Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance Syllabus

Introduction to Ethical Hacking and Reconnaissance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Introduction to Ethical Hacking and Reconnaissance in Certified Ethical Hacker (CEH), not a summary of it.

1. 1

   Information Security Fundamentals

   4 topics

   • Core Security Concepts
     • CIA triad: confidentiality, integrity, availability
     • Authenticity and non-repudiation
     • Defense-in-depth and security layers
   • Threats, Vulnerabilities, and Attack Vectors
     • Threat categories: network, host, application
     • Attack classifications: passive, active, insider, close-in
     • Information warfare concepts
   • Cyber Kill Chain and Attack Frameworks
     • Lockheed Martin Cyber Kill Chain stages
     • MITRE ATT&CK tactics and techniques
     • TTPs and indicators of compromise
   • Hacker Classes and Ethical Hacking
     • Black, white, gray hat and other actor types
     • Phases of hacking: recon, scanning, gaining access, maintaining access, clearing tracks
     • Scope and limitations of ethical hacking
2. 2

   Information Security Controls and Laws

   3 topics

   • Defense Strategies and Risk Management
     • Risk assessment and risk matrix
     • Threat modeling and threat intelligence
     • Incident management lifecycle
   • Standards and Compliance
     • PCI DSS, HIPAA, SOX, GDPR
     • ISO/IEC 27001 and NIST frameworks
   • Cyber Laws and Penetration Testing Process
     • US laws: CFAA, DMCA
     • Rules of engagement and authorization
     • Pen test phases and reporting
3. 3

   Footprinting and Reconnaissance

   5 topics

   • Footprinting Methodology and OSINT
     • Passive vs active footprinting
     • Open-source intelligence gathering objectives
   • Search Engine and Web-Based Footprinting
     • Google dorking and advanced operators
     • Shodan, Censys, and IoT search engines
     • Web archives and cached pages
   • Network and DNS Footprinting
     • WHOIS, DNS interrogation, zone transfers
     • Traceroute and network range discovery
   • Email, Social Media, and People Footprinting
     • Email header analysis and tracking
     • Social media intelligence and people search
   • Footprinting Tools and Countermeasures
     • Recon-ng, Maltego, theHarvester, FOCA
     • Footprinting countermeasures

Introduction to Ethical Hacking and Reconnaissance flashcards for Certified Ethical Hacker (CEH)

23 of 51 cards from the Introduction to Ethical Hacking and Reconnaissance deck — real questions with worked answers.

1. What are the three core principles of the CIA triad in information security?

   Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

2. In addition to the CIA triad, what two elements complete the five-element security model?

   Authenticity (verifying genuineness of users/data) and Non-repudiation (ensuring a party cannot deny an action).

3. Define a threat, a vulnerability, and a risk, and give the conceptual risk formula.

   A threat is a potential cause of an unwanted event; a vulnerability is a weakness that a threat can exploit; risk is the likelihood and impact of a threat exploiting a vulnerability. Risk = Threat x Vulnerability x Impact (or Likelihood x Impact).

4. What is an attack vector versus an attack surface?

   An attack vector is the path or means an attacker uses to gain access (e.g., phishing, malware); the attack surface is the total sum of all vulnerable points/entry points exposed to attackers.

5. List the main categories of security threats by source.

   Network threats, host threats, and application threats; by origin they are categorized as internal (insider) and external threats, plus natural/physical threats.

6. What is the difference between a zero-day vulnerability and a known vulnerability?

   A zero-day is a flaw unknown to the vendor with no available patch, exploitable before disclosure; a known vulnerability has been disclosed and typically has a patch or mitigation available.

7. Name the seven phases of the Lockheed Martin Cyber Kill Chain in order.

   1) Reconnaissance, 2) Weaponization, 3) Delivery, 4) Exploitation, 5) Installation, 6) Command and Control (C2), 7) Actions on Objectives.

