Overview
Domain 7 covers hacking and securing three categories of device across three modules. Hacking mobile platforms covers Android and iOS attack vectors, mobile malware, jailbreaking and rooting, mobile device management and app security. IoT hacking covers IoT architecture, common weaknesses such as weak defaults and poor update support, IoT attacks and the OWASP IoT risks, and countermeasures. OT hacking covers operational technology, including industrial control systems, SCADA and protocols such as Modbus, the differences between IT and OT security priorities, and how to secure fragile OT environments.
These device types share wireless and network exposure with earlier domains but introduce distinct constraints. The OT subsection in particular requires a different mental model, and candidates who apply standard IT thinking to OT scenarios reliably lose those questions. The domain is 10% of the exam and the OT portion is its sharpest edge.
How it's tested
Expect questions on mobile attack vectors and defenses, IoT weaknesses, and OT scenarios that test the inverted priorities. The OT questions in particular reward understanding why defenders accept longer patch cycles and prioritize safety and uptime. Read the full scenario and every option carefully before deciding.
-
OT priority inversion
An OT or ICS decision is described, and you must choose the answer that prioritizes availability and safety over rapid IT-style remediation.
-
Mobile attack or defense
A mobile scenario is described, and you must identify the attack vector or the right control such as MDM or containerization.
-
IoT weakness
An IoT deployment is described, and you must identify the weakness or the countermeasure, often network isolation.
A critical patch is released for controllers running a live production line. In IT, you would patch quickly. But in OT, an unplanned patch could halt or destabilize the physical process, and availability and safety come first. The correct answer schedules the patch during a planned maintenance window after testing, accepting a longer exposure to reduce operational and safety risk.
Domains 3
Official domains from the EC-Council outline, in outline order.
7.1 Hacking Mobile PlatformsAndroid and iOS attack vectors, mobile malware, and mobile defenses.
- What it means
- This module covers mobile attack vectors, Android and iOS architecture and vulnerabilities, mobile malware and spyware, jailbreaking and rooting, insecure app and data storage, mobile device management, and defenses such as containerization, app vetting and MDM policies.
- What to understand
- Jailbreaking (iOS) and rooting (Android) remove built-in protections and expand the attack surface. Mobile device management controls the whole device, while mobile application management and containerization control only corporate apps, which suits personal devices. Insecure data storage on the device is a common weakness.
- How it shows up
- A mobile attack or management scenario is described, and you must identify the vector or choose the control, often MDM or containerization.
- Common confusion
- Confusing MDM with mobile application management. MDM manages the whole device, while application management controls only corporate apps and data.
7.2 IoT HackingIoT architecture, weaknesses, attacks and countermeasures.
- What it means
- This module covers IoT architecture and communication, common weaknesses such as weak default credentials, lack of updates and insecure interfaces, the OWASP IoT top risks, IoT attacks and tools, and countermeasures such as network isolation, changing defaults, firmware updates and monitoring.
- What to understand
- IoT devices often ship with weak defaults, cannot run security agents and receive few updates, so network isolation is the primary control. Changing default credentials and segmenting IoT onto its own network limit the damage a compromised device can cause.
- How it shows up
- An IoT deployment weakness is described, and you must identify it or choose the countermeasure, usually isolation and credential changes.
- Common confusion
- Expecting IoT devices to be protected with the same endpoint agents as computers. Most cannot run them, so network controls carry the load.
7.3 OT HackingICS, SCADA, Modbus, the inverted CIA triad, and securing OT.
- What it means
- This module covers operational technology, including industrial control systems and SCADA, OT protocols such as Modbus and DNP3, the differences between IT and OT security priorities, OT attacks, and countermeasures such as segmentation, monitoring and carefully scheduled maintenance.
- What to understand
- OT inverts the CIA triad: availability is most important, then integrity, then confidentiality, because an outage or unsafe state has physical and safety consequences. OT systems are often old, unpatchable and fragile, so aggressive scanning or unplanned patching is dangerous. Segmentation, monitoring and planned maintenance are the main defenses.
