CEH Practical Exam and CEH Master Explained

Most people know the CEH knowledge exam. Fewer know that EC-Council also runs a separate hands-on exam, and that passing both is what earns the higher CEH Master title. This guide explains the practical exam, how it differs from the multiple-choice paper and how to prepare. Details come from EC-Council's CEH page, read on November 5, 2026; EC-Council can change them, so confirm before you book.

Two Exams, Two Different Skills

• Knowledge exam: 125 multiple-choice questions in 4 hours, delivered online through the EC-Council exam portal. Passing scores typically range from 60% to 85%, depending on the exam form you receive.
• Practical exam (optional): 20 real-life challenges in 6 hours, in EC-Council's iLabs cyber range, also with a 60% to 85% pass range.

The knowledge exam asks what you know. The practical asks what you can do with a target in front of you.

What CEH Master Means

EC-Council describes the 4-hour exam plus the 6-hour practical as the route to the CEH Master title. The practical is optional, but it is the part that shows an employer you can apply the material, not only recall it.

How to Think About 20 Challenges in 6 Hours

Six hours across 20 challenges is about 18 minutes each on average. Averages hide the real lesson: some challenges will be quick and some will eat an hour if you let them. A few habits help in any timed lab:

• Triage first. Skim every challenge, do the ones you know cold, and come back to the rest.
• Time-box each one. If 25 minutes pass with no progress, write down where you stopped and move on.
• Keep notes as you go. Commands that worked, ports, usernames and hashes you found. You will reuse them.
• Enumerate before you exploit. Most stuck challenges are stuck because something was missed in scanning, for example a service on an unusual port.

Practice Under the Clock

• Pick 5 lab tasks and give yourself 90 minutes for all five.
• Write the notes you would need if someone else had to repeat your steps.
• After each session, list what slowed you down: scanning, a tool you did not know, a rabbit hole. Fix the biggest one next time.
• Repeat weekly. Speed comes from repetition, not from one long weekend.

Should You Take the Practical?

If you are applying for penetration testing or red team roles, yes: it is evidence of hands-on ability. If you only need a credential to clear an HR filter, the knowledge exam may be enough for now. Whichever you choose, the next step for fully hands-on work is CPENT AI; our CEH vs CPENT guide explains the jump.