CPEH study guide
CPEH · Work through your exam, one topic at a time.
The Certified Professional Ethical Hacker (CPEH) is a vendor-neutral, hands-on credential aimed at practitioners who want to demonstrate that they can plan and carry out an authorized penetration test rather than simply recite tool names. It suits security analysts, system and network administrators moving into offensive roles, SOC staff who need to understand attacker tradecraft, and consultants who must produce defensible findings for clients. The CPEH study guide has 10 sections and about 2,908 words.
01Ethics, Legal Frameworks, and Compliance
This domain tests whether you can keep an engagement lawful and ethical before, during, and after testing. CPEH-style questions often present a tempting action-scanning a related domain, using leaked credentials, or retaining client data-and ask what a professional should do.
297 words, about 1 min02Reconnaissance and Footprinting
This domain examines how you gather information about a target without crossing into unauthorized scanning. The exam distinguishes passive reconnaissance, which avoids direct contact, from active reconnaissance, which sends traffic to target systems and therefore needs clear authorization.
302 words, about 2 min03Scanning, Enumeration, and Vulnerability Assessment
This domain tests structured discovery: finding live hosts, identifying services, enumerating accounts and shares, and turning scan output into validated vulnerabilities. The exam expects you to choose scan types, interpret ambiguous results, and avoid overstating findings.
311 words, about 2 min04System Hacking and Privilege Escalation
This domain covers gaining and expanding control of a host: credential attacks, local privilege escalation, and the discipline needed to prove impact without damaging the system. The exam focuses on misconfigurations and careful validation more than on one-click exploits.
289 words, about 1 min05Malware, Social Engineering, and Client-Side Attacks
This domain tests attacks that target people and endpoints: phishing, pretexting, malicious attachments, browser exploits, and payload delivery. The ethical boundary is strict: simulations must be authorized, bounded, and designed to collect the minimum evidence.
301 words, about 2 min06Network and Wireless Exploitation
This domain covers exploitation of network infrastructure and wireless protocols: interception, spoofing, segmentation bypass, and wireless credential attacks. The exam expects you to know which attacks are disruptive and which require special hardware or proximity.
298 words, about 1 min07Web Application and Database Exploitation
This domain tests exploitation of web applications and databases: injection, broken access control, authentication flaws, and safe proof-of-concept work. The exam favors precise requests and minimal data extraction over destructive exploitation.
292 words, about 1 min08Cryptography and Secure Communications
This domain tests whether you can evaluate cryptographic protections and secure communications without confusing encoding, hashing, and encryption. The exam focuses on misuse, key management, and protocol weaknesses.
271 words, about 1 min09Post-Exploitation, Persistence, and Covering Tracks
This domain covers what happens after initial access: expanding access, maintaining persistence, moving laterally, and removing artifacts. The exam tests restraint, scope control, and evidence handling as much as technique.
273 words, about 1 min10Reporting, Remediation, and Defensive Countermeasures
This domain tests how you turn testing into decisions: clear findings, honest risk ratings, practical remediation, and retesting. The exam rewards reports that a technical team can reproduce and an executive can act on.
274 words, about 1 min