CEH Exam Traps & Common Failure Patterns

Companion to 00-master-strategy.md, 01-exam-logistics.md, and practice/01-03-mcq-set-*.md. Date: 2026-09-11. Scope: CEH v13 (312-50, EC-Council Blueprint v5.0).

The CEH v13 is 125 multiple-choice questions over 4 hours. The content is memorisable; the failure rate is not driven by what you don’t know but by how the questions are built. This document catalogues the 25 most common question traps, the 4-step reading framework, scenario-decoding strategy, time-budget math, and the EC-Council house-style fingerprints that signal each trap.

1. Why CEH candidates fail (research-backed)

Variable cut score, 60-85%. EC-Council does not publish a fixed pass percentage. Each exam form is psychometrically calibrated against a per-form cut score that sits between roughly 60% and 85%. Harder forms carry a lower cut score; easier forms a higher one. Because you cannot pick which form you draw, the only safe target is ≥90% on unseen questions - anything below 85% on practice tests is a coin-flip on exam day. Source: https://www.examcert.app/blog/ceh-passing-score/ and the local 01-exam-logistics.md notes.

78% of CEH holders credit hands-on over textbooks. A widely-cited EC-Council 2026 survey of credentialed holders reported that ~78% said practical lab time mattered more than reading study guides. The exam is scenario-heavy - Q1 in practice/01-mcq-set-a.md is a 4-sentence SOC scenario, not a recall item.

100+ lab hours correlates with pass. The same survey and the Cover6 / StationX community analyses converge on 80-120 hours of hands-on time (Kali + TryHackMe + PortSwigger + HTB) as the pass threshold. Pure-book study averages fail at the 60-85% cut.

Top 6 ranked failure reasons (synthesised from the master-strategy doc + community pattern):

Rank	Failure reason	Mitigation
1	Treating CEH as theory-only (scenario panic)	80+ hours Kali/THM/PortSwigger
2	Ignoring Domain 4 (legal/procedures, ~12%)	Read PTES + PDPA end-to-end
3	Skipping web-attack labs (SQLi/XSS/SSRF = 15-20%)	PortSwigger Apprentice tier (~30 labs)
4	Reading outdated books (pre-v12)	Use only v12/v13-aligned material
5	Booking before a timed practice test	Boson / EC-Council practice ≥ 80% first
6	Treating MITRE ATT&CK as glossary	Walk real campaigns in ATT&CK Navigator

Source: 00-master-strategy.md §“Common Failure Modes” and Cover6 Solutions “How to Pass the CEH in 2026”.

2. The 25 most-common CEH question traps

Each trap lists: What it looks like, Why CEH uses it, How to spot it, How to answer correctly.

1. Two-correct-answers (BEST not CORRECT)

Looks like: “Which technique BEST prevents …” with two fully valid mitigations.
Why: Forces discrimination between technically correct and best-fit-for-context.
Spot: The word “BEST”, “MOST appropriate”, “PRIMARY”.
Answer: Pick the option tied to the scenario’s primary constraint (compliance, cost, scale, attacker capability).

2. Negation (NOT)

Looks like: “Which of the following is NOT a feature of …”
Why: Negation flips the search task - you must find the exception.
Spot: Bold/caps NOT, EXCEPT, ALL BUT, LEAST likely.
Answer: Read twice. Pre-filter for things that are correct, then mark the one that isn’t.

3. Longest-answer statistically more correct

Looks like: One option is 2 lines; the others are 5 words.
Why: Item writers pad the correct option with qualifiers; distractors stay terse.
Spot: Compare option lengths after elimination.
Answer: Use length only as a tie-breaker - never as the primary signal.

4. Absolute-word (always/never/only)

Looks like: “TLS 1.0 always …”, “AES is never …”
Why: Absolute words are almost always wrong in security (everything has exceptions).
Spot: Always, never, only, completely, every, none.
Answer: Treat the option as wrong unless you can prove the absolute claim.

5. Outdated vocabulary (WEP, SSL 3.0)

Looks like: “Cracking WEP with …” or “POODLE exploits SSL 3.0”.
Why: The blueprint is current, but legacy distractors still appear in older question banks.
Spot: WEP, WPA-TKIP, SSL 3.0, SHA-1, MD5 in a modern context.
Answer: Pick the modern equivalent (WPA3 / TLS 1.3 / SHA-256) - CEH v13 assumes retired protocols are not the live answer.

6. Outdated attacks (Cain vs BetterCAP)

Looks like: “Which tool performs ARP poisoning?” with Cain listed.
Why: Cain & Abel is the textbook answer but has been unmaintained since 2014.
Spot: Cain, BackTrack, SpyEye, Zeus (legacy malware names).
Answer: BetterCAP, Ettercap, Responder - the modern tool is the exam answer.

