EC-COUNCILEC-Council Ethical Hacking Essentials
The EC-Council Ethical Hacking Essentials (EHE) certification is your entry point into the world of ethical hacking and penetration testing. This beginner-friendly program requires no prior IT or cybersecurity experience, yet it delivers hands-on skills through 47 guided labs and real-world CTF challenges. You'll learn to think like an attacker, understand the full hacking lifecycle, and validate your abilities with a globally recognized credential that sets you on the path to advanced certifications like CEH.
1527 practice questions · Updated 2026-07-30
8Domains
36Objectives
234Concepts
1527Questions
EHE Curriculum
Every domain, objective, and concept the EHE exam measures.
- Information Security Fundamentals
- Threats and Vulnerabilities
- Defense in Depth
- Security Controls
- Risk Management Basics
- Security Policies and Procedures
- Ethical Hacking Overview
- Threat definition
- Threat sources
- Threat types
- Vulnerability definition
- Vulnerability categories
- Relationship between threats and vulnerabilities
- Cryptography Fundamentals
- Symmetric Encryption
- Asymmetric Encryption
- Hash Functions
- Digital Signatures
- Key Management
- Cryptographic Attacks
- Information Security Laws
- Regulatory Compliance
- Standards and Frameworks
- Legal and Ethical Implications
- Definition of hacking
- Hacker classes
- Hacker skill levels
- Ethical hacking principles
- Ethical hacking scope
- Ethical hacking methodologies
- Ethical hacking frameworks
- Malware Definition
- Malware Types
- Malware Attack Vectors
- Malware Lifecycle
- Malware Obfuscation Techniques
- Malware Indicators of Compromise
- Malware propagation vectors
- Malware propagation techniques
- Indicators of malware infection
- Network indicators of malware
- Behavioral indicators of malware
- Malware countermeasures overview
- Antivirus and anti-malware software
- Host-based intrusion prevention
- Network-based intrusion prevention
- Firewalls and malware filtering
- Patch management and vulnerability mitigation
- User awareness and training
- Least privilege and access control
- Application whitelisting
- Email and web security gateways
- Endpoint detection and response (EDR)
- Incident response and recovery planning
- Password cracking fundamentals
- Password storage mechanisms
- Password cracking techniques overview
- Brute force attacks
- Dictionary attacks
- Hybrid attacks
- Rainbow table attacks
- Rule-based attacks
- Password cracking tools
- Countermeasures against password cracking
- Password Cracking Countermeasures Overview
- Strong Password Policies
- Password Storage Best Practices
- Multi-Factor Authentication (MFA)
- Account Lockout and Rate Limiting
- Password Managers and User Education
- Monitoring and Auditing
- Reconnaissance Fundamentals
- Footprinting Concepts
- OSINT Sources and Tools
- Passive Reconnaissance Techniques
- Active Reconnaissance Techniques
- Information Collection Methods
- Footprinting Steps
- OSINT Analysis and Application
- Scanning Fundamentals
- Scanning Techniques
- Scanning Tools
- Enumeration Fundamentals
- Enumeration Techniques
- Enumeration Tools
- Vulnerability Scanning Fundamentals
- Vulnerability Assessment Process
- Types of Vulnerability Scans
- Vulnerability Scanning Tools
- Interpreting Scan Results
- Remediation and Reporting
- Gaining Access
- Maintaining Access
- Covering Tracks
- Identify countermeasures for each hacking phase
- Apply countermeasures to reconnaissance
- Apply countermeasures to scanning and enumeration
- Apply countermeasures to gaining access
- Apply countermeasures to maintaining access
- Apply countermeasures to covering tracks
- Insider threat definition
- Insider threat indicators
- Insider threat mitigation strategies
- Identity theft definition
- Identity theft impact
- Identity theft prevention
- Identity theft response
- Social engineering countermeasures overview
- Security policies and procedures
- User awareness and training
- Technical controls
- Physical security measures
- Incident reporting and response
- Monitoring and auditing
- Verification and authentication procedures
- Definition of packet sniffing
- Types of packet sniffing
- Sniffing techniques
- Sniffing tools
- Countermeasures against sniffing
- DoS attack definition
- DDoS attack definition
- Volumetric attacks
- Protocol attacks
- Application-layer attacks
- SYN flood attack
- UDP flood attack
- ICMP flood attack
- Ping of Death
- Smurf attack
- HTTP flood attack
- Slowloris attack
- DNS amplification attack
- NTP amplification attack
- Botnet role in DDoS
- DDoS mitigation techniques
- DoS/DDoS countermeasures
- Session hijacking definition
- Session hijacking process
- Session ID prediction
- Session fixation
- Cross-site scripting (XSS) for session hijacking
- Session side-jacking
- Man-in-the-browser attack
- Countermeasures against session hijacking
- Network attack detection techniques
- Network attack countermeasures
- Monitoring and analysis of network traffic
- Incident response and remediation
- Web server attack surface
- Common web server vulnerabilities
- Web server attack techniques
- Web server attack countermeasures
- Web Application Attack Surface
- Injection Attacks
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Session Hijacking and Fixation
- Authentication and Authorization Flaws
- File Upload Vulnerabilities
- XML External Entity (XXE) Attacks
- Server-Side Request Forgery (SSRF)
- Web Application Exploitation Tools
- Countermeasures and Secure Coding Practices
- SQL Injection Fundamentals
- Types of SQL Injection
- SQL Injection Attack Techniques
- Impact of SQL Injection
- SQL Injection Detection
- SQL Injection Prevention
- SQL Injection Mitigation in Web Applications
- Wireless Network Fundamentals
- Wireless Encryption and Authentication
- Wireless Attack Types
- Wireless Attack Tools
- Wireless Security Countermeasures
- Bluetooth Attack Vectors
- Bluetooth Security Weaknesses
- Bluetooth Attack Countermeasures
- Wireless Network Threats
- Wireless Encryption Protocols
- Wireless Security Best Practices
- Mobile attack vectors
- Mobile vulnerabilities
- Mobile malware types
- Mobile device management risks
- Mobile app security risks
- Mobile network threats
- Mobile OS security features
- Mobile device physical security
- MDM Fundamentals
- MDM Features and Capabilities
- MDM Deployment Models
- BYOD Policies
- BYOD Security Risks
- Containerization and Separation
- Mobile Threat Defense (MTD)
- Compliance and Legal Considerations
- IoT Attack Surface
- Common IoT Vulnerabilities
- IoT Attack Types
- IoT Security Countermeasures
- OT Attack Surface
- Common OT Vulnerabilities
- OT Attack Types
- OT Security Countermeasures
- Cloud Computing Fundamentals
- Cloud Service Models
- Cloud Deployment Models
- Containerization Concepts
- Container Security
- Container Orchestration
- Cloud Threat Landscape
- Cloud Attack Vectors
- Cloud Security Risks
- Mitigation Strategies
- Cloud Attack Countermeasures Overview
- Identity and Access Management (IAM) Countermeasures
- Data Protection Countermeasures
- Network Security Countermeasures
- Application Security Countermeasures
- Monitoring and Logging Countermeasures
- Incident Response and Recovery Countermeasures
- Compliance and Governance Countermeasures
- Types of penetration testing
- Phases of penetration testing
- Approaches to penetration testing
- Penetration Testing Guidelines
- Penetration Testing Recommendations
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for EHE, so none is invented.
Social engineering concepts and techniques
5 concepts · 44 questions