- C)PEH stands for Certified Professional Ethical Hacker, a credential administered by Mile2, not EC-Council or GAQM.
- The written exam has 100 multiple-choice questions, roughly two hours, and a 70% minimum passing grade.
- The linked curriculum has 11 unweighted headings, Module 00 through Module 10, not 11 official exam domains.
- Credential validity is three years; renewal guidance centers on 60 CEUs, but sources conflict on details.
What the Letters Actually Mean
C)PEH stands for Certified Professional Ethical Hacker. The leading "C)" is Mile2's naming convention: every credential in the family opens with that bracketed letter, and the rest of the acronym names the role. An ethical hacker, in this context, is a practitioner who tests systems with the owner's written permission, using the same techniques an attacker would, and then documents what was found so it can be fixed.
If you have arrived here from a search for the acronym alone, you may have seen similarly spelled credentials from other organizations. This page is about one thing only: the Mile2 Certified Professional Ethical Hacker. Anything you read elsewhere about exam fees, domain percentages, or pass rates for a differently owned certification should not be applied to this one. For other angles on the same question, see our companion explainers on what C)PEH stands for and what C)PEH is.
Who Issues It and Who Does Not
The governing and administering body is Mile2, and the official designation is C)PEH. That sentence matters because the ethical hacking space is crowded with look-alike names, and candidates regularly buy the wrong prep material. To be explicit, this credential is not GAQM's CPEH-001, not EC-Council's CEH, and not Mile2's own C)PTE or C)PTE-A, which are separate penetration-testing credentials.
| Credential | Relationship to this article |
|---|---|
| Mile2 C)PEH (Certified Professional Ethical Hacker) | The subject of this article |
| EC-Council CEH | Different issuer; do not reuse its fees, domains, or pass statistics |
| GAQM CPEH-001 | Different issuer; separate exam and policies |
| Mile2 C)PTE / C)PTE-A | Same issuer, different credentials; not interchangeable with C)PEH |
The practical consequence: when you search for study material, verify that it is built around Mile2's C)PEH outline. A question bank written for a different ethical hacking exam may overlap in topic names while differing in emphasis and wording. If you are weighing the two most commonly confused paths, our difficulty guide discusses how the C)PEH experience should be judged on its own terms.
What the Exam Looks Like
The credential PDF describes a written exam of 100 multiple-choice questions with an allotted time of approximately two hours and a minimum passing grade of 70%. Delivery is online through Mile2's learning-management system. Mile2's course and exam security page identifies that platform as LearnDash and describes a two-hour timed window that cannot be paused, so plan to sit the exam in one uninterrupted block.
Some details Mile2 has not published: how many of the 100 items are scored versus unscored, and any official per-topic weighting. Because of that, any claim that a particular topic "makes up X% of the exam" is unsupported. Treat all curriculum areas as potentially testable and distribute your effort accordingly. Our page on the C)PEH passing score covers how the 70% threshold translates into raw questions.
The proctoring and open-book question
This is the area where Mile2's own documents do not line up cleanly, so candidates should be cautious about forum certainty. The current FAQ says most standard exams can be started on demand without a live-proctor appointment, naming C)ISSO-A and C)PTE-A as exceptions. The broader Policies and Procedures document (dated May 26, 2026) describes LearnDash delivery, an open-book exam, live camera and screen proctoring scheduled at least 48 hours ahead, randomized items, the ability to return to skipped questions, and immediate results. That policy contains internal wording differences about whether some exams or all proctored administrations are covered, and its exact application to the standard C)PEH product is not reconciled with the FAQ.
The honest takeaway is that you should not assume either an unproctored session or a live-proctored one, and you should not assume an unrestricted open-book policy. Ask Mile2 or confirm in your booking flow before test day. The policy also describes identification requirements, accommodations, and a 30-day wait before a third attempt. For scheduling realities, see C)PEH exam dates and scheduling.