8. What does the MITRE ATT&CK framework document, and how does it differ from the Cyber Kill Chain?

   MITRE ATT&CK is a knowledge base of real-world adversary Tactics, Techniques, and Procedures (TTPs) mapped in a matrix; unlike the linear Kill Chain, it is non-sequential and granular, detailing how attackers operate at each tactic.

9. In the Cyber Kill Chain, what happens during the Weaponization phase?

   The attacker couples an exploit with a backdoor/payload into a deliverable (e.g., a malicious PDF or Office document) to create the weapon, without yet interacting with the target.

10. What is TTP in the context of adversary behavior?

    Tactics (the adversary's goals/why), Techniques (how the goal is achieved), and Procedures (the specific implementation/steps) used to describe attacker behavior.

11. Differentiate between Black Hat, White Hat, and Gray Hat hackers.

    Black Hats use skills illegally for malicious/personal gain; White Hats (ethical hackers) use skills legally with permission to improve security; Gray Hats operate between the two, sometimes acting without authorization but without malicious intent.

12. What are Script Kiddies, Hacktivists, and Suicide Hackers?

    Script Kiddies are unskilled attackers using prebuilt tools; Hacktivists hack to promote a political/social agenda; Suicide Hackers aim to cause damage regardless of getting caught or punished.

13. What is the difference between a State-Sponsored hacker and a Cyber Terrorist?

    State-Sponsored hackers are employed by governments to penetrate/damage rival nations' systems; Cyber Terrorists are motivated by religious/political beliefs to create fear or large-scale disruption.

14. What is ethical hacking and what is its defining requirement?

    Ethical hacking is the authorized practice of bypassing system security to identify vulnerabilities using attacker techniques; its defining requirement is explicit permission/scope from the system owner (a legal authorization).

15. Name the five phases of hacking.

    1) Reconnaissance, 2) Scanning, 3) Gaining Access, 4) Maintaining Access, 5) Clearing Tracks (covering tracks).

16. What is the difference between active and passive reconnaissance?

    Passive reconnaissance gathers information without directly interacting with the target (e.g., public records, OSINT); active reconnaissance directly engages the target (e.g., probing, scanning) and risks detection.

17. What are the three primary types of security controls by function?

    Preventive (stop incidents, e.g., firewalls), Detective (identify incidents, e.g., IDS), and Corrective (restore after incidents, e.g., backups). Categories by nature: technical, administrative, and physical.

18. What is Defense in Depth?

    A layered security strategy using multiple, redundant defensive mechanisms so that if one control fails, others continue to protect assets.

19. List the four main risk treatment/management strategies.

    Risk Avoidance (eliminate the activity), Risk Mitigation/Reduction (apply controls), Risk Transference (e.g., insurance/outsourcing), and Risk Acceptance (acknowledge and retain the risk).

20. What is the difference between a Red Team, a Blue Team, and a Purple Team?

    Red Team simulates attackers (offense); Blue Team defends and responds (defense); Purple Team facilitates collaboration between Red and Blue to improve overall security posture.

21. What are the key phases of Incident Handling and Response (IH&R)?

    Preparation, Incident Recording/Assignment, Triage, Notification, Containment, Evidence Gathering/Forensics, Eradication, Recovery, and Post-Incident (lessons learned).

22. What does the CVSS measure and what is its score range?

    The Common Vulnerability Scoring System (CVSS) measures the severity of vulnerabilities on a scale of 0.0 to 10.0, using Base, Temporal, and Environmental metric groups.

23. What is the CVE and who maintains it?

    Common Vulnerabilities and Exposures (CVE) is a publicly disclosed list of standardized identifiers for known security vulnerabilities, maintained by MITRE.

See more Introduction to Ethical Hacking and Reconnaissance flashcards →

Planning Introduction to Ethical Hacking and Reconnaissance for Certified Ethical Hacker (CEH)

Introduction to Ethical Hacking and Reconnaissance (Certified Ethical Hacker (CEH)) FAQ