Examius

🇺🇸 Certified Ethical Hacker (CEH) · subject

Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance Syllabus

The Introduction to Ethical Hacking and Reconnaissance syllabus for Certified Ethical Hacker (CEH) in full: 3 chapters, 12 topics and 31 sub-topics, every one listed below, plus 51 Introduction to Ethical Hacking and Reconnaissance flashcards with answers.

3Chapters
12Topics
31Sub-topics
51Flashcards

Introduction to Ethical Hacking and Reconnaissance syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Information Security Fundamentals

     4 topics
    • Core Security Concepts
      • CIA triad: confidentiality, integrity, availability
      • Authenticity and non-repudiation
      • Defense-in-depth and security layers
    • Threats, Vulnerabilities, and Attack Vectors
      • Threat categories: network, host, application
      • Attack classifications: passive, active, insider, close-in
      • Information warfare concepts
    • Cyber Kill Chain and Attack Frameworks
      • Lockheed Martin Cyber Kill Chain stages
      • MITRE ATT&CK tactics and techniques
      • TTPs and indicators of compromise
    • Hacker Classes and Ethical Hacking
      • Black, white, gray hat and other actor types
      • Phases of hacking: recon, scanning, gaining access, maintaining access, clearing tracks
      • Scope and limitations of ethical hacking

  2. Information Security Controls and Laws

     3 topics
    • Defense Strategies and Risk Management
      • Risk assessment and risk matrix
      • Threat modeling and threat intelligence
      • Incident management lifecycle
    • Standards and Compliance
      • PCI DSS, HIPAA, SOX, GDPR
      • ISO/IEC 27001 and NIST frameworks
    • Cyber Laws and Penetration Testing Process
      • US laws: CFAA, DMCA
      • Rules of engagement and authorization
      • Pen test phases and reporting

  3. Footprinting and Reconnaissance

     5 topics
    • Footprinting Methodology and OSINT
      • Passive vs active footprinting
      • Open-source intelligence gathering objectives
    • Search Engine and Web-Based Footprinting
      • Google dorking and advanced operators
      • Shodan, Censys, and IoT search engines
      • Web archives and cached pages
    • Network and DNS Footprinting
      • WHOIS, DNS interrogation, zone transfers
      • Traceroute and network range discovery
    • Email, Social Media, and People Footprinting
      • Email header analysis and tracking
      • Social media intelligence and people search
    • Footprinting Tools and Countermeasures
      • Recon-ng, Maltego, theHarvester, FOCA
      • Footprinting countermeasures

Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance flashcards — 51 questions with answers

  1. What are the three core principles of the CIA triad in information security?

    Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed).

  2. In addition to the CIA triad, what two elements complete the five-element security model?

    Authenticity (verifying genuineness of users/data) and Non-repudiation (ensuring a party cannot deny an action).

  3. Define a threat, a vulnerability, and a risk, and give the conceptual risk formula.

    A threat is a potential cause of an unwanted event; a vulnerability is a weakness that a threat can exploit; risk is the likelihood and impact of a threat exploiting a vulnerability. Risk = Threat x Vulnerability x Impact (or Likelihood x Impact).

  4. What is an attack vector versus an attack surface?

    An attack vector is the path or means an attacker uses to gain access (e.g., phishing, malware); the attack surface is the total sum of all vulnerable points/entry points exposed to attackers.

  5. List the main categories of security threats by source.

    Network threats, host threats, and application threats; by origin they are categorized as internal (insider) and external threats, plus natural/physical threats.

  6. What is the difference between a zero-day vulnerability and a known vulnerability?

    A zero-day is a flaw unknown to the vendor with no available patch, exploitable before disclosure; a known vulnerability has been disclosed and typically has a patch or mitigation available.

  7. Name the seven phases of the Lockheed Martin Cyber Kill Chain in order.

    1) Reconnaissance, 2) Weaponization, 3) Delivery, 4) Exploitation, 5) Installation, 6) Command and Control (C2), 7) Actions on Objectives.

  8. What does the MITRE ATT&CK framework document, and how does it differ from the Cyber Kill Chain?

    MITRE ATT&CK is a knowledge base of real-world adversary Tactics, Techniques, and Procedures (TTPs) mapped in a matrix; unlike the linear Kill Chain, it is non-sequential and granular, detailing how attackers operate at each tactic.

  9. In the Cyber Kill Chain, what happens during the Weaponization phase?

    The attacker couples an exploit with a backdoor/payload into a deliverable (e.g., a malicious PDF or Office document) to create the weapon, without yet interacting with the target.

  10. What is TTP in the context of adversary behavior?

    Tactics (the adversary's goals/why), Techniques (how the goal is achieved), and Procedures (the specific implementation/steps) used to describe attacker behavior.

