CMIT 321: Ethical Hacking

CMIT 321 teaches UMGC students to think like attackers so they can protect networks better, always within legal and ethical limits.

UMGC describes it as the development of the structured knowledge base needed to discover vulnerabilities and recommend solutions for tightening network security and protecting data from potential attackers.

The focus is on penetration-testing tools and techniques. The course (formerly CMIT 398E) is designed to help prepare for the EC-Council Certified Ethical Hacker certifications.

Students usually enjoy the tools; the harder part is the report. Findings only help an organization when they are explained clearly and paired with practical fixes.

What CMIT 321 Covers

Key Concepts Explained

Authorization and Scope

Ethical hacking is only ethical with written permission and a defined scope. Testing systems you do not own or have no permission to test can be illegal. Course labs provide a safe, authorized environment; practice only there or on your own systems.

Vulnerability, Exploit and Risk

A vulnerability is a weakness; an exploit is a method that takes advantage of it; risk depends on how likely and damaging that would be. Reports should rate findings consistently, often using CVSS scores as a reference.

Scanning Basics

Port scanners identify open ports and services. Knowing what a result means (for example, an open SSH port on a database server) and whether it should be exposed is more important than the scan itself.

Passive and Active Reconnaissance

Reconnaissance comes first and shapes everything after it. Passive reconnaissance gathers information without touching the target directly, for example from public websites, DNS records and job adverts that reveal technologies in use. Active reconnaissance interacts with the target, such as scanning ports, and is more likely to be logged.

In a lab report, record what each source revealed and how it guided the next step. That shows structured thinking rather than random tool use, which is exactly the "structured knowledge base" UMGC's description emphasizes. Remember that even passive techniques must stay within the authorized scope of the exercise.

Writing a Penetration Test Report

A professional report usually includes:

• Executive summary: the overall risk in plain language.
• Scope and method: what was tested, when and how.
• Findings: each with description, evidence, severity and affected systems.
• Recommendations: specific, prioritized fixes.

Write for two audiences: managers who read the summary and technicians who act on the detail.

Typical Assignments and How to Approach Them

Where Students Get Stuck

• Tool output without interpretation. Explain what each result means for security.
• Vague fixes. "Improve security" is not a recommendation.
• Inconsistent severity. Use one rating approach throughout.
• Working outside the lab. Never test systems without permission.

Study Tips for CMIT 321

• Keep notes organized by testing phase, with the tools used in each.
• Take screenshots as you work; recreating evidence later is hard.
• Read the CEH exam blueprint for scope.
• Practice writing a two-sentence executive summary for every lab.

How We Help with CMIT 321

Send the lab instructions, rubric and your notes or screenshots. A security tutor can explain techniques and results, prepare a model findings report, or edit your write-up for clarity. For technical write-up structure, see our lab report guide.

GradeEssays is independent of the University of Maryland Global Campus and EC-Council. We tutor within the course's authorized lab context only; we never test real systems, take quizzes or exams, sit certifications, or log in to your classroom or labs.