- How it shows up
- An OT or ICS decision is described, and you must choose the answer that respects availability and safety over IT-style remediation.
- Common confusion
- Applying IT security priorities to OT. In OT, availability and safety come before confidentiality, and rapid patching can be the wrong choice.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
OT inverted CIA triad
In OT, availability comes first, then integrity, then confidentiality.
- Remember
- It is the opposite of typical IT priorities.
- Tested as
- The key OT concept.
- Trap
- Applying IT priorities to OT scenarios.
-
ICS and SCADA
Industrial control systems and supervisory control and data acquisition systems that run physical processes.
- Remember
- They prioritize uptime and safety and are often fragile.
- Tested as
- OT questions.
- Trap
- Treating them like standard servers.
-
OT patching caution
Patches to OT are scheduled carefully to avoid disrupting physical processes.
- Remember
- Longer patch cycles are accepted to protect availability and safety.
- Tested as
- OT decision questions.
- Trap
- Choosing rapid patching as in IT.
-
Modbus and OT protocols
Legacy industrial protocols that often lack authentication and encryption.
- Remember
- Their insecurity is why segmentation matters.
- Tested as
- OT attack questions.
- Trap
- Expecting modern security features in them.
-
IoT weak defaults
IoT devices often ship with default credentials and few updates.
- Remember
- Change defaults and isolate the devices.
- Tested as
- IoT questions.
- Trap
- Leaving default credentials in place.
-
IoT isolation
Placing IoT devices on a separate, restricted network segment.
- Remember
- The primary control when devices cannot run agents.
- Tested as
- IoT countermeasure questions.
- Trap
- Expecting endpoint software on IoT.
-
Jailbreaking vs. rooting
Removing built-in protections on iOS (jailbreaking) or Android (rooting).
- Remember
- Both expand the attack surface.
- Tested as
- Mobile questions.
- Trap
- Confusing which term applies to which platform.
-
MDM vs. MAM
MDM manages the whole device; mobile application management controls corporate apps.
- Remember
- MAM and containerization suit personal devices.
- Tested as
- Mobile management questions.
- Trap
- Using full MDM on personal devices where privacy matters.
-
Insecure data storage
Sensitive data stored unprotected on a mobile device.
- Remember
- A common mobile weakness.
- Tested as
- Mobile questions.
- Trap
- Assuming device storage is inherently safe.
-
Segmentation for OT and IoT
Isolating fragile or unpatchable devices on their own network.
- Remember
- It limits the blast radius of a compromise.
- Tested as
- OT and IoT countermeasure questions.
- Trap
- Leaving OT and IoT on the general network.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
IT vs. OT security priorities
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IT priorities | Confidentiality, integrity, availability in that typical order | Confidentiality often first | Applying this order to OT |
| OT priorities | Availability, integrity, confidentiality | Availability and safety come first | Patching rapidly as in IT |
MDM vs. MAM vs. containerization
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| MDM | Manages the whole device | Full control including wipe | Using it on personal devices |
| MAM | Manages corporate apps and their data | Controls only work apps | Expecting device-wide control |
| Containerization | Separates work and personal data | Isolates corporate data | Assuming it covers personal apps |
Mobile vs. IoT vs. OT constraints
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Mobile | Smartphones and tablets | Can run management and security apps | Assuming IoT behaves the same |
| IoT | Connected devices with limited capability | Often cannot run agents; isolate them | Expecting endpoint software |
| OT | Industrial control systems | Availability and safety first; fragile | Applying IT remediation speed |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Patch the ICS now
- What candidates pick
- Apply a critical patch to live industrial controllers immediately.
- Why it looks right
- Rapid patching is correct in IT.
- Why it's wrong
- In OT, an unplanned patch can halt or destabilize a physical process. Availability and safety come first, so patching is scheduled and tested.
Clue to watch for The system is OT, ICS or SCADA running a live process.
-
IT triad for OT
- What candidates pick
- Prioritize confidentiality when securing an OT environment.
- Why it looks right
- Confidentiality leads in IT.
