- Use only systems you own, administer, or have written permission to test.
- Build an isolated lab before running reconnaissance, scanning, or exploitation tools.
- Treat CEH v12 exam 312-50 as a skills map, not a shortcut to unsupervised testing.
Last updated: 2026. CEH is the Certified Ethical Hacker certification from EC-Council, an entry-level ethical hacking credential that introduces techniques for identifying, validating, and reporting security weaknesses in controlled environments. For beginners in Belgium and the wider EU, the key problem is turning curiosity into lawful, disciplined practice: documenting findings, keeping labs safe, and mapping each exercise to the CEH v12 exam objectives.
CEH v12, associated with exam 312-50, covers areas such as footprinting, scanning, enumeration, vulnerability analysis, system hacking concepts, malware threats, web application security, cloud, and IoT. Those topics are relevant because junior security work often begins with evidence gathering: confirming whether an exposed service is real, interpreting scan results, checking whether an alert matches known behaviour, and escalating findings clearly.
Legal and ethical boundaries in Belgium and the EU
Ethical hacking begins with permission. In Belgium, unauthorised access, interference, or data extraction can create criminal and civil risk under Belgian computer crime rules, even if the intention is educational. In the EU, GDPR also matters because a test can expose personal data, logs, identifiers, or account details that must be handled lawfully and minimised wherever possible.
The practical rule is simple: written authorisation defines what can be tested, when testing can happen, which methods are allowed, and how findings should be reported. A beginner should never scan public IP ranges, company systems, school networks, cloud tenants, Wi-Fi networks, or third-party websites without explicit permission from the owner. Bug bounty programmes and capture-the-flag platforms are safer only when their scope is read carefully and followed exactly.
This article is educational and does not provide legal advice. The Centre for Cybersecurity Belgium, NIST SP 800-115, OWASP Top 10, and EC-Council’s CEH exam blueprint are useful reference points for understanding responsible testing concepts, but they do not replace written permission or local legal guidance. A lawful practice habit is a career skill in its own right, because security teams value analysts who can work within scope and produce defensible evidence.
What CEH is good for at beginner level
CEH is often positioned as a hacking certification, but beginners should read it as a structured introduction to attacker techniques and defensive validation. It helps learners understand how reconnaissance differs from footprinting, why enumeration produces more useful evidence than a raw port list, and how exploitation risk is assessed before any intrusive action is taken.
It is also important to choose the right credential for the intended direction. CEH v12 is strongest when the learner wants ethical hacking and penetration testing fundamentals across topics such as scanning, enumeration, web applications, cloud, and IoT. Security+ is broader and more defensive, while eJPT is commonly associated with hands-on junior penetration testing practice. A learner aiming for SOC Tier 1 triage or vulnerability management can still benefit from CEH, provided the study plan includes lab evidence and not only theory.
In real junior roles, CEH skills rarely appear as unsupervised hacking assignments. They more often support alert triage, vulnerability scan verification, asset exposure checks, basic web application observations, and assistance on guided penetration tests. For example, a SOC analyst may use port and service knowledge to assess whether an alert involving an exposed remote access service is plausible, while a vulnerability management analyst may confirm whether a scanner finding reflects the service actually running on the host.
Building a safe CEH home lab
A beginner lab should be boring by design. It should be isolated, reversible, and documented before any tools are launched. VirtualBox and VMware Workstation Player are common choices because they allow learners to run Kali Linux alongside intentionally vulnerable virtual machines without touching production systems or public targets.
The safest pattern is to create a host-only or internal virtual network, place Kali Linux and one vulnerable VM on that network, and disable bridging to the home or office LAN unless there is a clear reason. Snapshots should be taken before major exercises so the learner can roll back after misconfiguration, failed exploitation attempts, or accidental service changes. This also makes repetition easier, which matters more than speed in the first months of CEH preparation.
Practice targets should come from lawful training environments. Intentionally vulnerable VMs, TryHackMe rooms, Hack The Box beginner labs, and vendor-provided lab environments are designed for this purpose, as long as the learner stays within the platform rules. Internet-wide scanning is a common beginner mistake because it feels like reconnaissance practice, but it quickly moves outside safe educational boundaries and creates noise for other organisations.
