ExamFinch.com My Study

Study guide

1.5 The CEH Domains & Your Study Priority Map

Practice this exam

EC-Council Certified Ethical Hacker CEH

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map

2 Reconnaissance, Footprinting, Scanning & Enumeration

2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures

3 Vulnerability Analysis & System Hacking Phases

3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection

4 Malware Threats, Sniffing & Social Engineering

4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses

5 Network & Perimeter Hacking

5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders

6 Web Server & Web Application Hacking

6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts

7 Wireless Network Hacking

7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures

8 Mobile Platform, IoT & OT Hacking

8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security

9 Cloud Computing & Cryptography

9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices

1.5 The CEH Domains & Your Study Priority Map

Key Takeaways Explain This Topic AI

The CEH v13 blueprint defines 9 official domains; Network and Perimeter Hacking is the single largest at 24%

Reconnaissance Techniques (17%) and System Hacking Phases and Attack Techniques (15%) are the next priorities — with the 24% domain they are 56% of the exam

Information Security and Ethical Hacking Overview (this chapter) is 6% — small in weight but it underpins every other domain's vocabulary

The 9 blueprint domains and the 20 training modules describe the same content at two levels of granularity

Allocate study hours roughly in proportion to domain weight, then re-weight upward for your weakest practice areas

Last updated: June 2026

The 9 Official CEH Domains

The CEH v13 exam blueprint organizes the 125 questions into nine domains , each with an official weight. Use the weights as a study-time budget: the exam rewards depth in the heaviest domains.

  • # Domain Weight Covered In This Guide
  • 1 Information Security and Ethical Hacking Overview 6% Chapter 1 (this chapter)
  • 2 Reconnaissance Techniques 17% Reconnaissance, Footprinting, Scanning & Enumeration
  • 3 System Hacking Phases and Attack Techniques 15% Vulnerability Analysis & System Hacking Phases
  • 4 Network and Perimeter Hacking 24% Network & Perimeter Hacking
  • 5 Web Application Hacking 14% Web Server & Web Application Hacking (incl. SQL Injection)
  • 6 Wireless Network Hacking 5% Wireless Network Hacking
  • 7 Mobile Platform, IoT, and OT Hacking 10% Mobile Platform, IoT & OT Hacking
  • 8 Cloud Computing 5% Cloud Computing & Cryptography
  • 9 Cryptography 5% Cloud Computing & Cryptography

Malware, sniffing, and social-engineering content in this guide supports the System Hacking and Network/Perimeter domains, where those attack techniques are assessed.

Domains vs. the 20 Modules

Do not confuse the 9 weighted domains (how the exam is scored) with the 20 training modules (how the course is taught). They cover the same material at different granularity: e.g., the single Reconnaissance Techniques domain (17%) spans the Footprinting, Scanning, and Enumeration modules, while Network and Perimeter Hacking (24%) absorbs the Sniffing, Social Engineering, DoS, Session Hijacking, and Evasion (IDS/Firewall/Honeypot) modules. Studying by domain weight is the efficient way to budget; studying by module is the efficient way to learn techniques.

Weight Distribution

CEH v13 Domain Weight Distribution (%)

How to Budget Study Time

The top three domains — Network and Perimeter Hacking (24%) , Reconnaissance Techniques (17%) , and System Hacking Phases and Attack Techniques (15%) — total 56% of the exam. Master these and stay competent everywhere else and you clear the cut score comfortably.

A proportional starting plan:

Spend roughly half your time on the top three domains. They have the most questions and the most interconnected concepts (ports, Nmap, sniffing, system hacking).

Give the 14% Web Application domain solid coverage. Injection (especially SQL injection ), the OWASP-style flaw classes, and web-server attacks are dense and heavily tested.

Do not skip the three 5% domains. Wireless, Cloud, and Cryptography are individually small but collectively 15% — easy points if you know the core concepts (WPA2/WPA3, the cloud shared-responsibility model, symmetric vs. asymmetric keys, hashing).

Treat this 6% Overview domain as the glue. Low weight, but its vocabulary (CIA triad, threat/vuln/risk, the five phases, authorization, hacker classes) is assumed in every other domain's questions.

Re-weight toward your weak areas. After a full-length practice test, add time to your lowest-scoring domains regardless of blueprint weight — a 45% score anywhere leaves easy points on the table.

Mapping Domains to the Five Phases

The domains are not random — most expand a phase from Section 1.2:

  • Reconnaissance Techniques -> Phase 1 (Recon) + Phase 2 (Scanning/Enumeration)
  • System Hacking Phases -> Phase 3 (Gaining Access) + Phase 4 (Maintaining Access) + Phase 5 (Clearing Tracks)

Network/Perimeter, Web, Wireless, Mobile-IoT-OT, Cloud -> attack surfaces and techniques used across Phases 2-4

Cryptography -> cross-cutting; it protects confidentiality and integrity and is attacked across phases

Thinking in phases keeps the large blueprint coherent instead of a flat list of 20 modules to memorize, and it tells you which countermeasure a question is really asking about.

A Concrete Four-Week Study Map

Weights translate into a workable schedule. For a typical four-week sprint of full-length practice plus targeted review:

  • Week Focus (by domain weight) Why
  • 1 This Overview chapter + Reconnaissance (17%) Lock the vocabulary, then the biggest non-network domain

2 Network & Perimeter (24%) — ports, Nmap, sniffing, IDS/firewall/honeypot evasion The single largest slice; most interconnected

3 System Hacking (15%) + Web Application (14%) Password attacks, privilege escalation, SQL injection, OWASP-class flaws

4 Mobile/IoT/OT (10%) + the three 5% domains + full-length mocks Mop up the smaller domains and re-weight to weak areas

This front-loads the 24% + 17% + 15% triad (56% of the exam) while still guaranteeing every domain is touched. Reserve the last few days exclusively for timed, full-length practice so you internalize the ~1m55s-per-question pace.

High-Yield Quick Facts to Anchor

Regardless of domain, a handful of facts recur often enough to be worth memorizing cold: well-known ports (FTP 21, SSH 22, Telnet 23, SMTP 25, DNS 53, HTTP 80, HTTPS 443, SMB 445), the five phases in order, the CIA triad mapping, and the difference between symmetric and asymmetric cryptography. These anchor points let you reason out unfamiliar questions instead of guessing blindly.

A final scoring reality check: because the cut score floats between 60% and 85% by form, you should not aim for the minimum. Treat 80% on full-length, mixed-domain practice as your readiness signal. If you are passing the 24%/17%/15% triad consistently and not bombing any single 5% domain, you have built the margin needed to clear whatever form you are assigned on test day.