  11. Differentiate between Black Hat, White Hat, and Gray Hat hackers.

    Black Hats use skills illegally for malicious/personal gain; White Hats (ethical hackers) use skills legally with permission to improve security; Gray Hats operate between the two, sometimes acting without authorization but without malicious intent.

  12. What are Script Kiddies, Hacktivists, and Suicide Hackers?

    Script Kiddies are unskilled attackers using prebuilt tools; Hacktivists hack to promote a political/social agenda; Suicide Hackers aim to cause damage regardless of getting caught or punished.

  13. What is the difference between a State-Sponsored hacker and a Cyber Terrorist?

    State-Sponsored hackers are employed by governments to penetrate/damage rival nations' systems; Cyber Terrorists are motivated by religious/political beliefs to create fear or large-scale disruption.

  14. What is ethical hacking and what is its defining requirement?

    Ethical hacking is the authorized practice of bypassing system security to identify vulnerabilities using attacker techniques; its defining requirement is explicit permission/scope from the system owner (a legal authorization).

  15. Name the five phases of hacking.

    1) Reconnaissance, 2) Scanning, 3) Gaining Access, 4) Maintaining Access, 5) Clearing Tracks (covering tracks).

  16. What is the difference between active and passive reconnaissance?

    Passive reconnaissance gathers information without directly interacting with the target (e.g., public records, OSINT); active reconnaissance directly engages the target (e.g., probing, scanning) and risks detection.

  17. What are the three primary types of security controls by function?

    Preventive (stop incidents, e.g., firewalls), Detective (identify incidents, e.g., IDS), and Corrective (restore after incidents, e.g., backups). Categories by nature: technical, administrative, and physical.

  18. What is Defense in Depth?

    A layered security strategy using multiple, redundant defensive mechanisms so that if one control fails, others continue to protect assets.

  19. List the four main risk treatment/management strategies.

    Risk Avoidance (eliminate the activity), Risk Mitigation/Reduction (apply controls), Risk Transference (e.g., insurance/outsourcing), and Risk Acceptance (acknowledge and retain the risk).

  20. What is the difference between a Red Team, a Blue Team, and a Purple Team?

    Red Team simulates attackers (offense); Blue Team defends and responds (defense); Purple Team facilitates collaboration between Red and Blue to improve overall security posture.

Show the other 31 Introduction to Ethical Hacking and Reconnaissance flashcards

  1. What are the key phases of Incident Handling and Response (IH&R)?

    Preparation, Incident Recording/Assignment, Triage, Notification, Containment, Evidence Gathering/Forensics, Eradication, Recovery, and Post-Incident (lessons learned).

  2. What does the CVSS measure and what is its score range?

    The Common Vulnerability Scoring System (CVSS) measures the severity of vulnerabilities on a scale of 0.0 to 10.0, using Base, Temporal, and Environmental metric groups.

  3. What is the CVE and who maintains it?

    Common Vulnerabilities and Exposures (CVE) is a publicly disclosed list of standardized identifiers for known security vulnerabilities, maintained by MITRE.

  4. What is the purpose of the PCI DSS standard and to whom does it apply?

    Payment Card Industry Data Security Standard (PCI DSS) protects cardholder data; it applies to any organization that stores, processes, or transmits credit/debit card information.

  5. What does HIPAA regulate and in what sector?

    The Health Insurance Portability and Accountability Act (HIPAA) regulates the protection and confidential handling of protected health information (PHI) in the U.S. healthcare sector.

  6. What is the difference between ISO/IEC 27001 and the NIST Cybersecurity Framework?

    ISO/IEC 27001 is an international certifiable standard specifying requirements for an Information Security Management System (ISMS); the NIST CSF is a U.S. voluntary framework of guidelines organized around Identify, Protect, Detect, Respond, and Recover.

  7. What does SOX (Sarbanes-Oxley Act) regulate?

    SOX mandates financial record accuracy and internal controls for U.S. public companies, requiring data integrity and protection of financial reporting systems.

  8. What U.S. law primarily criminalizes unauthorized access to computer systems?

    The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, criminalizes unauthorized access and exceeding authorized access to protected computers.

  9. What does GDPR regulate and what is the maximum fine?

    The EU General Data Protection Regulation (GDPR) governs personal data protection/privacy of EU residents; maximum fines are up to 20 million euros or 4% of annual global turnover, whichever is higher.

  10. What is the difference between Black Box, White Box, and Gray Box penetration testing?

    Black Box: tester has no prior knowledge of the target; White Box: tester has full knowledge (source code, architecture); Gray Box: tester has partial/limited knowledge.

