CEH-001
Certified Ethical Hacker (CEH)
CEH-001 Exam Guide: What the Official CEH v13 Evidence Supports
The supplied official evidence identifies CEH-001 as a label that does not match the qualifying certification name: EC-Council identifies its certification as Certified Ethical Hacker, specifically CEH v13. The exam validates knowledge of ethical-hacking threats, attack vectors, detection, prevention, procedures, and methodologies. This guide helps you decide whether you are targeting the correct certification, whether your background is ready, which learning areas need the most attention, and how to sequence study before booking the knowledge exam.
Confirm what CEH-001 refers to before you study
The first decision is administrative, not technical: verify that your registration or employer request actually refers to EC-Council Certified Ethical Hacker v13. The supplied official source does not identify “GAQM CEH-001” as the certification; it identifies Certified Ethical Hacker (CEH) as an EC-Council certification, specifically CEH v13.
This distinction matters because study material, eligibility, exam delivery, and practical options depend on the issuing organization and version. A page or voucher using CEH-001 may be an internal catalogue code, a third-party naming convention, or a different examination entirely. Do not purchase preparation material until the provider, certification title, version, and exam route agree.
Use the official EC-Council certification page to compare the title shown in your booking workflow: https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh-v13-north-america/. If the registration portal continues to use CEH-001, ask the organization issuing the voucher to confirm the mapping in writing. Treat that confirmation as a prerequisite to scheduling, not as a minor wording issue.
What the knowledge exam validates
The knowledge exam is a multiple-choice assessment of information-security threats and attack vectors, attack detection, attack prevention, procedures, and methodologies. The official evidence describes a 4-hour exam with 125 questions, delivered online through the ECC exam portal, with a passing score ranging from 60% to 85%.
Those subjects require more than memorizing tool names. You need to recognize the phase of an ethical-hacking engagement, distinguish an attack from a countermeasure, connect a weakness to an appropriate detection method, and select a defensible procedure in a short scenario. A useful study note therefore records four items for each topic: what the technique does, what evidence it leaves, how it can be prevented, and when an ethical tester would use it.
The supplied facts do not provide a domain-by-domain percentage blueprint. Do not assign unofficial weights to the modules or compare bare percentages. If EC-Council supplies a current exam blueprint with domain percentages when you register, use that document as the controlling planning reference.
Who should consider this certification
CEH is aimed at people developing or demonstrating ethical-hacking knowledge, including cybersecurity practitioners who need a structured examination of attack methods and defenses. EC-Council strongly recommends a minimum of 2 years of IT security experience before attempting CEH, but the supplied evidence does not describe that recommendation as an unconditional prerequisite.
Candidates with networking, operating-system, security-control, and incident-handling knowledge can usually spend study time on attack methodology rather than learning basic infrastructure at the same time. Candidates without that foundation should not interpret the broad module list as permission to skip fundamentals; they should first close gaps in TCP/IP, common services, authentication, access control, system administration, and basic scripting.
The right readiness question is not whether you have used a particular hacking tool. Ask whether you can explain why a technique works, what authorization and scope it requires, what observable result it produces, and what control reduces the risk. If you cannot do that consistently, delay the exam decision and build the foundation first.
What the curriculum covers
The official CEH v13 outline is structured across 20 learning modules and covers over 550 attack techniques. The range extends from ethical-hacking foundations and reconnaissance through network, system, web, wireless, mobile, cloud, IoT, operational technology, and cryptography topics.
The early modules establish the engagement sequence. Module 1 covers ethical-hacking fundamentals, information-security controls, relevant laws, and standard procedures. Module 2 covers footprinting and reconnaissance, while Module 3 covers network scanning and countermeasures. Module 4 addresses enumeration, including BGP and NFS exploits and associated countermeasures. Module 5 focuses on identifying security loopholes in networks, communication infrastructure, and end systems.
The middle of the outline moves from access and traffic to people and perimeter controls. Module 6 covers system hacking, steganography, steganalysis, and covering tracks. Module 7 covers malware types, APT and fileless malware, analysis procedures, and countermeasures. Modules 8 and 11 cover sniffing and session hijacking. Modules 9 and 10 cover social engineering and DoS/DDoS. Module 12 addresses evasion of IDS, firewalls, and honeypots.
