Overview
Domain 1 is the foundation the rest of CEH builds on. It introduces information security concepts, the elements of security such as confidentiality, integrity and availability, the classes of threats and attacks, and the structured phases every engagement follows: reconnaissance, scanning, gaining access, maintaining access and clearing tracks. It covers the frameworks used to describe attacker behavior, including the Cyber Kill Chain, MITRE ATT&CK and the Diamond Model, and the idea of tactics, techniques and procedures. It also covers the information security laws, standards and ethics that govern lawful testing, and the role of authorization.
In CEH v13, this overview is where the AI theme is introduced before it is applied across the later modules. The domain is small by weight but it provides the vocabulary and the phase model that organize all the hands-on content in Domains 2 to 9.
How it's tested
Questions in this domain are mostly definitional and classification-based. They ask which phase an activity belongs to, which attack category or framework fits a description, or what makes testing lawful. They are among the more straightforward questions on the exam, so they are points worth securing.
-
Name the phase
An activity is described, and you must place it in the correct phase of the five-phase model.
-
Classify the attack or framework
A behavior or model is described, and you must identify the attack category or the framework, such as the Cyber Kill Chain or ATT&CK.
-
Lawful or not
A testing situation is described, and you must decide what makes it authorized and ethical.
A tester gathers employee names from LinkedIn and company subdomains from public DNS records before touching any system. Asked which phase this is, note that nothing has been scanned or accessed yet. Collecting information about a target without interacting with its systems is reconnaissance, specifically passive reconnaissance, the first of the five phases.
Domains 1
Official domains from the EC-Council outline, in outline order.
1.1 Introduction to Ethical HackingSecurity concepts, attack classes, the five phases, frameworks, laws and ethics.
- What it means
- This module covers the elements of information security (confidentiality, integrity, availability, authenticity and non-repudiation), classes of threats and attack types, the cyber kill chain methodology and frameworks such as MITRE ATT&CK, the five phases of ethical hacking (reconnaissance, scanning, gaining access, maintaining access, clearing tracks), hacker classes, and the laws, standards and ethics that govern ethical hacking.
- What to understand
- The five phases are the backbone of the whole certification, and each later domain expands one or more of them. An ethical hacker does the same things as an attacker but only with written authorization and within an agreed scope. The Cyber Kill Chain describes an intrusion as stages, while ATT&CK is a matrix of tactics and techniques.
- How it shows up
- You must place an activity in the right phase, classify an attack or framework, or identify what makes an engagement lawful and ethical.
- Common confusion
- Confusing scanning with reconnaissance. Passive reconnaissance gathers information without touching the target, while scanning actively probes it.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Five phases of hacking
Reconnaissance, scanning, gaining access, maintaining access, clearing tracks.
- Remember
- They map onto the later domains in order.
- Tested as
- Phase identification questions.
- Trap
- Placing active scanning in the reconnaissance phase.
-
CIA triad
Confidentiality, integrity and availability, the core security goals.
- Remember
- Most attacks target one of the three.
- Tested as
- Concept questions.
- Trap
- Overlooking availability as a security goal.
-
Passive vs. active reconnaissance
Passive gathers information without contacting the target; active probes it directly.
- Remember
- Passive is stealthier and comes first.
- Tested as
- Phase and method questions.
- Trap
- Calling direct scanning passive.
-
Cyber Kill Chain
An intrusion described as stages from reconnaissance to actions on objectives.
- Remember
- Breaking any stage can stop the attack.
- Tested as
- Framework questions.
- Trap
- Confusing it with the five phases of ethical hacking.
-
MITRE ATT&CK
A knowledge base of adversary tactics and techniques.
- Remember
- It is a matrix, not a linear sequence.
- Tested as
- Framework questions.
- Trap
- Treating it as ordered stages.
-
Tactics, techniques and procedures (TTPs)
The patterns of behavior an attacker uses.
- Remember
- TTPs are harder for attackers to change than tools or indicators.
- Tested as
- Behavioral analysis questions.
- Trap
- Confusing a technique with a tool.
-
Hacker classes
Black hat, white hat, grey hat and others defined by intent and authorization.
- Remember
- Authorization is what separates a white hat from a black hat.
- Tested as
- Definition questions.
- Trap
- Defining classes by skill rather than intent and authorization.
-
Authorization
Written permission that makes testing lawful.
- Remember
- Without it, the same actions are crimes.
- Tested as
- Ethics and legal questions.
- Trap
- Assuming skill or good intent substitutes for authorization.
-
Defense in depth
Layered security controls so no single failure is fatal.
- Remember
- It combines prevention, detection and response.
- Tested as
- Concept questions.
- Trap
- Relying on a single strong control.
-
Information security laws and standards
Regulations and standards such as PCI DSS, HIPAA and ISO/IEC 27001 that shape testing.
- Remember
- They set obligations and limits on testing.
- Tested as
- Compliance questions.
