CEH study guide · 2026

The 9 CEH domains, explained

9 domains and 21 official domains. Network and Perimeter Hacking carries the most weight at 24%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
125
Time
4 hours
Passing score
Approximately 70% (cut score varies by exam form, 60–85%)
Outline
CEH Exam Blueprint v5.0, effective April 2024, carried into CEH v13 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 6%
  2. 2 17%
  3. 3 15%
  4. 4 24%
  5. 5 14%
  6. 6 5%
  7. 7 10%
  8. 8 5%
  9. 9 5%
  1. 1 Information Security and Ethical Hacking Overview
  2. 2 Reconnaissance Techniques
  3. 3 System Hacking Phases and Attack Techniques
  4. 4 Network and Perimeter Hacking
  5. 5 Web Application Hacking
  6. 6 Wireless Network Hacking
  7. 7 Mobile Platform, IoT, and OT Hacking
  8. 8 Cloud Computing
  9. 9 Cryptography

All 9 domains

21 official domains 115–170 hrs suggested study

  1. Domain 01 6%

    Information Security and Ethical Hacking Overview

    This domain sets the framework for the whole CEH exam. It covers the five phases of ethical hacking, the main attack categories, the frameworks such as the Cyber Kill Chain and MITRE ATT&CK, and the laws and ethics that separate an ethical hacker from a criminal.

    Inside this domain

    • Introduction to Ethical Hacking

    Watch for Scanning is recon

    Domains
    1
    Questions est.
    ~8
    Study time est.
    5–10 hrs
  2. Domain 02 17%

    Reconnaissance Techniques

    Reconnaissance Techniques is the second-largest CEH domain. It covers the first three modules of the methodology: footprinting and reconnaissance, scanning networks, and enumeration, building the detailed map every later attack depends on.

    Inside this domain

    • Footprinting and Reconnaissance
    • Scanning Networks
    • Enumeration

    Watch for Connect for stealth

    Domains
    3
    Questions est.
    ~21
    Study time est.
    20–25 hrs
  3. Domain 03 15%

    System Hacking Phases and Attack Techniques

    This domain covers gaining and keeping access to systems. It spans three modules: vulnerability analysis, the system hacking methodology, and malware threats, from first foothold through privilege escalation to maintaining access and covering tracks.

    Inside this domain

    • Vulnerability Analysis
    • System Hacking
    • Malware Threats

    Watch for Crack before reusing

    Domains
    3
    Questions est.
    ~19
    Study time est.
    20–25 hrs
  4. Domain 04 24%

    Network and Perimeter Hacking

    Network and Perimeter Hacking is the single largest CEH domain. It covers five modules: sniffing, social engineering, denial-of-service, session hijacking, and evading IDS, firewalls and honeypots, the techniques that attack and bypass network defenses.

    Inside this domain

    • Sniffing
    • Social Engineering
    • Denial-of-Service
    • Session Hijacking
    • and 1 more domains

    Watch for Wrong sniffing attack

    Domains
    5
    Questions est.
    ~30
    Study time est.
    30–40 hrs
  5. Domain 05 14%

    Web Application Hacking

    Web Application Hacking covers attacking the web tier: hacking web servers, hacking web applications, and SQL injection. SQL injection and the web app testing methodology are where candidates most often lose points.

    Inside this domain

    • Hacking Web Servers
    • Hacking Web Applications
    • SQL Injection

    Watch for WAF fixes injection

    Domains
    3
    Questions est.
    ~18
    Study time est.
    15–25 hrs
  6. Domain 06 5%

    Wireless Network Hacking

    Wireless Network Hacking is a small but deceptive CEH domain. It covers wireless encryption standards, the wireless hacking methodology, specific attacks such as the evil twin, Bluetooth attacks, and the countermeasures that secure wireless networks.

    Inside this domain

    • Hacking Wireless Networks

    Watch for WPA2 is most secure

    Domains
    1
    Questions est.
    ~6
    Study time est.
    5–10 hrs
  7. Domain 07 10%

    Mobile Platform, IoT, and OT Hacking

    This domain covers three device worlds: mobile platforms, the Internet of Things, and operational technology. The OT subsection is the main trap, because OT inverts the usual security priorities to put availability and safety first.

