Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A list of IP addresses and corresponding MAC addresses stored on a local computer.






2. A domain composed of all the systems sharing any given physical transport media. Systems within a collision domain may collide with each other during the transmission of data. Collisions can be managed by CSMA/CD (collision detection) or CSMA/CA (col






3. A set of hardware - software - people - policies - and procedures needed to create - manage - distribute - use - store - and revoke digital certificates.






4. An attack that combines a brute-force attack with a dictionary attack.






5. nmap all output






6. Incremental Substitution






7. A device providing temporary - on-demand - point-to-point network access to users.






8. A well-known and studied phenomenon of human nature - whereby a single trait influences the perception of other traits.






9. An application that monitors a computer or network to identify - and prevent - malware. AV is usually signature-based - and can take multiple actions on defined malware files/activity.






10. A widely used authentication protocol developed at the MassachusettsInstitute of Technology (MIT). Kerberos authentication uses tickets - Ticket Granting Service - and Key Distribution Center.






11. A limited-function version of the Internetworking Operating System (IOS) - held in read-only memory in some earlier models of Cisco devices - capable of performing several seldom-needed low-level functions such as loading a new IOS into Flash memory






12. A fully qualified domain name consists of a host and domain name - including a top-level domain such as .com - .net - .mil - .edu -and so on.






13. Recording the time - normally in a log file - when an event happens or when information is created or modified.






14. Port 135






15. An Ethernet networking system transmitting data at 100 million bits per second (Mbps) - 10 times the speed of an earlier Ethernet standard. Derived from the Ethernet 802.3 standard - it is also known as 100BaseT.






16. In computer security - this is an algorithm that uses separate keys for encryption and decryption.






17. 1. The path a packet travels to reach the intended destination. Each individual device along the path traveled is called a hop. 2. Information contained on a device containing instructions for reaching other nodes on the network. This information can






18. A type of denial-of-service attack where a hacker sends thousands of SYN packets to the target with spoofed IP addresses.






19. The last portion of the SID that identifies the user to the system in Windows. A RID of 500 identifies the administrator account.






20. A network administration command-line tool available for many operating systems for querying the Domain Name System (DNS) to obtain domain name or IP address mappings or any other specific DNS record.






21. A security protocol for wireless local area networks defined in the 802.11b standard; intended to provide the same level of security as a wired LAN. WEP is not considered strong security - although it does authenticate clients to access points - encr






22. A network architecture framework developed by ISO that describes the communications process between two systems across the Internet in seven distinct layers.






23. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






24. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






25. An attack that exploits the common mistake many people make when installing operating systems






26. A three-step process computers execute to negotiate a connection with one another. The three steps are SYN - SYN/ACK - ACK.






27. An API that provides services related to the OSI model's Session layer - allowing applications on separate computers to communicate over a LAN.






28. A software license agreement; a contract between the 'licensor' and purchaser establishing the right to use the software.






29. A NAT method in which multiple internal hosts - using private IP addressing - can be mapped through a single public IP address using the session IDs and port numbers. An internal global IP address can support in excess of 65 -000 concurrent TCP and U






30. The basis of this kind of security is that an individual user - or program operating on the user's behalf - is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the use






31. An attack in which a hacker steps between two ends of an already-established communication session and uses specialized tools to guess sequence numbers to take over the channel.






32. An international organization composed of national standards bodies from over 75 countries. Developed the OSI reference model.






33. A network system of servers that translates numeric Internet Protocol (IP) addresses into human-friendly - hierarchical Internet addresses - and vice versa.






34. A section or subset of the network. Often a router or other routing device provides the end point of the segment.






35. A data encryption/decryption program often used for e-mail and file storage.






36. Calculations of two components of risk: R - the magnitude of the potential loss (L) - and the probability - p - that the loss will occur.






37. An attack technique that tricks your DNS server into believing it has received authentic information when - in reality - it has been provided fraudulent data. DNS cache poisoning affects user traffic by sending it to erroneous or malicious end points






38. Baseband LAN specification developed by Xerox Corporation - Intel - and Digital Equipment Corporation. One of the least expensive - most widely deployed networking standards; uses the CSMA/CD method of media access control.






39. A piece of software - provided by the vendor - intended to update or fix known - discovered problems in a computer program or its supporting data.






40. A computer system that performs tasks dictated by an attacker from a remote location. Zombies may be active or idle - and owners of the systems generally do not know their systems are compromised.






41. An early network application that provides information on users currently logged on to a machine.






42. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is - clearance) of users to access information of such sensi






43. ICMP Type/Code 8






44. A programming principle whereby the last piece of data added to the stack is the first piece of data taken off.






45. All measures and techniques taken to gather information about an intended target. Footprinting can be passive or active.






46. The potential for damage to or loss of an IT asset






47. An approach to restricting system access to authorized users in which roles are created for various job functions. The permissions to perform certain operations are assigned to specific roles. Members of staff (or other system users) are assigned par






48. A self-replicating malicious program that attempts installation beneath antivirus software by directly intercepting the interrupt handlers of the operating system to evade detection.






49. An attack where the hacker positions himself between the client and the server - to intercept (and sometimes alter) data traveling between the two.






50. The use of deceptive computer-based means to trick individuals into disclosing sensitive personal information