The Curriculum Behind the Name
The seven-page CPEH Web Outline PDF linked from Mile2's course outline page lists Module 00 (Course Introduction) plus ten substantive modules. We present them here as 11 preparation-curriculum headings. They are unweighted, and they are not a verified exhaustive exam blueprint. You may also encounter older reseller or academy listings that show 16 modules; those lists reflect earlier packaging and are not carried into this scope.
| # | Heading | What it covers conceptually |
|---|---|---|
| 1 | Course Introduction | Orientation to the program and its lab environment |
| 2 | Introduction to Ethical Hacking | Purpose, authorization, and how testing differs from attack |
| 3 | Cybersecurity Foundation | Core networking and security concepts everything else assumes |
| 4 | Reconnaissance & Enumeration | Gathering target information and listing services and accounts |
| 5 | Cryptography | Encryption, hashing, and key concepts as they affect testing |
| 6 | Vulnerability Scanning & Analysis | Finding and prioritizing weaknesses |
| 7 | Web and Application Attacks | Web, application, and API weaknesses |
| 8 | Exploitation and Post-Exploitation | Gaining and using access in authorized scope |
| 9 | Social Engineering | Human-focused attack paths |
| 10 | Wireless Pentesting | Wireless network assessment |
| 11 | Reporting & Ethics | Documenting findings and professional conduct |
A note on spelling: the outline's cover uses "Wireless Pentesting" while the detailed section prints "Wireless Pen testing." Both refer to the same module. For a deeper walk through each heading, read our guide to all 11 content areas.
Concrete Skills Behind Each Heading
Knowing the heading names is the easy part. What candidates struggle with is understanding what each area is really asking. The following blocks translate the curriculum into things you should be able to explain in your own words.
Reconnaissance & Enumeration
Reconnaissance is the discipline of learning about a target before touching it in any way that could be noticed, and enumeration is the follow-up of actively listing what is there.
- Distinguish passive information gathering (public records, search engines, DNS data) from active probing that sends traffic to the target.
- Explain why enumeration of services, shares, and accounts converts a vague target into a specific attack surface.
- Know that scope and written authorization decide which of these activities is permitted at all.
Cryptography
You are not being asked to design ciphers; you are being asked to recognize how cryptographic choices create or close attack paths.
- Separate symmetric from asymmetric approaches and explain where each is typically used.
- Understand hashing as one-way integrity checking, and why storing passwords without proper protection is a finding.
- Recognize that weak configuration, such as outdated protocols or poor key handling, often matters more than the algorithm name.
Vulnerability Scanning & Analysis
A scanner produces a list; an analyst produces a decision. The skill being tested is judgment.
- Explain why raw scanner output contains false positives that must be validated.
- Prioritize by combining severity with exposure and business impact rather than sorting by score alone.
- Understand how public weakness catalogs such as CWE help classify root causes consistently.
Web and Application Attacks
This heading reaches into OWASP-style web risks and API weaknesses.
- Be able to describe injection, broken authentication, and access-control failures in plain language and name how each is detected.
- Understand that APIs expose the same classes of flaw as web pages, often with weaker input handling.
- Connect each weakness to a mitigation, because the exam values remediation understanding alongside attack understanding.
Reporting & Ethics
The last heading is easy to under-study and shouldn't be.
- Know what belongs in a professional finding: evidence, impact, reproduction detail, and a fix recommendation.
- Understand authorization, scope limits, and why exceeding them turns a test into an offense.
- Appreciate that how you handle discovered sensitive data is part of the professional standard.
Cost, Attempts, and Access
Pricing for Mile2 products is dynamic, and the retrieved product-page body did not expose live amounts, so treat everything below as indicative and confirm at checkout. The official public search index showed the C)PEH Exam Combo at $500 sale, $795 original list. The Combo includes an exam, a simulator or practice resource, a preparation guide, and two attempts. It is not the full training package.
A separately listed C)PEH Electronic Book Kit was indexed at $400; that is preparation material, not an examination fee, and its checkout amount was likewise not independently confirmed. Mile2 does not publish a member versus non-member tier. Per the FAQ, once both included attempts are used, two additional attempts require another retail purchase. Third-party training providers charge their own prices, which reflect instruction and are not the issuer's exam fee. Our C)PEH certification cost breakdown lays these layers out side by side.
Also note the difference between access windows and credential life. Ultimate Combo course access and its included exam voucher are generally good for one year, which is distinct from the three-year validity of the credential itself. Cyber Range access can carry a shorter, separate term.
