While assessing a healthcare application, a penetration tester discovers unprotected database tables containing Protected Health Information (PHI). The tester hashes the data locally to use as proof of exploit. Which statement about compliance is MOST accurate?

Legal reporting and breach notification obligations must still be fulfilled

The tester assumes direct liability only if the hashed records are moved off the client network

Hashing the extracted data locally fully satisfies all privacy requirements during testing

Immediate escalation to federal law enforcement is required prior to applying system patches

What is the difference between a threat and a vulnerability in information security?

A vulnerability is a weakness in a system, while a threat is a potential danger that might exploit that weakness

A threat requires human action, while a vulnerability is always a technical flaw

A threat is internal to an organization, while a vulnerability comes from external sources

A vulnerability is a deliberate attack, while a threat is an accidental exposure

An HTTP response header reveals "Server: cloudflare" alongside an application vulnerability. To avoid misattributing this vulnerability to the application layer, which validation step should an ethical hacker perform NEXT?

Cross-check the TLS certificate and ASN

Exploit the vulnerability using standard payloads

Launch a secondary automated vulnerability scan

Enumerate the application layer using Burp Suite

A target domain utilizes a privacy protection service. To escalate the investigation and deduce the underlying hosting provider, which sequence of chained reconnaissance lookups represents the MOST effective technical workflow?

Pivot from WHOIS to name-server glue records to ASN

Pivot from reverse DNS to certificate revocation lists

Pivot from RDAP to passive DNS to internal routing tables

Pivot from WHOIS to BGP routing tables to firewall logs

A client requires a reconnaissance phase with a strict zero-footprint constraint, emphasizing that the target systems must not receive any direct network traffic. Which method should the analyst use to identify subdomains?

Query Certificate Transparency logs for the target domain

Perform a stealth SYN scan using Nmap with fragmented packets

Run a directory brute-force attack using carefully customized HTTP requests

Execute a DNS zone transfer against the target's authoritative name server

An ethical hacker is strictly limited to passive reconnaissance during the initial phase of an engagement. Which of the following activities violates the rules of engagement by crossing into active reconnaissance?

Querying the target's authoritative name servers directly

Querying the Regional Internet Registry for autonomous system assignments

Extracting organizational information from certificate transparency logs

Retrieving historical DNS records from third-party passive DNS archives

A university research team plans to conduct an internet-scale port scan to study IoT device prevalence. Which scan configuration BEST balances technical objectives with responsible research practices and third-party impact?

Use conservative rate limits with scanner identification and abuse opt-out contact

Use the cloud provider's default rate limits without verifying acceptable-use policy

Deploy maximum-rate scanning without throttling to complete the study quickly

Limit scanning to business hours in the researcher's timezone to reduce complaints

An organization suffered an unscheduled outage during a routine vulnerability scan. Upon reviewing the audit logs, the security manager finds the root cause. Which action most likely triggered the outage?

Executing discovery probes and unapproved intrusive checks in the same assessment

Generating an extensive executive summary report without filtering out false positive findings

Applying a strict rate limit to the network traffic to preserve critical bandwidth

Utilizing a credentialed assessment profile to accurately inventory software on target systems

Full engagement115 min clock312-50

CEH mock exam on the clock

A CEH mock exam on a clock set to the real exam's pace: no verdicts while it runs, then a score for each domain and a note on every option. It is shorter than the real 125-question exam, so read the result as a diagnosis of where to study next.

Exam: 312-50
Targets: 60
Clock: 115 min

This mock against exam 312-50

How the run differs from the real sitting
Feature	This mock	Exam 312-50
Length (differs)	Shorter than a full form; the briefing shows the count	125 multiple-choice questions
Time (differs)	Scaled to the length	4 hours
Pace per question	Just under 2 minutes	Just under 2 minutes
Mix (differs)	Weighted by blueprint v5.0 domain shares	Nine domains, per blueprint v5.0
Mark and review	Flag any question and return before you finish	Mark questions and review them before ending
Pass line (differs)	None; you get a score per domain	Cut score of 60% to 85%, set per form
Afterward (differs)	A note on every option	Transcript with your score and the form's cut score

Tinted rows marked ≠: the two differ.

Exam details from EC-Council's certification page, the CEH candidate handbook and the CEH course page, checked Oct 11, 2026.

Sit it like the real thing

Do it in one sitting. Phone in another room, no notes: the real exam is closed-book (EC-Council). Stop halfway and the domain scores describe a different test from the one you will sit.

Use the flag. The candidate handbook confirms you can mark questions and come back to them before you end the exam. Build the habit here: anything that has taken more than two minutes gets a flag and you move on; flags get cleared at the end, while the clock still runs.

Start the timed run

The briefing shows how the run is split by domain. The clock starts when you press Start; verdicts wait for Finish.

60 targets, 115 minutes on the clock. The clock starts when you press Start.
No verdicts during the run. Pick, change your mind, flag, move on.
The hit map under each target jumps anywhere in the run.
Finish early or let the clock run out: you get a score by domain, then every target with notes on all its options.

How this run is split by domain

Domain	Targets
Overview	4
Recon	10
System hacking	9
Network & perimeter	14
Web apps	8
Wireless	3
Mobile, IoT, OT	6
Cloud	3
Crypto	3

115:00Target 1/60

Reading the debrief

Domain scores: They come weakest first. Spend the next week on the top one or two, weighted by what the domain is worth: a low score in a 5% domain costs less than the same score in Network and Perimeter Hacking, which blueprint v5.0 puts at 24%.
Overall percentage: Treat it as a trend between runs. EC-Council sets the cut score per form, from 60% to 85%, so no mock percentage maps to a pass; the CEH passing score page explains the range. EC-Council also says the section percentages on a real score report have no one-to-one link to pass or fail (certification FAQ).
Flagged but right: A correct answer you flagged is luck you cannot bank on. Read its notes as if you had missed it.

What to do with the result

Feed the two weakest domains into the CEH study plan and drill them on the CEH practice test with the domain filter on. Wait at least a week before the next mock: the same items a few days apart test your memory of them more than your readiness.

For the full shape of the real sitting, from question count to time limit, see how many questions are on the CEH exam.

Sources

EC-Council certification page: format and cut scoreschecked Oct 11, 2026
CEH Candidate Handbook (PDF): mark and reviewchecked Oct 11, 2026
EC-Council CEH course page: exam transcriptchecked Oct 11, 2026
EC-Council certification FAQ: section scoreschecked Oct 11, 2026
CEH Exam Blueprint v5.0 (PDF): domain shareschecked Oct 11, 2026