7. FIRST step vs LAST step

Looks like: “What is the FIRST action the analyst should take?”
Why: Tests chronology - easy to default to the most interesting step, not the first.
Spot: FIRST, NEXT, LAST, INITIAL, FINAL.
Answer: Walk the kill chain / NIST 800-61 phases in order: Preparation → Detection & Analysis → Containment.

8. MITRE vs Lockheed confusion

Looks like: “Recon → Weaponisation → Delivery …” vs ATT&CK tactics.
Why: Two frameworks, different granularity - easy to mix.
Spot: 7 phases = Lockheed Kill Chain; 14 tactics = ATT&CK Enterprise.
Answer: 7-phase sequence = Lockheed; granular post-compromise behaviours = ATT&CK.

9. Nmap near-miss (-sS vs -sT)

Looks like: “Stealth scan that completes a full handshake” with -sS and -sT both present.
Why: Tests whether you know -sS is half-open and -sT is full-handshake.
Spot: Conflicting Nmap flags with similar intent.
Answer: -sS = stealth but no full handshake; -sT = full handshake (logged). -sN/-sF/-sX are flag scans (RFC 793 quirk), -sA is ACK mapping, -sI is idle.

10. Defense-in-depth vs Zero Trust

Looks like: “Migrate from castle-and-moat to per-request authorisation” - answer should cite NIST 800-207.
Why: Both are layered-defence philosophies but ZT is identity-centric, not network-centric.
Spot: “Perimeter”, “VPN”, “always verify” → Zero Trust.
Answer: Defense-in-depth = layers (network + host + app + data); Zero Trust = NIST 800-207 = no implicit trust, continuous verification.

11. AES key size (128/192/256)

Looks like: “Which AES key size is mandated for FIPS 140-3 high-sensitivity data?”
Why: All three are valid AES key sizes; only one fits the constraint.
Spot: “FIPS”, “Suite B”, “CNSA”, “Top Secret” → 256-bit.
Answer: AES-128 = general; AES-192 = legacy Suite B; AES-256 = high-sensitivity / NSA CNSA.

12. OWASP 2021 vs 2025 mix-up

Looks like: “Which category is IDOR?” with A01:2021 vs A01:2025 numbering.
Why: OWASP reissued in 2025; some entries moved (A02:2021 Cryptographic Failures = A04:2025).
Spot: “Cryptographic Failures” - number depends on year.
Answer: Memorise both - 2021 IDOR = A01 Broken Access Control; 2025 renamed Software Supply Chain Failures.

13. Cloud shared-responsibility wrong layer

Looks like: “Customer is responsible for …” with OS patching vs physical security.
Why: IaaS/PaaS/SaaS shift responsibility lines differently.
Spot: IaaS (EC2) = customer patches OS; SaaS (Gmail) = provider patches app; physical = always provider.
Answer: Patch the layer the customer actually controls - provider never patches your OS or your IAM.

14. Singapore vs global law

Looks like: “Notify the regulator of a breach involving 500 PDs within …”
Why: PDPA (72h if significant harm) ≠ GDPR (72h) ≠ HIPAA (60 days).
Spot: Singapore = PDPC / PDPA / CMCA / CSA. Global = GDPR / HIPAA / PCI-DSS.
Answer: PDPA - “as soon as practicable”, 72h if significant harm; CSA - CII owners prescribed timeline.

15. Tool near-miss (Wireshark vs tcpdump)

Looks like: “Which CLI tool captures packets without a GUI?”
Why: Wireshark is the famous one; tcpdump is the CLI; tshark is the Wireshark CLI.
Spot: “GUI”, “CLI”, “headless”, “remote server” → tcpdump / tshark.
Answer: CLI = tcpdump / tshark; GUI = Wireshark; IDS = Snort / Suricata.

16. Non-default port

Looks like: “HTTPS is on TCP/8443” - answer choices assume default 443.
Why: Tests whether you check the scenario, not the default.
Spot: Port number in the question ≠ standard port.
Answer: Use the port stated in the scenario, not your default knowledge.

17. Pen-test vs red team

Looks like: “Goal is broad coverage of vulnerabilities” vs “Goal is emulating an adversary”.
Why: Pen-test = breadth of vulns; red team = depth of adversary emulation.
Spot: “Vulnerability coverage” → pen-test; “Adversary emulation / TTPs” → red team.
Answer: Pen-test = breadth, point-in-time, deliverable is vuln report. Red team = depth, goal-based, deliverable is campaign narrative.

