How does the CEH v13 exam (312-50) work?
EC-Council's CEH v13 exam, code 312-50, consists of 125 multiple-choice questions to be answered in 4 hours. There is no single cut score: depending on the exam form you receive, the passing score ranges from 60% to 85%, because EC-Council weights each question set according to its difficulty. In practice, aim well above the minimum rather than counting on a narrow margin.
The exam is taken in English, either online with remote proctoring or at an authorised test centre. Questions go beyond definitions: many present a scenario, a tool output or a command to interpret. Good news for candidates in Morocco: attending official training exempts you from the eligibility application required of self-study candidates.
- Exam code: 312-50 (CEH v13, branded "CEH AI")
- Format: 125 multiple-choice questions, 4 hours
- Passing score: 60% to 85% depending on the exam form
- Delivery: remote proctoring or authorised test centre
- Validity: 3 years, renewable with 120 ECE credits and the EC-Council annual membership fee
What are the 20 CEH v13 modules and how should you group them?
The official syllabus has 20 modules. Learning them in order like a list of chapters is the surest way to get lost. Group them by attack phase instead: you will remember the logic better, and that is exactly how scenario questions are built.
- Foundations: introduction to ethical hacking (concepts, legal framework, methodologies, the role of AI)
- Reconnaissance: footprinting and reconnaissance, network scanning, enumeration, vulnerability analysis
- System compromise: system hacking, malware threats
- Network attacks and evasion: sniffing, social engineering, denial of service, session hijacking, evading IDS, firewalls and honeypots
- Web applications: hacking web servers, hacking web applications, SQL injection
- Modern attack surfaces: wireless networks, mobile platforms, IoT and OT, cloud computing
- Cross-cutting: cryptography
What study plan will get you through CEH in 4 to 6 weeks?
If you already have a grounding in networking, Linux and Windows, four to six weeks of steady revision after the course is usually enough. Plan one to two hours a day on weekdays and a longer session at the weekend. If you are starting further back, stretch the plan rather than compress it.
- Week 1: foundations and reconnaissance. Revise the TCP/IP model, common ports and Nmap options; redo the footprinting and scanning labs.
- Week 2: enumeration, vulnerabilities and system hacking. Work on protocols (SMB, SNMP, LDAP), reading CVSS scores, privilege escalation and password cracking.
- Week 3: malware, sniffing, social engineering, DoS, session hijacking and evasion. Learn to recognise an attack from a capture or a symptom.
- Week 4: web, SQL injection, wireless, mobile, IoT/OT, cloud and cryptography. Focus on the OWASP Top 10, encryption types and hashing algorithms.
- Weeks 5 and 6 (if possible): timed 125-question practice exams, review of every mistake, notes on weak areas and targeted revision of the modules you know least.

Why practise in the labs for a multiple-choice exam?
You often hear that CEH "can be passed by memorising". That is the most expensive mistake. Many questions show you a tool's output and ask what it means or which command produced it. If you have run those tools yourself, the answer is obvious; if not, you hesitate between two plausible options.
The official CEH v13 labs recreate full environments where you chain the phases of an attack. Redo the key exercises at least twice, noting for each tool its purpose, its basic syntax and what its output shows.
- Nmap: scan types, service and OS detection options
- Wireshark and tcpdump: filters, spotting a scan or ARP poisoning
- Metasploit: modules, payloads, Meterpreter sessions
- Burp Suite and sqlmap: intercepting requests, SQL injection
- Hydra, John the Ripper, Hashcat: password attacks
- AI-assisted tools covered in class: what they automate and where they fall short
Exam day: online or at a test centre, how should you prepare?
From Casablanca, Rabat or any other city in Morocco, remote proctoring is often the simplest option, provided you prepare your environment. At a test centre the logistics are handled for you, but you need to book a slot and plan the journey. Either way, 4 hours is long: managing your energy matters as much as what you know.
- Online: test your webcam, microphone and connection the day before; a quiet room, a clear desk, no second screen
- A valid official ID matching the exact name on your registration
- Time management: about 1 minute 50 seconds per question; flag hard questions and come back at the end
- Read every word: "NOT", "BEST" and "FIRST" change everything
- Eliminate impossible answers first, then pick the most precise one
- Never leave a question unanswered
Which mistakes make candidates fail the CEH exam?
CEH failures rarely have a single cause. Most often they come from unbalanced preparation: too much reading, not enough practice and no rehearsal under real conditions.
- Relying only on question banks: wording changes and understanding matters more
- Neglecting "easy" modules such as cryptography, cloud or IoT, which still count towards your score
- Mixing up similar concepts: scan types, DoS attacks, malware families or encryption types
- Never sitting a full 4-hour practice exam before the real one
- Booking the exam too long after the course: ideally within four to six weeks
After CEH: CEH Practical, CEH Master and your next career step
Once you hold the 312-50, there are two logical next steps. The first is the CEH Practical: 6 hours, 20 challenges in a live environment, with a 70% pass mark. It answers the criticism that CEH is "too theoretical", and candidates who pass both exams earn the CEH Master title.
The second is to move up a level. If you are aiming for a pentester role, OffSec's OSCP+ is the demanding next step, with a fully hands-on exam. If you are still new to security, CompTIA Security+ remains an excellent foundation to strengthen in parallel. In Morocco, banks, telecom operators, audit firms and offshoring centres regularly mention CEH in their job ads, especially as law 05-20 strengthens security audit requirements.
Prepare for CEH v13 with GATech in Morocco
At GATech, the CEH v13 course runs for 5 days (40 hours) in Casablanca, in Rabat or as a live virtual classroom. It combines lectures with the official labs, and your instructor supports you all the way to the exam. Prices start at 21,900 MAD, with the 312-50 exam voucher included.
Several offers ease the budget: 10% off for early registration (at least 4 weeks before the session), 15% off for groups of 3 or more from the same company, 15% off for students and recent graduates, and 3 interest-free instalments for individuals. Discounts cannot be combined. Contact us for upcoming dates and your quote.
Frequently asked questions
What score do you need to pass the CEH v13 exam?
There is no single score. Depending on the 312-50 exam form you receive, the cut score ranges from 60% to 85%. Aim clearly above the minimum in your practice exams.
How long does it take to prepare for the CEH exam?
If you have a grounding in networking, Linux and Windows, allow for the 5-day course followed by four to six weeks of steady revision with timed practice exams. Beginners will need more time.
Can I take the CEH exam online from Morocco?
Yes. You can sit the exam online with remote proctoring from home or the office, or at an authorised test centre. Online, you need a webcam, a microphone, a stable connection and a quiet room.
Is the CEH v13 exam available in French?
The 312-50 exam is taken in English. You can attend the course in French, but it is wise to revise with the English terminology for tools and attacks so you are not caught off guard on exam day.
What is the difference between CEH, CEH Practical and CEH Master?
CEH (312-50) is the 4-hour multiple-choice exam. CEH Practical is a 6-hour hands-on exam with 20 challenges and a 70% pass mark. Passing both earns you the CEH Master title.
GATech teaching team
Cybersecurity trainers and consultants preparing professionals in Morocco for CEH, OSCP+, CISSP, CompTIA and ISO 27001.
Published



