Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. An Application layer protocol for managing devices on an IP network.






2. Provides data encryption for IEEE 802.11 wireless networks so data can only be decrypted by the intended recipients.






3. The act of checking some sequence of tokens for the presence of the constituents of some pattern.






4. A proprietary - open - wireless technology used for transferring data from fixed and mobile devices over short distances.






5. The contents of a packet. A system attack requires the attacker to deliver a malicious payload that is acted upon and executed by the system.






6. Traffic-passing technique used by bridges and switches in which traffic received on an interface is sent out all interfaces on the device except the interface on which the information was originally received. Traffic on a switch is flooded when it is






7. Formal description and evaluation of the vulnerabilities in an information system






8. A method of evaluating the security of a computer system or network by simulating an attack from a malicious source.






9. nmap






10. Using conversation or some other interaction between people to gather useful information.






11. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






12. A technology where you advertise one IP address externally and data packets are rerouted to the appropriate IP address inside your network by a device providing translation services. In this way - IP addresses of machines on your internal network are






13. Another term for firewalking






14. A type of malware that covertly collects information about a user.






15. The process of determining if a network entity (user or service) is legitimate






16. The act of using numerous electronic serial numbers on a cell phone until a valid number is located.






17. The subjective - potential percentage of loss to a specific asset if a specific threat is realized. The exposure factor (EF) is a subjective value the person assessing risk must define.






18. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.






19. A series of documents and notes on standards used or proposed for use on the Internet; each is identified by a number.






20. A program designed to browse websites in an automated - methodical manner. Sometimes these programs are used to harvest information from websites - such as e-mail addresses.






21. Insane scan timing






22. In penetration testing - this is a method of testing the security of a system or subnet without any previous knowledge of the device or network. Designed to simulate an attack by an outside intruder (usually from the Internet).






23. An early network application that provides information on users currently logged on to a machine.






24. A one-way mathematical function that generates a fixedlength numerical string (hash) from a given data input. MD5 and SHA-1 are hashing algorithms.






25. ICMP Type/Code 0-0






26. A secret - typically consisting of only decimal digits - that a claimant memorizes and uses to authenticate his identity






27. Occurs when authorized users accumulate excess privileges on a system due to moving from position to position.






28. The result of using a private key to encrypt a hash value for identification purposes within a PKI system. The signature can be decoded by the originator's public key - verifying his identity and providing non-repudiation. A valid digital signature g






29. A symmetric key cipher where plaintext bits are combined with a pseudo-random cipher bit stream (keystream) - typically by an exclusive-or (XOR) operation. In a stream cipher the plaintext digits are encrypted one at a time - and the transformation o






30. An Application layer protocol for sending electronic mail between servers.






31. An inspection of a place where a company or individual proposes to work - to gather the necessary information for a design or risk assessment.






32. Whether purposeful or the result of malware or other attack - a backdoor is a hidden capability in a system or program for bypassing normal computer authentication systems.






33. Hex 12






34. Port 80/81/8080






35. Access by information systems (or users) communicating from outside the information system security perimeter.






36. Microsoft SID 500






37. A method of external testing whereby several systems or resources are used together to effect an attack.






38. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






39. An organization composed of engineers - scientists - and students who issue standards related to electrical - electronic - and computer engineering.






40. A term representing the responsibility managers and their organizations have to provide information security to ensure the type of control - the cost of control - and the deployment of control are appropriate for the system being managed.






41. don't ping






42. Nmap normal output






43. Polymorphic Virus






44. A host designed to collect data on suspicious activity.






45. A standard developed to enable routers to exchange messages containing information about routes to reach subnets in the network.






46. Injecting traffic into the network to identify the operating system of a device.






47. The monetary value expected from the occurrence of a risk on an asset. It is mathematically expressed as single loss expectancy (SLE) = asset value (AV)






48. ICMP Ping






49. The process of a system providing a fully qualified domain name (FQDN) to a local name server - for resolution to its corresponding IP address.






50. A system used by the Securities and Exchange Commission (SEC) for companies and businesses to transmit required filings and information. The EDGAR database performs automated collection - validation - indexing - acceptance - and forwarding of submiss