C)PEH Requirements 2026: Eligibility, Prerequisites & How to Qualify

What "Requirements" Actually Means for C)PEH

When people search for C)PEH requirements, they usually want to know one thing: what must I have done before I am allowed to sit the exam? For the Certified Professional Ethical Hacker credential from Mile2, the honest answer is more relaxed than most candidates expect. The issuer lists suggested preparation, not a hard eligibility wall. There is no verified requirement for a college degree, a professional reference, a minimum number of classroom hours, or a signed work-history attestation.

That does not mean the exam is easy to walk into cold. It means the gatekeeping is done by the content rather than by paperwork. The requirements that matter are the ones you impose on yourself: enough networking fluency, enough security vocabulary, and enough hands-on familiarity with tools to handle 100 multiple-choice questions spanning reconnaissance, cryptography, web attacks, exploitation, and reporting.

This article separates three layers so you can plan accurately: the issuer's suggested background, the exam's formal mechanics, and the practical knowledge you need to actually pass. If you want a broader orientation first, see What Is C)PEH Certification? before returning here.

Confirming You Are Chasing the Right Credential

Before you spend money, make sure the credential you are researching is the one you want. Several certifications in the security world use similar acronyms or similar-sounding names, and a surprising amount of online content blends them together. The credential covered on this site is the Mile2 Certified Professional Ethical Hacker, official designation C)PEH. Mile2 is both the governing and administering body.

It is not the same thing as EC-Council's CEH, not a GAQM exam, and not Mile2's own penetration-testing credentials such as C)PTE or C)PTE-A. Each of those has its own requirements, pricing, and curriculum. If a forum post, reseller page, or practice-question site quotes fees, domain weights, or pass rates, check which certification and which issuer it is actually describing. Requirements facts in particular do not transfer between credentials.

The Suggested Background: Three Routes In

Mile2's credential documentation recommends that candidates hold any one of the following before attempting the exam:

• Mile2 C)SP, the issuer's own security-fundamentals-level certification.
• 12 months of IT experience in any capacity that exposes you to systems, support, or administration.
• 12 months of networking experience, such as supporting routers, switches, firewalls, or network troubleshooting.

Read that list carefully: it is "any one," not "all three," and it is framed as a suggestion. Nothing in the verified material says Mile2 audits your employment history or blocks registration if you have none of the three. The suggestion exists because the exam presumes you already understand how networks and operating systems behave. Without that, the Reconnaissance & Enumeration and Exploitation and Post-Exploitation material becomes memorization instead of understanding.

Which route fits which candidate

If you are in the last two rows, treat the suggested background as a self-assessment checklist. Can you explain what happens during a TCP handshake? Can you describe why a hash is not encryption? If those questions feel uncomfortable, build the foundation before booking.

What the Exam Asks of You

The formal exam requirements are straightforward. The written examination consists of 100 multiple-choice questions with a time allowance of approximately two hours, and a minimum passing grade of 70%. It is delivered online through Mile2's learning-management system. Mile2's security page identifies the platform as LearnDash and describes a two-hour timed window that cannot be paused, so plan to sit the whole thing in one uninterrupted block.

Several things the published material does not say are worth knowing. The split between scored and unscored questions is not published. No official percentage allocation by topic has been verified, and no current exam-version identifier has been confirmed, so any source claiming to know which area is "weighted highest" is guessing. Likewise, there is no verified separate hands-on performance exam in the C)PEH specification. The labs that appear in Mile2's materials belong to the training course, not to the exam.

The curriculum your questions are drawn from

The current Mile2 course outline lists eleven headings: a course introduction plus ten substantive modules. They are best understood as preparation-curriculum headings, not as eleven officially weighted exam domains and not as an exhaustive blueprint. The headings are:

1. Course Introduction
2. Introduction to Ethical Hacking
3. Cybersecurity Foundation
4. Reconnaissance & Enumeration
5. Cryptography
6. Vulnerability Scanning & Analysis
7. Web and Application Attacks
8. Exploitation and Post-Exploitation
9. Social Engineering
10. Wireless Pentesting
11. Reporting & Ethics

For a section-by-section walkthrough of what each heading covers, read C)PEH Exam Domains 2026: Complete Guide to All 11 Content Areas. Older reseller and academy pages sometimes show a 16-module list; those belong to earlier course versions and should not be mixed with the current outline.

Fees, the Exam Combo, and What Is Not Included

Money is a requirement too, so it helps to understand what you are actually buying. Mile2's public search index shows the C)PEH Exam Combo at a sale price of $500, against an original list price of $795. The Combo bundles an exam, a simulator or practice resource, a preparation guide, and two attempts. It is not the full training package.