- Why it's wrong
- OT inverts the triad, putting availability and safety first.
Clue to watch for The scenario is an OT or industrial environment.
-
Agent on the sensor
- What candidates pick
- Install endpoint protection on IoT sensors.
- Why it looks right
- Endpoint software protects computers.
- Why it's wrong
- Most IoT devices cannot run agents. Network isolation and changing defaults are the practical controls.
Clue to watch for The devices are constrained IoT equipment.
-
MDM on personal phones
- What candidates pick
- Enroll employee-owned phones in full MDM with device wipe.
- Why it looks right
- It gives maximum control.
- Why it's wrong
- It intrudes on personal data. Mobile application management with containerization protects corporate data while respecting privacy.
Clue to watch for The devices are personally owned and privacy matters.
-
Default credentials are fine
- What candidates pick
- Deploy IoT devices without changing default credentials.
- Why it looks right
- It is quick and the devices seem minor.
- Why it's wrong
- Default credentials are a leading IoT compromise route. Change them and isolate the devices.
Clue to watch for The IoT devices still use factory defaults.
-
OT on the flat network
- What candidates pick
- Leave OT systems on the same network as IT.
- Why it looks right
- It is simpler to manage.
- Why it's wrong
- OT should be segmented so an IT compromise cannot reach fragile, safety-critical systems.
Clue to watch for OT and IT share one network segment.
Answer framework
For any Domain 7 device scenario, use these steps before choosing an answer.
- Identify whether the target is a mobile device, an IoT device or an OT system, because each has different constraints.
- For OT, apply the inverted CIA triad, putting availability and safety first and accepting scheduled, tested maintenance over rapid patching.
- For IoT, recognize that most devices cannot run agents, so isolation and changing default credentials are the primary controls.
- For mobile, match the management approach to ownership, using MDM for corporate devices and containerization or MAM for personal ones.
- Across all three, prefer segmentation and monitoring to contain devices that cannot be fully hardened, and apply the mental model that fits the device type.
Practice question
Want more like this? The CEH practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
The OT subsection is the make-or-break part of this domain, so study it first and hardest even though mobile may feel more familiar. Internalize the inverted CIA triad and the reason for it: OT failures have physical and safety consequences, so availability comes first. Practice OT decision questions until you consistently pick the operationally cautious answer over the IT-style rapid-remediation one.
Next, learn IoT: its weak defaults, inability to run agents, and the isolation-first defense. Then cover mobile, which is the most intuitive module, focusing on jailbreaking versus rooting and the MDM, MAM and containerization distinctions tied to device ownership.
Because this domain is 10% and the OT portion is where points are lost, weight your time toward OT and IoT rather than mobile. Afterwards, move to Domain 8, cloud computing, another small but deep domain. Review each missed question by checking whether you applied IT thinking to an OT scenario.
FAQ
How much of CEH v13 is Domain 7?
Mobile Platform, IoT, and OT Hacking is about 10% of the exam, roughly twelve questions across the three modules.
Why is OT different from IT security?
OT inverts the CIA triad, putting availability and safety first because failures affect physical processes. Rapid patching, normal in IT, can be dangerous in OT.
How are IoT devices best secured?
Through network isolation, changing default credentials, firmware updates and monitoring, because most cannot run endpoint security agents.
What is the difference between jailbreaking and rooting?
Jailbreaking removes built-in restrictions on iOS; rooting does the same on Android. Both expand the attack surface.
When should I use MDM versus containerization?
Use full MDM for corporate-owned devices and containerization or mobile application management for personal devices, to protect corporate data without controlling personal content.
Why do candidates lose points on OT questions?
They apply IT thinking, choosing rapid patching and confidentiality-first answers, when OT prioritizes availability and safety and accepts longer, planned maintenance.
How does Domain 7 connect to the rest of the exam?
These devices share wireless and network exposure with Domains 4 and 6, but add distinct constraints, especially the OT priority inversion.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 7 knowledge
You have covered mobile, IoT and OT hacking, including the inverted OT priorities. Test whether you can apply the right mental model to each device type under exam conditions.