CEH 3-Week Sprint Plan - Singapore, Aggressive

Target: Pass CEH v13 (312-50) on first attempt, 21 days from today. Your background: (ISC)² CC already earned → 2-3× head start on security vocabulary. Plan tuned for that. Required hours: ~3 hrs/day (90 min AM + 90 min PM) on weekdays, 4-5 hrs on weekends. Total ~65-70 hrs. Pass threshold to clear: 90% on practice tests (CEH cut score floats 60-85% per form; 80% = coin flip).

⚠️ TODAY (before anything else)

Do these in order, today:

Set up the lab (tools/01-kali-linux-setup.md - quick-start section, ~1 hr). You cannot learn CEH from reading. You need Nmap output in your face.
Check your eligibility path (research/01-exam-logistics.md § Eligibility).
- If you have 2+ years infosec work experience → submit the ANSI self-study application today ($100, 5-10 business days for approval). Don’t wait.
- If you don’t → buy the official training bundle (SkillsFuture eligible → S$75-S$317 net). See the Singapore playbook in 00-master-strategy.md.
Buy voucher + book Pearson VUE slot for Day 21 - even before you study. Why:
- SG Pearson VUE centres fill 1-2 weeks out, especially weekends.
- Booking a date forces daily discipline.
- You can reschedule ≥48h ahead if you’re not ready.
- Today: pick a date ~21 days from now at Bugis Junction, International Plaza, Tampines, or Jurong East. 9-11 AM slot.
Take Set A as a baseline (practice/01-mcq-set-a.md) - 50 questions, timed (75 min), no notes. Score yourself cold. This is your day-0 reference. Save the score.
Set up the practice routine:
- Add to calendar: 90 min block every weekday 7:30-9:00 AM, 90 min every evening 9:00-10:30 PM.
- Saturday: 4-5 hr block 9 AM-2 PM. Sunday: 4-5 hr block + 1 hr weekly review.

🎯 3-Week Day-by-Day Plan

Week 1 - Foundation + Baseline (Days 1-7)

Goal: Cover all 9 domains at 70% theory depth. GO/NO-GO gate at Day 7.

Day	AM (90 min)	PM (90 min)	Deliverable
1	Read `research/02-domain-1-2-threats-defense.md` (full)	Set up Kali + Metasploitable 2 + DVWA per `tools/01-kali-linux-setup.md`	Lab running; 5 Kill Chain phases + 14 ATT&CK tactics memorised
2	Read `research/03-domain-3a-reconnaissance.md`	Lab: Nmap the Metasploitable - try `-sS`, `-sT`, `-sU`, `-sN`, `-sF`, `-sX`, `-sV`, `-A`, `-Pn`, `-f`	Screenshot of Nmap output for 8 scan types
3	Read `research/04-domain-3b-system-network-attacks.md` (1st half)	Lab: Hydra + John on Metasploitable; capture SMB traffic in Wireshark	1 cracked password + 1 Wireshark capture
4	Read `research/04` (2nd half) + OWASP Top 10 from `research/05`	Lab: PortSwigger Apprentice labs (SQLi, XSS, access control) - 5 labs	5 PortSwigger labs cleared
5	Read `research/05-domain-3c-app-crypto-cloud.md` (1st half)	Lab: Aircrack-ng on test WPA2 (or HTB wireless room)	1 wireless attack demo + 10 cloud terms memorised
6	Read `research/05` (2nd half) + `research/06`	Lab: Burp Suite Intruder against DVWA + Metasploitable scan via Nessus Essentials	1 web exploit demo + Nessus report
7	Take `practice/01-mcq-set-a.md` TIMED (75 min, no notes)	Review every wrong answer; re-read the relevant `research/` section	GO/NO-GO SCORE - see gate below

GO/NO-GO gate (Day 7):

≥ 75% on Set A → GO. Book the exam. Continue to Week 2.
65-74% → conditional go. Continue but reassess Day 14.
< 65% → PUSH the exam by 7-14 days. A fail costs $500 retake + 14-day wait. Don’t gamble.

Week 1 weekly total: ~22 hours

Week 2 - Heavyweight + Mocks (Days 8-14)

Goal: Drill the high-weight domains (D3.C 28%, D3.B 16%) + take Set B mock.