18. “No authorisation” trap

Looks like: Scenario describes an attack without saying “authorised”.
Why: Tests ethics/legal awareness - unauthorised testing is a crime in most jurisdictions (Singapore CMCA s.3).
Spot: Missing words “authorised”, “scope”, “Rules of Engagement”.
Answer: The first action is to confirm written authorisation / scope / ROE - not to start scanning.

19. ISO 27001 vs 27002

Looks like: “Which standard provides implementation guidance for controls?”
Why: 27001 = certification (Annex A lists controls); 27002 = guidance (how to implement).
Spot: “Certify”, “ISMS”, “mandatory” → 27001. “How to”, “guidance”, “implementation” → 27002.
Answer: 27001 = certifiable ISMS; 27002 = control implementation guidance (was 17799).

20. IDS vs IPS

Looks like: “Sensor compares packets against signatures and drops traffic in-line.”
Why: Tests the “drops” verb - IDS only watches, IPS blocks.
Spot: “logs”, “alerts” = IDS; “drops”, “blocks in-line”, “resets” = IPS.
Answer: Drops in-line = IPS. Watches + alerts = IDS. (Source: NIST SP 800-94.)

21. Hash vs encryption

Looks like: “MD5(password) is stored - what property does this provide?”
Why: Hashing is one-way; encryption is reversible with a key.
Spot: “Stored”, “checksum”, “integrity”, “password storage” → hash. “Confidentiality”, “transit”, “TLS” → encryption.
Answer: Hash = integrity / one-way. Encryption = confidentiality / reversible. Salt + KDF (Argon2id/bcrypt) for passwords.

22. Symmetric vs asymmetric speed

Looks like: “Which is faster for bulk data?”
Why: Symmetric (AES) ≈ 100-1000× faster than asymmetric (RSA/ECC).
Spot: “Bulk data”, “VPN tunnel”, “file encryption” → AES. “Key exchange”, “signatures” → RSA/ECC.
Answer: Hybrid: RSA/ECC exchanges the key, AES encrypts the payload. Speed = symmetric.

23. VPN vs proxy

Looks like: “Site-to-site encrypted tunnel at L3” vs “Forwarding HTTP traffic at L7”.
Why: VPN = L3 tunnel (IPsec, WireGuard); Proxy = L7 forwarding (forward/reverse).
Spot: “Tunnel”, “L3”, “site-to-site” → VPN. “Caching”, “filtering”, “HTTP” → proxy.
Answer: VPN = L3 encryption; proxy = L7 application-aware forwarding.

24. TLS vs SSL

Looks like: “Configure SSL 2.0 on the web server”.
Why: SSL 2.0/3.0 are deprecated and banned by modern browsers/PCI-DSS.
Spot: “SSL 2.0”, “SSL 3.0”, “TLS 1.0”, “TLS 1.1” → wrong.
Answer: Modern answer = TLS 1.2 or 1.3. SSL is a legacy brand name.

25. Stateful vs stateless firewall

Looks like: “Which device tracks TCP session state?”
Why: Stateful = tracks connection table; stateless = inspects each packet independently.
Spot: “Tracks sessions”, “connection table”, “ACK without SYN” → stateful. “Per-packet ACL”, “header-only” → stateless.
Answer: Stateful = L4 with session table (modern firewalls). Stateless = simple ACL (legacy / hardware filters).

3. Question-reading framework (4 steps)

Read LAST line first. Identify the verb + constraint: “BEST”, “FIRST”, “NOT”, “MOST likely”, “primary purpose”. The verb dictates the answer family - FIRST is chronology, BEST is trade-off, NOT is negation.
Identify trap type. Match the verb to one of the 25 traps above. Most CEH items are a single trap plus a content question - once you see the trap, the content becomes mechanical.
Eliminate 2 options. Look for absolute words, wrong domain (e.g., cloud question, IDS answer), or legacy tools. Drop two.
Pick between remaining 2. Use length/qualifier heuristic, scenario constraint, and the CEH house style (next section).

Cross-reference: every question in practice/01-03-mcq-set-*.md maps to ≥1 trap here.

4. Scenario-based strategies

The CEH v13 is ~60% application/scenario. The scenario is decoration - your job is to extract the structured frame:

Read whole scenario. Don’t skim - the verb at the bottom is the answer key.
Identify actor. Attacker (red team), defender (SOC analyst), victim (CISO briefing), auditor. Actor dictates the goal.
Identify goal. Exfil, defend, detect, comply, escalate. Goal maps to CEH phase.
Match to CEH methodology phase. Recon → Scanning → Gaining Access → Maintaining Access → Covering Tracks. The phase is your answer frame.