Another common mistake is poor evidence collection. Beginners often run a tool, see interesting output, and move on without saving the command, timestamp, target, result, and interpretation. A better habit is to keep a lab journal with screenshots, packet captures, scan outputs, and short explanations. Any screenshots later used in a portfolio should be sanitised and given descriptive alt text, such as “Nmap service scan of isolated vulnerable VM showing ports 22 and 80 open.”
First hands-on exercise: Nmap scanning
Nmap is useful for CEH practice because it teaches the difference between discovering a host, identifying open ports, and interpreting services. In a legal lab, the target should be a private IP address assigned to a vulnerable VM on an isolated network. The example below assumes Kali Linux can reach a lab machine at 192.168.56.20.
Example — Identify open services on an isolated lab VM
nmap -sS -sV -oN ceh-lab-nmap.txt 192.168.56.20
Starting Nmap
Nmap scan report for 192.168.56.20
Host is up.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH
80/tcp open http Apache httpd
The command performs a SYN scan and attempts basic service version detection, then saves the result to a text file. The learning objective is not to attack the services immediately, but to ask better questions: whether the host is expected, whether SSH and HTTP should be exposed, whether the versions are current, and what additional authorisation would be needed before deeper testing.
This maps directly to CEH scanning and enumeration objectives. Scanning identifies reachable services; enumeration seeks more detail about those services, such as banners, directories, users, shares, or application behaviour. In professional work, that distinction matters because a port scan alone is rarely enough evidence to support a finding.
Second hands-on exercise: Wireshark and packet evidence
Wireshark helps beginners understand what tools do on the network. Capturing packets during a lab scan shows the relationship between a command and the traffic it generates. That makes the learner less dependent on automated output and better prepared to explain findings during an interview or a technical review.
Example — Capture traffic from a lab scan with tshark
sudo tshark -i eth0 -f "host 192.168.56.20" -a duration:60 -w ceh-lab-capture.pcapng
This command captures packets for sixty seconds on the selected interface and writes them to a pcapng file that can be opened in Wireshark. The interface name may differ by system, so the learner should verify it before starting. The useful exercise is to run the Nmap scan during the capture window, then inspect the SYN packets, responses, and any service negotiation that follows.
Packet analysis also reinforces ethical boundaries. Capturing traffic on a shared or corporate network can expose other people’s data and may breach policy or law. In a CEH beginner lab, packet captures should be limited to the isolated environment and stored only as long as needed for learning and documentation.
A 30-60-90 day study plan for CEH v12
A realistic CEH study plan should combine theory, labs, and reporting habits from the beginning. Beginners who leave hands-on work until the final weeks often recognise tool names but struggle to interpret output. The plan below assumes steady weekly practice rather than full-time study.
| Period |
Main focus |
Practical output |
| Days 1-30 |
Networking fundamentals, Linux basics, lab setup, legal scoping, footprinting, and scanning. |
An isolated VM lab, saved snapshots, first Nmap notes, and a short written scope for every exercise. |
| Days 31-60 |
Enumeration, vulnerability analysis, web application basics, OWASP Top 10 categories, and packet inspection. |
Annotated scan outputs, Wireshark captures, simple web testing notes, and evidence that distinguishes observation from conclusion. |
| Days 61-90 |
Review across CEH v12 domains, timed practice, reporting, remediation language, and weak-area labs. |
A sanitised lab portfolio with selected write-ups, screenshots, commands used, results, and lessons learned. |
Tool themes can rotate weekly: one week for Nmap, one for Wireshark, one for web proxy concepts, one for password and authentication concepts, and one for reporting. The aim is to build fluency without treating tools as magic. A learner should be able to explain what was sent, what came back, why it matters, and what permission was in place.
Structured training can help when a learner needs deadlines, guided labs, and alignment to the current exam blueprint. Readynez covers CEH through an EC-Council Certified Ethical Hacker course, and learners comparing related options can also review EC-Council training paths or a subscription model such as Unlimited Security Training. The decision should come after the learner has understood the time commitment and the need for hands-on practice.
