EC-Council · Official Blueprint · Last reviewed May 2026
The official EC-Council CEH exam covers 6 domains. Domain weights tell you exactly how much of the exam each topic represents — and where to invest your study time.
AAA, access control lists (standard and extended), port security, DHCP snooping, Dynamic ARP Inspection, and VPN overview.
Covers the topics, concepts, and applied skills examined under the Reconnaissance and Footprinting domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Covers the topics, concepts, and applied skills examined under the Scanning, Enumeration, and Vulnerability Analysis domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Covers the topics, concepts, and applied skills examined under the System Hacking and Malware domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Covers the topics, concepts, and applied skills examined under the Network and Application Attacks domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
Covers the topics, concepts, and applied skills examined under the Cryptography, Cloud, and IoT Security domain. Study the official exam objectives and practise questions in this area to build confidence and accuracy before your exam.
The heaviest domain on the CEH is "Information Security Fundamentals and Ethics" at null%. Start here and return to it regularly.
Allocate study time proportional to domain weight — a 25% domain deserves roughly 25% of your prep hours.
Never skip a low-weight domain. A 10% domain still represents 5–7 exam questions — enough to make the difference between pass and fail.
Use Courseiva domain analytics to track your accuracy per domain automatically. The system routes extra questions to your weak areas.
Courseiva tracks your accuracy per domain automatically and routes you toward your weakest areas — no manual configuration needed.