The later modules are application and platform focused. Modules 13 and 14 cover web-server and web-application hacking. Module 15 covers SQL injection. Module 16 covers wireless networks, Module 17 mobile platforms, Module 18 IoT and OT, Module 19 cloud computing, and Module 20 cryptography, including algorithms, PKI, encryption uses, attacks, and cryptanalysis tools.
This breadth changes how you should revise. Build connections between modules rather than treating each as an isolated vocabulary list. For example, a web-application weakness should be linked to its likely impact, testing approach, evidence, and countermeasure. A wireless topic should be connected to protocol behavior, attack surface, tools, and defensive configuration.
Topics that need explanation rather than flashcards
Reconnaissance, enumeration, vulnerability analysis, SQL injection, malware, session hijacking, cloud security, and cryptography are especially poor candidates for one-line memorization. For each, write a short attack narrative and then reverse it into a defense narrative.
For SQL injection, distinguish the injection family, the reason a query is vulnerable, the observable result, and the mitigation. For session hijacking, connect session management, authentication, authorization, and cryptographic weaknesses to the relevant countermeasures. For malware, separate the malware category from the delivery or analysis procedure. These distinctions help prevent answers that sound plausible but confuse cause, technique, and defense.
AI topics require controlled use
The official CEH v13 material includes AI-driven ethical-hacking techniques and ChatGPT-powered AI tools for ethical hackers. Use AI as a study aid for comparison, explanation, and practice-question critique, not as an authority that replaces the official outline. Verify every generated explanation against EC-Council material and avoid entering confidential organizational information into an external tool.
A practical exercise is to ask an AI system to contrast two concepts, then check the response against your notes. Record the correction when it is wrong. That process develops judgment about tool output, which is more useful than collecting unverified command lists.
How to choose training and study materials
Choose a route that gives you both current CEH v13 coverage and a way to test your understanding. EC-Council states that training is available through iClass, Authorized Training Centers, and academic partners; its official material also describes on-demand and live instructor-led options. Self-study materials are available for purchase, and the exam eligibility application is required for that route.
A self-paced route suits candidates who already understand networking and security fundamentals and can maintain a study schedule without external deadlines. Instructor-led training may be more useful when you need clarification, structured pacing, or accountability. Neither format removes the need to verify version alignment, module coverage, lab access, and the exact exam being purchased.
Before enrolling, ask four practical questions: Is the material explicitly aligned to CEH v13? Does it cover all 20 modules? Are the labs authorized and isolated? Does the package concern the knowledge exam, the optional practical exam, or both? Keep the answers with your booking records.
The official iClass training page is available at https://iclass.eccouncil.org/ceh-training/. Official training information is also available at https://ethicalhacking.eccouncil.org/certified-ethical-hacker-ceh-v13online-d2c-north-america.
Use labs to connect concepts to evidence
Hands-on work is most valuable when it answers a question about behavior or evidence. EC-Council describes 221 hands-on labs, preconfigured targets and networks, vulnerable operating systems and websites, a cloud-based cyber range, and access to over 4,000 hacking and security tools in its CEH v13 training material.
Do not measure preparation by the number of tools you have opened. For every lab, write down the target condition, the authorized objective, the technique selected, the output that confirmed or disproved your hypothesis, and the defensive lesson. If a scan produces an unexpected result, investigate the network condition instead of copying a different command until the output looks familiar.
Keep all practice inside an authorized lab or training range. The exam evaluates ethical-hacking knowledge, and real systems are not practice targets merely because they are reachable. A controlled environment also makes it easier to repeat an exercise, change one variable, and understand the result.
A useful lab sequence is reconnaissance, scanning, enumeration, vulnerability analysis, controlled exploitation, evidence collection, and remediation review. Later, repeat the sequence against web, wireless, cloud, or mobile scenarios so that the workflow remains stable while the technology changes.
A study sequence that prevents shallow coverage
Study in a dependency order: establish the engagement and networking foundation, learn discovery and analysis, then move to exploitation themes and specialized platforms. Finish with integrated scenarios and timed knowledge review. This sequence reduces the common problem of learning isolated attack names without understanding where they fit.
Begin with Modules 1 through 5. Create a one-page reference for laws, authorization, ethical-hacking phases, reconnaissance methods, scanning distinctions, enumeration targets, and vulnerability-analysis outputs. Review network protocols and operating-system behavior alongside the modules rather than postponing them.
