Ravindra BagaleCourses & study guides मराठी Track your progress

48. CEH v13 Exam Modules Map and Practice Questions

48.8 Quick Revision Table – Module → Book Chapter → Blue Control

By Last updated:

Thodkyaat – ek page revision. Exam night / interview morning. Chala!

Mod Exam module (short) Revise chapters Blue control (one-liner) OWN lab tick
01 Intro ethical hacking ch17, ch18, ch34, ch35 Written scope + IT Act awareness Ethics sticky note
02 Footprinting ch19, ch36 Shrink OSINT surface; monitor DNS noise Amass passive on domain you own
03 Scanning ch01–03, ch19 SG/firewall; alert mass SYN Nmap .20 only
04 Enumeration ch37, ch38 Close unused shares; log directory binds Enum notes without exploit
05 Vuln analysis ch20 Patch by exposure Scanner → ticket → re-scan
06 System hacking ch22, ch23, ch26 MFA, keys, least privilege, patch Hardened SSH lab
07 Malware ch39, ch28 Backups + least privilege + IR No prod detonation
08 Sniffing ch24 TLS; no telnet/FTP Wireshark lab HTTPS proof
09 Social engineering ch27 MFA + report + DMARC Consented sim only
10 DoS ch40 Rate limit / DDoS pattern / playbook Never flood third parties
11 Session hijack ch41 HTTPS + cookie flags Cookie flags on .50
12 IDS/FW/honeypot ch42, ch32 Layered detect; isolate honeypot fail2ban/firewalld lab
13 Web servers ch07, ch08, ch21 Patch + harden httpd/nginx sudo service reload
14 Web apps ch21, ch29 OWASP fixes + authZ DVWA/Juice fix loop
15 SQLi ch10, ch11, ch29 Prepared statements Concat → PDO proof
16 Wireless ch25 WPA2/WPA3 + guest isolation OWN AP only
17 Mobile ch44 Lock + updates + MDM mindset Emulator hygiene
18 IoT/OT ch43 Defaults changed + segment OT Camera inventory fiction
19 Cloud ch04–16, ch30 IAM + S3 BPA + CloudTrail Free Tier checklist
20 Cryptography ch33 TLS 1.2+; bcrypt/Argon2 Hash vs encrypt drill
Red team (attacker) does Blue team (defender) detects / stops
Revises only tool flags, zero Blue column Revises module + chapter + Blue one-liner + lab tick
Skips Modules 01/09/19 as "soft" Treats ethics, phishing, cloud misconfig as high-score areas

Ravindra Bagale's Tip

Print the revision table – but fill in the blank "OWN lab tick" column yourself. A blank tick = a weak module. Don't just rattle off exam modules – tick = typed in lab. Got it?

Lab

With Zoya: quiz each other random module numbers for 15 minutes. Answer format mandatory: (1) module name, (2) book chapter, (3) one Blue control, (4) one OWN lab proof sentence.

Extended teaching notes

Why this lesson matters

Use this lesson to strengthen systems you own: understand the risk, practise safely in a lab, then write and apply the fix.

Apply the fix across stacks

Same class of bug, same idea in every language.

Java / Spring Boot

Parameterise queries, encode output, CSRF tokens, limited Actuator, dependency scanning.

ASP.NET Core

EF Core / parameterised SQL, Razor encoding, HTTPS, Data Protection.

Node.js / Express

helmet, parameterised SQL, npm audit, avoid eval and shell concat.

Python / Django / Flask / FastAPI

ORM, autoescape, pip-audit, Bandit; never shell=True with user input.

PHP / Laravel

PDO/Eloquent, Blade escaping, composer audit.

Go / Ruby

database/sql placeholders / ActiveRecord; html/template / ERB escaping; govulncheck / Brakeman.

nginx / Apache / Tomcat

Hide versions, TLS, security headers, least-open ports.

MySQL / PostgreSQL / MongoDB / Redis

Private networks, auth on, least-privilege users, no 0.0.0.0/0.

AWS / Azure / GCP

Roles not long-lived keys, private data stores, cloud audit logs on.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.