Beginner pitfalls that slow CEH progress
The most damaging beginner error is practising on targets that are outside scope. Even a simple scan can be interpreted as hostile when it reaches systems the learner does not own or have permission to test. The second error is relying on automated tools without understanding the traffic, assumptions, and false positives behind the output.
Skipping environment isolation is another avoidable problem. A bridged VM can accidentally interact with a home router, office network, or cloud-connected service. Snapshots, host-only networking, and clear VM naming reduce confusion and make experiments easier to repeat.
Finally, many beginners underinvest in notes. Hiring teams in Belgium and across the EU rarely need to see dramatic lab claims; they need to see careful thinking. A sanitised portfolio with a few clear write-ups can support interviews for SOC Tier 1, junior vulnerability management, and assisted penetration testing roles because it shows process, restraint, and communication.
Lab troubleshooting for beginners
When a lab does not work, the cause is usually ordinary networking or resource pressure rather than an advanced security issue. If Kali cannot reach the vulnerable VM, the first checks should be whether both machines are on the same virtual network, whether the target has an IP address, and whether host-only or internal networking is configured consistently. A simple ping may help, although some targets block ICMP, so an Nmap ping scan or ARP table check can be more informative in a local lab.
Slow scans often come from low VM memory, high host CPU usage, or packet loss inside the virtual network. Closing unnecessary applications, assigning reasonable RAM, and using snapshots before major changes can prevent repeated rebuilds. If a tool output looks strange, the learner should verify the target IP, rerun the command with a saved output file, and compare the result with a packet capture before assuming the target is vulnerable.
Exam and career considerations in Belgium
Belgian and EU candidates should verify CEH exam logistics directly with EC-Council or the authorised exam delivery route they use. Online proctoring may require identity checks, a suitable testing space, system checks, and compliance with proctoring rules. Payment currency, VAT treatment, rescheduling, and retake conditions can vary by route and should be confirmed before booking rather than assumed from older study notes or forum posts.
From a career perspective, CEH is more useful when paired with evidence of disciplined practice. A CV line that says “CEH preparation” is weaker than a short portfolio showing scoped lab work, scan interpretation, packet analysis, and a concise remediation recommendation. In interviews, beginners should be prepared to explain why a test was lawful, what the tool actually did, what evidence was collected, and what they would escalate to a senior analyst.
Where CEH skills fit next
CEH preparation gives beginners a vocabulary for offensive security, but its strongest value comes when the learner applies that vocabulary responsibly. The practical next step is to keep the lab small, repeat exercises until the output makes sense, and turn every finding into a short report with scope, evidence, risk, and remediation notes.
Readynez can support that path through structured CEH preparation, but the certification should sit alongside lawful practice habits, careful documentation, and realistic role expectations. Those habits are what turn beginner hacking exercises into credible security skills.
FAQ
What is CEH and why is it useful for beginners?
CEH stands for Certified Ethical Hacker. It is useful for beginners because it introduces common attacker techniques in a structured way, including reconnaissance, scanning, enumeration, vulnerability analysis, and basic exploitation concepts. The value is strongest when the learner practises in a lawful lab and learns to explain the evidence behind each result.
Can beginners practise CEH skills legally in Belgium?
Yes, but only within clear boundaries. Beginners should practise on systems they own, intentionally vulnerable lab machines, authorised training platforms, or targets covered by written permission. Public systems, company networks, school networks, and random internet hosts should not be scanned or tested without explicit authorisation.
Nmap and Wireshark are sensible first tools because they teach service discovery and packet-level evidence. After that, learners can move into web testing concepts, vulnerability scanning, and controlled exploitation labs. The important habit is to understand what each tool does rather than collecting tool names.
How can beginners protect themselves while learning CEH?
They should use isolated virtual networks, keep snapshots, avoid testing outside scope, update their lab systems, and separate lab accounts from personal accounts. They should also avoid storing real personal data in lab exercises and should keep notes sanitised if they plan to use them in a portfolio.
What common mistakes should CEH beginners avoid?
The biggest mistakes are scanning systems without permission, using automated tools without understanding the output, skipping lab isolation, and failing to keep useful notes. A careful beginner should be able to show the authorised scope, command used, result observed, and conclusion drawn from the evidence.