Continue with Modules 6 through 12. Pair system hacking with malware, sniffing with session hijacking, social engineering with human-focused countermeasures, and DoS/DDoS with availability protection. Include IDS, firewall, and honeypot evasion only in the context of authorized assessment and defensive interpretation.
Then cover Modules 13 through 20. Give web servers, web applications, and SQL injection a connected study block. Follow with wireless and mobile platforms, then IoT/OT and cloud computing. Reserve cryptography for a deliberate review of encryption purpose, algorithm families, PKI, key handling, common uses, and attack implications.
At the end of each block, close the source material and explain the topic aloud. If you can list terms but cannot describe the sequence from weakness to impact to countermeasure, mark the topic as incomplete.
A practical six-stage roadmap
Stage one is scope correction. Confirm that your target is EC-Council CEH v13 rather than an unrelated CEH-001 catalogue entry, check the eligibility application requirement, and obtain the current official exam information before selecting a date.
Stage two is baseline testing. Without using leaked material or exam dumps, answer representative questions from legitimate training resources and classify each miss as a vocabulary gap, concept gap, scenario-reading error, or careless selection. The category determines the remedy.
Stage three is structured learning. Work through the modules in dependency order and produce compact notes based on technique, purpose, evidence, countermeasure, and legal or operational boundary. Avoid rewriting the entire course.
Stage four is controlled practice. Complete labs in an authorized range, reproduce the result, and explain what a defender would observe. When possible, perform the same objective with a different tool so that your understanding is not tied to one interface.
Stage five is integration. Run a mock engagement from reconnaissance through reporting, then review the controls that would prevent or detect each step. EC-Council describes a four-phase engagement in its Cyber Range that uses flags and tests applied knowledge in a consequence-free environment; use that type of exercise if it is included in your official training access.
Stage six is exam readiness. Confirm the booking details, delivery instructions, identity requirements, and any current policies directly with EC-Council or the exam portal. Then use timed practice to improve pacing, not to memorize answer patterns.
A weekly revision cycle
At the start of a study week, select a small group of related objectives. During learning, alternate reading with lab work. At the end of the week, complete retrieval practice without notes, review errors, and schedule the missed concepts for another explanation or lab.
Maintain an error log with five columns: topic, selected answer or action, why it was tempting, correct reasoning, and the evidence that would distinguish the choices. This is more informative than recording only a score. Revisit the log after several study sessions so that recurring confusion becomes visible.
Use mixed review near the end of preparation. A question about enumeration should sit beside one about web applications, cryptography, malware, or cloud security. Mixed practice checks whether you can identify the relevant domain from a scenario instead of relying on the order in which you studied the modules.
How to prepare for the knowledge-exam format
The official evidence describes 125 multiple-choice questions in a 4-hour knowledge exam delivered online through the ECC exam portal. Prepare for sustained reading and decision-making: practice identifying the actual question, eliminating incompatible options, and moving on when a prompt is consuming disproportionate attention.
Read scenario questions in two passes. First identify the asset, attack stage, and requested outcome. Then inspect qualifiers such as “most appropriate,” “best prevention,” “first step,” or “evidence.” Many distractors are related techniques that could work in another phase or solve a different problem.
When two choices appear plausible, compare their fit with the stated objective rather than choosing the more familiar tool. An answer that identifies a vulnerability is not automatically the answer that detects it; an attack technique is not automatically the appropriate countermeasure. Your notes should deliberately include these contrasts.
The official source reports a passing score range of 60% to 85%, rather than one universal threshold. Treat the exact threshold as a current exam-specific detail and verify it through the official booking or exam information. Do not turn a practice percentage into a guaranteed prediction of the live result.
The optional practical exam and CEH Master path
The practical exam is optional and, according to the supplied official evidence, rewards candidates with a higher level of certification. The official CEH v13 material describes completing 20 real-world challenges in 6 hours; completing both the knowledge and practical exams is presented as the route to CEH Master.
This is a different preparation decision from passing the knowledge exam. Practical preparation should emphasize navigation, hypothesis testing, evidence preservation, and completing an objective under a defined scope. It should not be reduced to memorizing tool syntax or reproducing a demonstration.
If your immediate requirement is the CEH knowledge credential, first confirm that the practical exam is relevant to your employer, role, or development plan. If you intend to pursue CEH Master, allocate separate practice time and confirm the current practical-exam rules, eligibility, booking relationship, and certification conditions directly with EC-Council.