  11. What are the main phases of the penetration testing process?

    Pre-engagement (scoping/agreement), Reconnaissance/Information Gathering, Scanning/Enumeration, Vulnerability Analysis, Exploitation/Gaining Access, Post-Exploitation, and Reporting.

  12. Why is a 'Rules of Engagement' (RoE) document essential before a penetration test?

    The RoE legally defines scope, targets, allowed techniques, timing, and limitations, providing authorization that protects the tester and prevents unauthorized/out-of-scope actions.

  13. What is footprinting and what are its two main types?

    Footprinting is the first step of gathering information about a target's network/systems; its two types are passive (no direct contact, OSINT) and active (direct interaction with the target).

  14. What does OSINT stand for and what does it involve?

    Open Source Intelligence (OSINT) involves collecting information from publicly available sources such as websites, social media, search engines, public records, and metadata.

  15. List four key objectives of footprinting for an attacker.

    Collect network information (IP ranges, domains), system information (OS, services), organizational information (employees, structure), and identify the attack surface/security posture.

  16. What is Google Dorking (Google Hacking)?

    Using advanced Google search operators to find sensitive information, exposed files, login pages, or vulnerabilities indexed by search engines (queries are cataloged in the Google Hacking Database / GHDB).

  17. What does the Google operator 'site:' do, and give an example combined with 'filetype:'.

    'site:' restricts results to a specific domain. Example: 'site:example.com filetype:pdf' returns only PDF files indexed on example.com.

  18. What does the Google 'inurl:' operator do?

    It restricts results to pages whose URL contains the specified term, e.g., 'inurl:admin' to find admin pages.

  19. How can the Wayback Machine (archive.org) aid web footprinting?

    It stores historical snapshots of websites, letting an attacker view old pages, removed content, prior structures, and exposed information no longer on the live site.

  20. What is a WHOIS lookup used for in footprinting?

    WHOIS queries domain registration databases to reveal registrant details, contact info, registrar, name servers, and domain creation/expiry dates.

  21. What information can DNS footprinting reveal, and which tool retrieves DNS records?

    It reveals host names, IP addresses, mail servers, and network structure via DNS records; tools include nslookup, dig, and host.

  22. Match these DNS record types to their function: A, MX, NS, CNAME, PTR, SOA.

    A = maps hostname to IPv4; MX = mail exchange server; NS = authoritative name server; CNAME = alias to another name; PTR = reverse lookup (IP to name); SOA = Start of Authority (zone admin info).

  23. What is a DNS zone transfer (AXFR) and why is it a security concern?

    A zone transfer replicates a full DNS zone database between servers; if misconfigured to allow anyone, an attacker can obtain a complete list of hosts/records, mapping the entire network.

  24. What does the traceroute/tracert utility reveal during network footprinting?

    It maps the path packets take to a target, revealing intermediate hops/routers, network topology, and the geographic/logical route, aiding network mapping.

  25. What is email footprinting and what does an email header reveal?

    Email footprinting analyzes email headers to extract sender IP, mail servers, routing path, timestamps, and originating geolocation; email tracking tools can also confirm if/when a message was read.

  26. How is social media used in footprinting?

    Attackers mine platforms like LinkedIn, Facebook, and X for employee names, roles, technologies used, locations, relationships, and personal details to enable social engineering or password guessing.

  27. What is people search / personnel footprinting?

    Using people-search engines and public records to gather personal data (phone, address, email, employer) about individuals for social engineering or targeting.

  28. What does the Maltego tool do in reconnaissance?

    Maltego is an OSINT and link-analysis tool that visually maps relationships between people, domains, infrastructure, and organizations gathered from many data sources.

  29. What information does the Shodan search engine provide to a footprinter?

    Shodan indexes Internet-connected devices and reveals open ports, running services, banners, IoT devices, webcams, and exposed systems by IP/service.

  30. What is theHarvester used for?

    theHarvester is an OSINT tool that gathers emails, subdomains, hosts, employee names, and open ports/banners from public sources and search engines.

  31. List four key countermeasures against footprinting.

    Restrict information published publicly (web/social media), enforce privacy on WHOIS and disable DNS zone transfers to untrusted hosts, configure web servers to avoid info leakage, and train employees on social engineering and OSINT awareness.

Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance FAQ

What is in the Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance syllabus?

Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance is split into 3 chapters: Information Security Fundamentals, Information Security Controls and Laws and Footprinting and Reconnaissance. Together they contain 12 topics and 31 sub-topics.

How many chapters are in Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance?

3 chapters, containing 12 topics and 31 sub-topics. The largest chapter is Footprinting and Reconnaissance, with 5 topics.

Are there flashcards for Certified Ethical Hacker (CEH) Introduction to Ethical Hacking and Reconnaissance?

Yes — a 51-card Introduction to Ethical Hacking and Reconnaissance deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.