- Trap
- Ignoring legal limits on testing activities.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Five phases of ethical hacking vs. Cyber Kill Chain
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Five phases | Reconnaissance, scanning, gaining access, maintaining access, clearing tracks | The CEH engagement model | Confusing it with the Kill Chain |
| Cyber Kill Chain | Reconnaissance, weaponization, delivery, exploitation, installation, C2, actions on objectives | A broader intrusion model | Treating the two as identical |
Passive vs. active reconnaissance
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Passive | Gather information without contacting the target | Stealthy, low risk of detection | Including direct scans |
| Active | Probe the target directly | More detail, detectable | Using it when stealth is required |
White hat vs. grey hat vs. black hat
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| White hat | Authorized, ethical tester | Has permission | Confusing with grey hat |
| Grey hat | Acts without clear authorization but not maliciously | Ambiguous authorization | Treating it as fully legal |
| Black hat | Malicious, unauthorized attacker | No permission, harmful intent | Defining by skill rather than intent |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Scanning is recon
- What candidates pick
- Classify active port scanning as reconnaissance.
- Why it looks right
- Both gather information about a target.
- Why it's wrong
- Reconnaissance gathers information passively or indirectly; scanning actively probes systems and is a separate phase.
Clue to watch for The activity sends packets to or interacts with the target.
-
Kill Chain equals five phases
- What candidates pick
- Treat the Cyber Kill Chain and the five phases as the same model.
- Why it looks right
- Both describe attack steps.
- Why it's wrong
- They are different models with different stages and purposes.
Clue to watch for The question names one model specifically.
-
Skill defines the hat
- What candidates pick
- Call a highly skilled hacker a white hat.
- Why it looks right
- Skill seems to define expertise.
- Why it's wrong
- Authorization and intent define the class, not skill level.
Clue to watch for The scenario describes permission or intent.
-
Intent replaces authorization
- What candidates pick
- Treat well-intentioned testing without permission as acceptable.
- Why it looks right
- The tester means well.
- Why it's wrong
- Without written authorization, the activity is unlawful regardless of intent.
Clue to watch for No authorization is mentioned.
-
ATT&CK is linear
- What candidates pick
- Treat MITRE ATT&CK as an ordered sequence.
- Why it looks right
- It resembles the staged Kill Chain.
- Why it's wrong
- ATT&CK is a matrix of tactics and techniques, used in any order.
Clue to watch for The question involves mapping techniques rather than stages.
-
CIA is only confidentiality
- What candidates pick
- Focus only on confidentiality when identifying the security goal at risk.
- Why it looks right
- Confidentiality is the most discussed goal.
- Why it's wrong
- Integrity and availability are equally part of the triad, and many attacks target them.
Clue to watch for The scenario describes tampering or an outage.
Answer framework
For any Domain 1 scenario, use these steps to find the answer CEH expects.
- Identify which of the five phases the described activity belongs to, from reconnaissance through to clearing tracks.
- Distinguish passive from active techniques, because passive reconnaissance does not touch the target while scanning does.
- Match any framework mentioned to its purpose, keeping the Cyber Kill Chain, the five phases and MITRE ATT&CK distinct.
- Identify which element of the CIA triad an attack threatens, considering integrity and availability as well as confidentiality.
- Confirm that the activity is authorized and lawful, since authorization and intent, not skill, define ethical hacking, confirming the activity stays within the authorized scope and the agreed rules.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as the map for the whole exam. Start by memorizing the five phases and then, for each, note which later domains expand it: reconnaissance leads into Domain 2, gaining access into Domains 3, 5 and others, and so on. This turns the twenty modules into a coherent sequence rather than a flat list.
Next, learn the frameworks precisely. Keep the five phases, the Cyber Kill Chain and MITRE ATT&CK distinct, since the exam tests whether you can tell them apart. Learn the CIA triad and the other security elements, and the hacker classes defined by intent and authorization.
Finally, study the laws, standards and ethics. These questions are usually straightforward, so they are easy points. Because this domain is only 6%, do not over-invest, but do not skip it either, as its vocabulary underpins the scenario questions throughout the exam. Afterwards, move to Domain 2, the first hands-on phase.
FAQ
How much of CEH v13 is Domain 1?
Information Security and Ethical Hacking Overview is about 6% of the exam, roughly seven of the 125 questions, under EC-Council Blueprint v5.0.
What are the five phases of ethical hacking?
Reconnaissance, scanning, gaining access, maintaining access and clearing tracks. They form the backbone of the whole certification.
Is the Cyber Kill Chain the same as the five phases?
No. The five phases are CEH's engagement model. The Cyber Kill Chain is a separate intrusion model with stages from reconnaissance to actions on objectives.
What makes hacking ethical?
Written authorization and lawful intent within an agreed scope. The same techniques performed without permission are crimes.
Does CEH v13 cover AI in this domain?
The AI theme is introduced here and then applied across the later modules, rather than isolated in its own domain. EC-Council integrated AI across all five phases.
Is Domain 1 hard?
It is among the more straightforward domains, being mostly definitional. It is worth securing fully because the points are attainable and the concepts support every other domain.
How does Domain 1 connect to the rest of the exam?
It supplies the phase model, frameworks and vocabulary that organize the hands-on content in Domains 2 to 9.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 1 knowledge
You have covered the five phases, the main attack categories, the frameworks and the laws and ethics of ethical hacking. Test whether you can classify activities and frameworks under exam conditions.