states that an attestation of course completion worth 35 CPD credits is issued to participants who attend the training course. Note that this is tied to attendance, not to passing the exam, so it is separate from the credential itself.