Day	AM (90 min)	PM (90 min)	Deliverable
8	Re-read `research/05` (Web/SQLi section) + OWASP Top 10 2021/2025	PortSwigger Practitioner labs (10 more)	OWASP card set from `domains/01-flashcards.md` drilled
9	Re-read `research/05` (Crypto section) - focus on RSA, ECC, AES, SHA-2, hash collisions, PKI/OCSP	`tools/02-essential-tools-cheatsheet.md` Nmap section end-to-end	Crypto cheat sheet of your own (1 page)
10	Re-read `research/05` (Cloud/IoT/OT)	HTB Academy 1 module (e.g., “Linux Fundamentals” or “Web Fundamentals”)	Cloud shared-responsibility diagram + Purdue model
11	Re-read `research/04` (DoS table + session hijack)	Lab: simulate SYN flood (small, in lab) + packet capture	1 DoS demo + 1 ARP poisoning demo
12	Re-read `research/06` (procedures, legal, SG law)	Drill SG law cards (CMCA, PDPA, CSA) + PTES stages from `99-cheatsheet.md`	Memorised: 5 pen-test phases + 6 SG law facts
13	Take `practice/02-mcq-set-b.md` TIMED (75 min, no notes)	Review every wrong answer; map each to a `research/` file	Set B score
14	Re-drill Set A (50 Q timed again)	Take `practice/03-mcq-set-c.md` TIMED (40 min, hardest)	Set A and Set C scores

Day-14 gate:

Both Set A and Set B ≥ 80% AND Set C ≥ 70% → CONFIRMED PASS. Continue but lighten the load.
75-79% on Set A or Set B → Week 3 = full remediation on weakest 2 domains.
< 75% on either → seriously consider rescheduling by 1 week.

Week 2 weekly total: ~22 hours

Week 3 - Mocks + Taper (Days 15-21)

Goal: Hit 90%+ on practice. Taper. Exam Day 21.

Day	AM (90 min)	PM (90 min)	Deliverable
15	Drill flashcards - focus on D3.C (38 cards)	Lab: re-run the 5 hardest PortSwigger labs (clean, no hints)	Flashcard pass-through
16	Drill flashcards - D3.B (24 cards) + D4 (19 cards)	Re-read `99-cheatsheet.md` end-to-end once	Cheatsheet fully internalised
17	Re-take Set B (50 Q, 75 min, no notes)	Re-take Set A (50 Q, 75 min)	Set A + Set B scores again
18	Targeted review of every question missed across Sets A+B+C (compile a “missed” list)	HTB/THM: 1 box end-to-end, time-boxed (90 min)	1 box pwned + missed-list drilled
19	Light review - only `99-cheatsheet.md` + your missed-list + Singapore law cards	Light review - only flashcards, no new content	Confidence check
20	REST. No studying. Sleep 8+ hours. Light walk.	Pack bag (passport, confirmation email, water, snack). Read `research/01-exam-logistics.md` § Exam Day.	Rested
21	EXAM DAY. 9-11 AM slot. Arrive 30 min early.	Celebrate or remediate	PASS

Week 3 weekly total: ~18 hours

📊 The 50% High-Leverage Topics (memorise these hard)

These account for ~50% of the exam. Master them and you’re in pass territory even if other areas are shaky.

Topic	Est. questions	Memory hook
Nmap flags	6-8	`-sS` SYN, `-sT` TCP, `-sU` UDP, `-sN` NULL, `-sF` FIN, `-sX` XMAS, `-sA` ACK, `-sI` IDLE, `-sV` version, `-O` OS, `-A` aggressive, `-Pn` no-ping, `-f` fragment, `-D` decoy, `-g` source port
OWASP Top 10 2021	8-12	A01 access ctrl, A02 crypto, A03 injection (SQLi/XSS), A04 insecure design, A05 misconfig, A06 vulnerable comp, A07 auth fail, A08 integrity fail, A09 logging fail, A10 SSRF
Kill Chain + ATT&CK	5-8	Lockheed 7 phases; MITRE 14 tactics; CEH 5 phases
Default ports	5-8	21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 445 SMB, 1433 MSSQL, 3306 MySQL, 3389 RDP, 5432 PostgreSQL, 5900 VNC
Tool recognition	8-12	“Which tool does X” - Nmap, Wireshark, Burp, sqlmap, Hydra, John, Hashcat, Metasploit, Aircrack, Mimikatz, Nikto, OWASP ZAP, Maltego, theHarvester
Crypto algorithms	4-6	DES/3DES broken; AES-128/256 strong; RSA ≥ 2048; ECC 256 = RSA 3072; MD5/SHA-1 broken; SHA-2/SHA-3 strong; HMAC for API signing

