Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A cyber attacker who acts without permission from - and gives prior notice to - the resource owner. Also known as a malicious hacker.






2. Insane scan timing






3. A mathematical operation requiring two binary inputs: If the inputs match - the output is a 0 - otherwise it is a 1.






4. 18 U.S.C. 1030






5. A command that instructs the system processor to do nothing. Many overflow attacks involve stringing several NOP operations together (known as a NOP sled).






6. A biometric device that uses pattern-recognition techniques based on images of the irises of an individual's eyes.






7. Hex 10






8. Directory Transversal






9. A method of external testing whereby several systems or resources are used together to effect an attack.






10. The subjective - potential percentage of loss to a specific asset if a specific threat is realized. The exposure factor (EF) is a subjective value the person assessing risk must define.






11. A device on a network.






12. The act of checking some sequence of tokens for the presence of the constituents of some pattern.






13. An Internet routing protocol used to exchange routing information within an autonomous system.






14. Looking over an authorized user's shoulder in order to steal information (such as authentication information).






15. Another term for firewalking






16. A symmetric key cipher where plaintext bits are combined with a pseudo-random cipher bit stream (keystream) - typically by an exclusive-or (XOR) operation. In a stream cipher the plaintext digits are encrypted one at a time - and the transformation o






17. A string that represents the location of a web resource






18. A malicious computer program with self-replication capabilities that attaches to another file and moves with the host from one computer to another.






19. A networking configuration where all nodes are connected in a circle with no terminated ends on the cable.






20. The act of dialing all numbers within an organization to discover open modems.






21. The process of determining if a network entity (user or service) is legitimate






22. The rate at which a biometric system will incorrectly identify an unauthorized individual and allow them access (see false negative).






23. Shifting responsibility from one party to another






24. A point of reference used to mark an initial state in order to manage change.






25. The central part of a computer or communications system hardware firmware - and software that implements the basic security procedures for controlling access to system resources.






26. Describes practices in production and development that promote access to the end product's source materials.






27. Malicious code that uses a polymorphic engine to mutate while keeping the original algorithm intact; the code changes itself each time it runs - but the function of the code will not change.






28. The result of using a private key to encrypt a hash value for identification purposes within a PKI system. The signature can be decoded by the originator's public key - verifying his identity and providing non-repudiation. A valid digital signature g






29. Name given to expert groups that handle computer security incidents.






30. Hashing algorithm that results in a 128-bit output.






31. Port 31337






32. A derogatory term used to describe an attacker - usually new to the field - who uses simple - easy-to-follow scripts or programs developed by others to attack computer systems and networks and deface websites.






33. A record showing which user has accessed a given resource and what operations the user performed during a given period.






34. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






35. An application that monitors a computer or network to identify - and prevent - malware. AV is usually signature-based - and can take multiple actions on defined malware files/activity.






36. Security identifier. The method by which Windows identifies user - group - and computer accounts for rights and permissions.






37. A condition that occurs when more data is written to a buffer than it has space to store - and results in data corruption or other system errors. This is usually due to insufficient bounds checking - a bug - or improper configuration in the program c






38. A social-engineering effort in which the attacker pretends to be an employee - a valid user - or even an executive to elicit information or access.






39. An unknown deficiency in software or some other product that results in a security vulnerability being identified.






40. An Application layer protocol used by local email clients to retrieve e-mail from a remote server over a TCP/IP connection.






41. Hex 14






42. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






43. Management policy and procedures designed to maintain or restore business operations - including computer operations - possibly at an alternate location - in the event of emergencies - system failures - or disaster.






44. The process of a system providing a fully qualified domain name (FQDN) to a local name server - for resolution to its corresponding IP address.






45. Any circumstance or event with the potential to adversely impact organizationaloperations - organizational assets - or individuals through an information system via unauthorized access - destruction - disclosure - modification of information - and/or






46. A person or entity indirectly involved in a relationship between two principles.






47. Nmap ml output






48. A stand-alone computer - kept off the network - that is used for scanning potentially malicious media or software.






49. A point-to-point connection between two endpoints created to exchangedata. Typically a tunnel is either an encrypted connection - or a connection using a protocol in a method for which it was not designed. An encrypted connection forms a point-to-poi






50. A device that receives and sends data packets between two or more networks; the packet headers and a forwarding table provide the router with the information necessary for deciding which interface to use to forward packets.