The official practical-exam description is available at https://ethicalhacking.eccouncil.org/certified-ethical-hacker-ceh-v13online-d2c-north-america.
Common preparation mistakes to avoid
The most damaging mistakes are usually planning errors: preparing for the wrong certification label, relying on an outdated version, studying tools without attack logic, and confusing a practice score with evidence of readiness. Correct those problems before adding more study hours.
Mistake one is assuming CEH-001 is automatically the official exam name. The supplied research specifically warns that the qualifying source identifies EC-Council CEH v13 instead. Resolve the identity of the exam first.
Mistake two is treating the module list as a set of flashcards. Attack names, protocol names, and tool names are useful only when you can connect them to a target, weakness, observable result, and countermeasure.
Mistake three is skipping foundational networking and systems knowledge. Reconnaissance, scanning, sniffing, session attacks, and many platform-specific topics become harder when you cannot reason about traffic, services, privileges, or authentication.
Mistake four is using unauthorized targets. Practice only with systems and ranges where you have explicit permission. Ethical boundaries are part of the subject, not a separate concern after technical study.
Mistake five is trusting unsupported blueprint percentages or unofficial question claims. No domain percentages are supplied here, and leaked questions cannot substitute for understanding. Use the official outline and legitimate practice resources instead.
Mistake six is ignoring administrative details until the day of the exam. Verify eligibility, the portal, delivery instructions, identification requirements, and current policies before scheduling.
What to verify before scheduling
Schedule only after the exam title and version, eligibility route, delivery method, and exam component are clear. The supplied official evidence supports online delivery through the ECC exam portal for the knowledge exam and states that a self-study eligibility application is required.
Use this checklist: confirm that the booking names Certified Ethical Hacker and the intended version; determine whether your route is self-study or official training; complete any required eligibility application; verify whether you are booking the knowledge exam or also planning the optional practical exam; and read the current exam-portal instructions.
Do not rely on a third-party page for time-sensitive rules when the official source or portal can confirm them. The supplied evidence does not establish every operational detail, such as current rescheduling rules, identification procedures, or regional availability, so those items should be checked at the point of registration.
Keep a copy of the confirmation and note the official support channel for changes. If the booking still says CEH-001 while the official certification evidence says CEH v13, stop and resolve the mismatch rather than assuming the two labels are interchangeable.
What to do after a failed practice assessment
A weak practice result should change your study method, not trigger random extra drilling. Review every missed item, including guessed answers, classify the reason for the miss, and return to the underlying concept or lab before attempting another mixed assessment.
If misses cluster around terminology, build contrast cards that place similar concepts side by side. If they cluster around scenarios, practice identifying the asset, phase, objective, and control before looking at answer choices. If they cluster around technical behavior, reproduce the result in an authorized lab and record the evidence.
If the problem is pacing, use timed blocks while preserving an error review. Faster guessing is not improvement. The aim is to make correct reasoning efficient enough for the official format without depending on question recollection or unauthorized material.
The next actions for a serious candidate
Start by resolving the CEH-001 naming issue and confirming the official CEH v13 target. Then obtain the current outline, assess your networking and security foundation, select a training route that matches your learning needs, and create an error-led study plan before choosing an exam date.
Your first working session can be short and concrete: write the certification title and version from the official source, list the modules you already understand, mark the modules that require labs, and identify any eligibility task still outstanding. Next, schedule the first study block around the early engagement sequence rather than jumping directly to familiar tools.
Use the official CEH v13 pages for the certification outline and exam information: https://ethicalhacking.eccouncil.org/, https://ethicalhacking.eccouncil.org/certified-ethical-hacker-ceh-v13online-d2c-north-america/, and https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/certified-ethical-hacker-ceh-certification-requirements/. Recheck those sources when you are ready to register because delivery and eligibility information can change.
Conclusion
For this target, accuracy begins with identity: the official research supports EC-Council Certified Ethical Hacker v13, not an independently verified “GAQM CEH-001” examination. Once that is confirmed, prepare for the knowledge exam as a broad assessment of ethical-hacking methods, detection, prevention, procedures, and methodology. Build understanding through the 20-module outline, authorized labs, error analysis, and a deliberate scheduling checklist. Treat the optional practical exam as a separate CEH Master decision, and verify all current administrative details directly with EC-Council before booking.