    Inside this domain

    • Hacking Mobile Platforms
    • IoT Hacking
    • OT Hacking

    Watch for Patch the ICS now

    Domains
    3
    Questions est.
    ~12
    Study time est.
    10–15 hrs
  8. Domain 08 5%

    Cloud Computing

    Cloud Computing is a small but deep CEH domain. It covers cloud concepts and models, the shared responsibility model, container and serverless technology, common cloud attacks, and the controls that defend cloud environments.

    Inside this domain

    • Cloud Computing

    Watch for Provider secures the data

    Domains
    1
    Questions est.
    ~6
    Study time est.
    5–10 hrs
  9. Domain 09 5%

    Cryptography

    Cryptography is the smallest CEH domain by weight but, per question, the one candidates score worst on. It covers encryption algorithms, hashing, PKI, disk and email encryption, and the cryptanalysis attacks the exam tests in detail.

    Inside this domain

    • Cryptography

    Watch for Hash for confidentiality

    Domains
    1
    Questions est.
    ~6
    Study time est.
    5–10 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 115–170 hrs of study.

  1. 4 Network and Perimeter Hacking 24% · 30–40 hrs
  2. 2 Reconnaissance Techniques 17% · 20–25 hrs
  3. 3 System Hacking Phases and Attack Techniques 15% · 20–25 hrs
  4. 5 Web Application Hacking 14% · 15–25 hrs
  5. 7 Mobile Platform, IoT, and OT Hacking 10% · 10–15 hrs
  6. 1 Information Security and Ethical Hacking Overview 6% · 5–10 hrs
  7. 6 Wireless Network Hacking 5% · 5–10 hrs
  8. 8 Cloud Computing 5% · 5–10 hrs
  9. 9 Cryptography 5% · 5–10 hrs

Try one

Practice questionDomain 4: Network and Perimeter Hacking

An attacker on a switched network wants to intercept traffic between two hosts. They send forged ARP replies so that both hosts associate the attacker's MAC address with each other's IP address. Which countermeasure MOST directly stops this attack?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Scanning is recon

    Clue The activity sends packets to or interacts with the target.

  • Domain 2

    Connect for stealth

    Clue The requirement is stealth or avoiding logs.

  • Domain 3

    Crack before reusing

    Clue Captured hashes and a time or stealth constraint are mentioned.

  • Domain 4

    Wrong sniffing attack

    Clue The description is about the switch table filling up versus forged ARP replies.

  • Domain 5

    WAF fixes injection

    Clue The question asks for the best long-term remediation.

  • Domain 6

    WPA2 is most secure

    Clue The question asks for the most secure option.

  • Domain 7

    Patch the ICS now

    Clue The system is OT, ICS or SCADA running a live process.

  • Domain 8

    Provider secures the data

    Clue The leak comes from a misconfigured access policy.

Other Cybersecurity certifications

Study guides for exams that overlap with CEH.

Practise what you read

CEH domains: common questions

How many domains are in the CEH exam?

CEH has 9 domains with 21 official domains between them: Information Security and Ethical Hacking Overview, Reconnaissance Techniques, System Hacking Phases and Attack Techniques, Network and Perimeter Hacking, Web Application Hacking, Wireless Network Hacking, Mobile Platform, IoT, and OT Hacking, Cloud Computing and Cryptography.

Which CEH domain carries the most weight?

Network and Perimeter Hacking is the heaviest at 24%, followed by Reconnaissance Techniques (17%). The lightest is Cryptography (5%). Weights come from EC-Council's official outline.

What is the CEH exam format?

Questions: 125. Time allowed: 4 hours. Passing score: Approximately 70% (cut score varies by exam form, 60–85%).

How long should I study for CEH?

Our planning estimate is 115–170 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Network and Perimeter Hacking, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CEH Exam Blueprint v5.0, effective April 2024, carried into CEH v13 (current), published by EC-Council. It was last reviewed in October 2026.

Domain names, weights and domains come from EC-Council's official outline (CEH Exam Blueprint v5.0, effective April 2024, carried into CEH v13 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.