Validity and Renewal
A C)PEH is valid for three years. Current central renewal guidance describes 60 documented qualifying CEUs over the cycle (commonly expressed as 20 per year), purchase of the applicable renewal product, seven Code of Ethics questions, and agreement to current policies. The FAQ gives a U.S. standard CEU-route renewal price of $200, with eligible developing-region pricing potentially as low as $100, subject to checkout or issuer confirmation. There is no annual membership requirement. Exam-based renewal may cost more, and CEU evidence is described on Mile2's qualifying-CEUs page.
Here is where candidates need to be careful. The Renewal Paths page publishes CEU-based and exam-based alternatives, including passing the latest relevant exam. The C)PEH course PDF, however, describes both a current-exam pass and annual CEUs as requirements. The May 2026 policy adds a recertification assessment and mentions completion within seven days of expiry, while its sections differ on whether the full certification exam is required after that period.
Key Takeaway
Do not treat an unspecified recertification assessment as either the full 100-question exam or the seven-question ethics acknowledgment. Confirm your renewal route and deadline with Mile2 before your expiry date, and do not rely on any assumed grace period.
Accreditation is another place to avoid overreach: the policy identifies C)ISSO-A and C)PTE-A as ANAB-accredited offerings, but it does not establish that accreditation for the standard C)PEH.
Career Context and Salary Claims
Ethical hacking skills feed into roles such as penetration tester, security analyst, vulnerability analyst, and red-team support. Employers in that space typically look at demonstrated technical ability and practical experience alongside any certification, and a single credential should not be expected to decide a hiring outcome by itself. We discuss the realistic job landscape in C)PEH jobs.
On salary, the undated course outline advertises $80,077 annual salary potential. That figure is issuer marketing: it has no dated credential-holder sample and no stated methodology, so it is not a verified 2026 average for C)PEH holders and it does not demonstrate that the credential causes higher pay. Read it as a promotional reference point, then consult our salary guide and the worth-it analysis for how to weigh it.
The same caution applies to pass rates. Mile2 has not published a C)PEH pass rate that we could verify, and a training vendor's success guarantee is not a credential pass rate. See what the data shows on pass rate for the details.
Sequencing Your Preparation
Because the curriculum is unweighted, the sensible approach is to build foundations first and spend extra time where the vocabulary is densest. A simple order that follows the dependency chain of the curriculum:
Foundations
- Cover Introduction to Ethical Hacking and Cybersecurity Foundation; everything later assumes this vocabulary.
- Review networking basics if your 12 months of IT or networking experience is thin.
Discovery and Cryptography
- Work through Reconnaissance & Enumeration and Cryptography together, since recon findings often feed crypto-related weaknesses.
Weakness Finding and Attack Surfaces
- Study Vulnerability Scanning & Analysis, then Web and Application Attacks, including OWASP, CWE, and API concepts.
Access, People, Radio, and Reporting
- Cover Exploitation and Post-Exploitation, Social Engineering, Wireless Pentesting, and Reporting & Ethics.
- Finish with timed practice sets under a two-hour limit.
That order is a suggestion, not an official schedule; adjust it to your background. For a fuller plan and resource list, read the C)PEH study guide, keep the cheat sheet handy for last-day review, and use realistic, timed questions from the practice test site to rehearse the 100-question format. Be aware that third-party question banks are not authenticated real exam content, so use them to test understanding rather than to memorize wording.
Frequently Asked Questions
It stands for Certified Professional Ethical Hacker, a credential from Mile2. It is distinct from EC-Council's CEH, GAQM's CPEH-001, and Mile2's C)PTE and C)PTE-A.
The credential PDF describes 100 multiple-choice questions in approximately two hours, with a minimum passing grade of 70%. The scored versus unscored split is not published.
Mile2's own documents differ. The FAQ suggests most standard exams start on demand without a live-proctor appointment, while the May 2026 policy describes open-book delivery with scheduled live proctoring. Confirm the current rule for your booking before test day.
No. Mile2 expressly permits testing without purchasing its course. Suggested preparation is the C)SP credential or 12 months of IT or networking experience, but these are not verified mandatory requirements.
It is valid for three years. Central guidance describes 60 documented CEUs, the applicable renewal product, and seven Code of Ethics questions, with exam-based alternatives also published. Sources differ on details, so confirm your route and deadline with Mile2 before expiry.