Two cautions apply. First, the price was visible in the public search index but not exposed in the retrieved body of the dynamic product page, so confirm the live checkout amount before you commit. Second, a separately listed C)PEH Electronic Book Kit (indexed at $400) is preparation material, not an exam fee. No member versus nonmember pricing tier is published.

Mile2 expressly permits testing without purchasing its course, so a full training package is not a prerequisite. That makes the Combo the leanest official path for experienced candidates. A full cost walkthrough lives in C)PEH Certification Cost 2026: Complete Pricing Breakdown.

Proctoring and Open-Book: What Is and Is Not Settled

This is the area where Mile2's own documents do not line up neatly, so be careful about what you assume. The FAQ indicates that most standard exams can start on demand without a live-proctor appointment, naming other credentials (C)ISSO-A and C)PTE-A) as exceptions. The broader Policies and Procedures document (dated May 26, 2026) describes LearnDash delivery, an open-book exam, live camera and screen proctoring scheduled at least 48 hours ahead, randomized items, the ability to return to skipped questions, and immediate results. That document also says some exams require a proctor, and it is not reconciled with the FAQ for the standard C)PEH product.

The same policies describe identification requirements, accommodations, and a 30-day wait before a third attempt. No C)PEH-specific adaptive-testing or calculator rule was verified. For scheduling logistics and timing, see C)PEH Exam Dates 2026.

The Knowledge You Need to Qualify in Practice

Since formal eligibility is light, the real requirement is competence across the curriculum. Here are the areas that tend to separate prepared candidates from underprepared ones.

Also budget time for Exploitation and Post-Exploitation, Social Engineering, and Wireless Pentesting. The cover of the outline spells the latter "Wireless Pentesting" while the detailed section prints "Wireless Pen testing"; both refer to the same module. Because no official weighting is published, treat all eleven headings as fair game rather than gambling on a favorite.

Sequencing Your Preparation Around the Curriculum

You do not need an elaborate method here; you need a sensible order. The curriculum builds from concepts to attacks to documentation, so study in that direction. A reasonable four-week arrangement for someone meeting the suggested background:

For a deeper resource plan, see C)PEH Study Guide 2026: How to Pass on Your First Attempt. When you are ready to test yourself under time pressure, the C)PEH practice tests mirror the multiple-choice style. Remember that third-party question banks are not authenticated real exam content, so use them to find weak areas, not to predict specific questions.

After You Pass: Validity and Renewal Requirements

Qualifying is not a one-time event. The credential is valid for three years. Current central renewal guidance describes 60 documented qualifying CEUs across the three-year cycle (commonly expressed as 20 per year), purchase of the applicable renewal product, seven Code of Ethics questions, and agreement to current policies. There is no annual membership requirement. The FAQ gives a U.S. standard CEU-route renewal price of $200, with eligible developing-region pricing potentially as low as $100, subject to confirmation at checkout.

Mile2 also publishes alternative renewal paths, including an exam-based route that involves passing the latest relevant exam, which may cost more. Here the sources diverge. The C)PEH course PDF describes both a current-exam pass and annual CEUs as requirements, while the central renewal pages present them as alternative paths. The May 2026 policy mentions a recertification assessment and completion within seven days of expiry, and its sections are not consistent on what happens after that window. Do not assume a universal seven-day grace entitlement, and do not equate an unspecified recertification assessment with either the full 100-question exam or the seven-question ethics acknowledgment.

Ultimate Combo course access and any included exam voucher are generally valid for one year, which is distinct from the three-year credential life; Cyber Range access can have a shorter separate term. Use your voucher within its window.

Who Benefits From the Credential

Because the eligibility bar is modest, the C)PEH suits people moving into security from IT or networking roles: system administrators, network engineers, and junior security analysts building toward offensive-security work. Its value to an employer is largely as evidence that you understand the full attack lifecycle and the ethics around it, from scoping through reporting.

Be cautious with salary claims. Mile2's outline advertises $80,077 in annual salary potential, but without a dated credential-holder sample or stated methodology; that is issuer marketing, not a verified 2026 average or proof that the credential caused a pay premium. For a balanced look, read C)PEH Salary Guide 2026 and Is the C)PEH Certification Worth It?. Note too that Mile2's policy identifies C)ISSO-A and C)PTE-A as ANAB-accredited offerings, but that does not establish accreditation for the standard C)PEH.

If you are comparing job outcomes, C)PEH Jobs explores the roles where this credential tends to be listed.

Frequently Asked Questions