PECB Certified Lead Ethical Hacker study guide
PECB Certified Lead Ethical Hacker · Work through your exam, one topic at a time.
The PECB Certified Lead Ethical Hacker (CLEH) is a technical cybersecurity credential awarded by PECB after you pass the Lead Ethical Hacker exam and meet the associated credential requirements. The training course behind it is designed to build the competence to plan, manage, and perform penetration tests of information systems and networks, and it grounds the work in recognised methodologies such as the Penetration Testing Execution Standard (PTES) and the Open Source Security Testing Methodology (OSSTMM). The PECB Certified Lead Ethical Hacker study guide has 6 sections and about 1,889 words.
01Information Gathering Tools and Techniques
This domain tests passive and active reconnaissance: OSINT, DNS and certificate intelligence, search-engine dorking, metadata, and service discovery. The exam expects you to choose the least intrusive technique that answers the question, stay inside the rules of engagement, and record sources and timestamps.
333 words, about 2 min02Threat Modeling and Vulnerability Identification
This domain tests whether you can model threats before scanning, map findings to assets and business context, and distinguish a vulnerability from a risk. Expect STRIDE, attack trees, data-flow diagrams, trust boundaries, CVSS, CVE/CWE, authenticated scanning, and false-positive validation.
341 words, about 2 min03Exploitation Techniques
This domain tests controlled exploitation to prove impact without causing harm. Expect web, network service, and credential attacks; proof-of-concept discipline; rules of engagement; and evidence capture.
303 words, about 2 min04Privilege Escalation
This domain tests post-exploitation escalation on Linux and Windows: enumeration, misconfiguration abuse, credential access, and validation. The exam emphasizes authorized scope, minimal impact, and evidence.
305 words, about 2 min05Pivoting and File Transfers
This domain tests movement across network segments and reliable transfer of tools and evidence. Expect SSH tunneling, SOCKS proxies, port forwarding, route addition, and file-transfer methods under egress filtering.
322 words, about 2 min06Reporting
This domain tests whether you can turn testing into defensible, actionable evidence. Expect executive summaries, technical findings, risk ratings, reproduction steps, remediation, and data handling.
285 words, about 1 min