🪶 What to Drop / Skim (low ROI in 3 weeks)

Topic	Est. questions	Why de-prioritise
AI/v13 deep details	1-3	Newer, no good practice material; “is prompt injection X” gets you 80% of the marks
Detailed IoT/OT protocols (Modbus, DNP3, Purdue levels)	2-4	Just memorise Mirai dictionary + Stuxnet/PIPEDREAM attack chain
Deep PKI/X.509 chain validation	1-2	CRL vs OCSP is enough
Detailed case laws (CFAA subsections, etc.)	1-2	CMCA + PDPA + “get written authorisation” is enough for SG exam
Snort/Suricata rule syntax	1-2	Know what an IDS/IPS does, not the rule grammar

⚠️ Pre-Booking Gate (Day 7 minimum)

Set A score	Decision
≥ 85%	Confident pass. Book exam.
75-84%	Likely pass. Book exam; keep day 14 as a soft re-check.
65-74%	Borderline. Continue but plan to reschedule to Day 28 if Day 14 not 80%+.
< 65%	Don’t sit. Reschedule.

Industry pass rate estimate: 75%+ on practice = 80% first-attempt pass rate. Below 70% = likely fail. Target 90%+ for safety against the variable cut score.

🛟 If You Slip / Fall Behind

Miss 1 day → don’t catch up, redistribute to weekend
Miss 2 days → drop AI/v13 deep study, focus on the 50% high-leverage list
Miss 3+ days → reschedule exam by 7-14 days ($0 if ≥48h before; $49 voucher extension if <48h)
Day 14 score < 75% → seriously consider reschedule
Day 18 score < 85% → almost certainly reschedule

💰 Cost (Singapore, ANSI path, self-study)

Item	Cost (SGD)
Eligibility application (if you don’t have training bundle)	~S$140
Pearson VUE voucher (S$1,199 USD × 1.35)	~S$1,620
Boson CEH practice test (optional but recommended)	~S$170
THM 1-month premium (optional)	~S$28
Total	~S$1,960
With SkillsFuture SSG (training path)	S$75-S$317 net

NB: ANSI self-study path is fastest to schedule. Training path requires SkillsFuture enrollment lead time (1-2 weeks). For a 3-week sprint, self-study is the only realistic option.

🏁 Day-21 Exam Day Rules

Sleep 7+ hours the night before. This is non-negotiable.
Eat a real breakfast. Bring a snack (banana, energy bar).
Arrive 30 min early. Pearson VUE check-in takes 10-15 min.
Bring: passport (NOT NRIC), confirmation email (printed or on phone), water.
Strategy:
- First pass: 1-1.5 hr, answer all easy/medium questions, flag hard ones
- Second pass: 1 hr, tackle flagged questions
- Third pass: 30-45 min, review flagged + quick check on all
Time per question budget: ~100 sec average; don’t dwell.
Eliminate > Memorise: on tough questions, kill the 2 obviously wrong options first.
Trust your first instinct on review - research shows first answer is more often right.
Click through the NDA at the start. Don’t read it carefully - you’ve already agreed.
You can flag + come back. Use this aggressively.

After the exam: Score appears on transcript immediately. Pass = you celebrate. Fail = read the score report, target weak domains, retake after 14-day cool-off (free retake if you bought the training bundle; $500 retake voucher otherwise).

TL;DR

Book exam for Day 21 TODAY.
3 hrs/day. 90 min AM + 90 min PM. Weekends 4-5 hr.
Memorise the 50% high-leverage list (Nmap + OWASP + Kill Chain + Ports + Tools + Crypto).
Take Set A on Day 7. Gate: 75%+.
Take Set B + Set C on Days 13-14. Gate: 80%+.
Days 15-19: drill + mock. Day 20: rest. Day 21: pass.

You’ve got this. (ISC)² CC proved you can pass 125-question, 4-hour exams. CEH is broader and more tool-flavoured, but the same discipline applies.