Set A Q4 (NIST 800-61 incident-handling phase) is the textbook case - alert triaging = Detection & Analysis, not Containment. Set B Q61 (ettercap -M arp:remote) - actor = attacker, goal = MitM, phase = Sniffing / Gaining Access adjacent. Set C Q103 - Zero Trust components: PE/PA/PEP, PA issues the token (not PE).

5. Time management for 4h/125Q

Budget: 4h × 3600 = 14,400 sec / 125 = 115 sec/Q (round to 100 sec for a 19-min buffer).
First pass - 90 min. Answer every easy/medium item; flag hard ones. Aim ~75 questions.
Second pass - 90 min. Return to flagged. Re-read slowly, eliminate, commit. Aim ~40 questions.
Third pass - 45 min. Review only flagged + sanity-check answered. 10 questions.
Buffer - 15 min. Final sweep + submission.

Hard rule: never dwell > 3 min on one question. Flag, move, return. The exam does not penalise blank answers - practice/01-mcq-set-c.md intro confirms there is no scoring penalty for unanswered items, but a flagged unanswered is still better than a panicked wrong answer.

6. Exam-day errors

Reading too fast. Misreading the verb (BEST vs FIRST) costs ~10 points across the paper.
Changing answers. The classic research finding is 70% of changed answers go from correct to wrong. Default to your first instinct unless you have new evidence.
Panic on first hard Q. Q1 may be a Set-C-level item. Flag and move - the next 30 will normalise.
Not using the Flag button. Pearson VUE and RPS both flag items for review. Use it - 25% of your questions should be flagged at first pass.
Leaving blanks. No penalty, but a flagged guess has ~25% success vs 0% for blank. Always commit.

7. EC-Council house style patterns

5-10 fingerprints you can spot to predict the trap:

Multi-sentence scenario. 3-5 sentences set the scene before the question. The scenario usually contains the constraint, not the trivia.
“Which of the following” + 4 plausible tools. All four look like they could be the answer - only one fits the constraint.
“BEST describes” / “MOST appropriate” / “PRIMARY purpose.” Discrimination test - pick the option that fits the scenario’s constraint, not the textbook.
Numerical exactness. Port numbers (53, 80, 443, 3389), key sizes (128/192/256), retention days (30/90/365), RTO/RPO minutes. Memorise the canonical numbers.
“FIRST step” chronology. NIST 800-61 phases, CEH 5/6-phase methodology, kill chain order. Always walk the canonical order.
Negation in the verb. “NOT”, “EXCEPT”, “ALL BUT” - flip the search.
Modern-vs-legacy pair. One option is the modern tool (BetterCAP, AES-256, TLS 1.3); one is the legacy (Cain, SSL 3.0). Modern wins unless the scenario is explicitly historical.
Two-framework comparison. MITRE ATT&CK vs Lockheed vs PTES vs NIST 800-115 vs OWASP vs ISO. Pick the one whose granularity matches the question.
Compliance keyword. PDPA, GDPR, HIPAA, PCI-DSS, SOX. The right answer usually cites the named regulation’s specific clause (72h, 60 days).
Domain tag at the top. practice/01-03-mcq-set-*.md shows CEH tags every scenario with its domain - use that to bound your answer (e.g., 3.C crypto question, don’t answer with a network tool).

Sources

EC-Council CEH page - exam format, v13 status, hands-on philosophy: https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/
ExamCert.app passing-score analysis - per-form cut score 60-85%, equating methodology: https://www.examcert.app/blog/ceh-passing-score/
EC-Council CEH v13 announcement - https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/a-new-era-in-cybersecurity-announcing-ceh-v13/
NIST SP 800-61r2 - incident-handling phases (Preparation / Detection & Analysis / Containment / Post-Incident Activity): https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
NIST SP 800-207 - Zero Trust Architecture (PE / PA / PEP): https://csrc.nist.gov/publications/detail/sp/800-207/final
NIST SP 800-94 - IDS vs IPS, signature vs anomaly detection: https://csrc.nist.gov/publications/detail/sp/800-94/final
MITRE ATT&CK - Tactic ordering and T-code mapping: https://attack.mitre.org/tactics/TA0001/
OWASP Top 10:2021 & 2025 - category numbering changes (A02 → A04): https://owasp.org/Top10/A02_2021-Cryptographic_Failures/ and https://owasp.org/www-project-top-10-for-large-language-model-applications/
Nmap Reference Guide - scan-type semantics (-sS, -sT, -sN, -sI, -A): https://nmap.org/book/man.html
Local CEH project - 00-master-strategy.md §“Common Failure Modes”, 01-exam-logistics.md (cut-score note), practice/01-03-mcq-set-*.md (150 cross-referenced MCQs).