SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The contents of a packet. A system attack requires the attacker to deliver a malicious payload that is acted upon and executed by the system.
payload
Last In First Out (LIFO)
Asymmetric
symmetric algorithm
2. A means of exchanging information from one entity to another using a process that does not provide an attacker the opportunity to reorder - delete - insert - or read information.
rogue access point
firewall
secure channel
Wireless Local Area Network (WLAN)
3. An international organization composed of national standards bodies from over 75 countries. Developed the OSI reference model.
ISO 17799
Decryption
SID
International Organization for Standardization (ISO)
4. A stand-alone computer - kept off the network - that is used for scanning potentially malicious media or software.
Vulnerability
sheepdip
Simple Object Access Protocol (SOAP)
Due Diligence
5. Freely and readily available information on an organization that can be gathered by a business entity about its competitor's customers - products - and marketing - and can be used by an attacker to build useful information for further attacks.
encryption
OpenBSD
Competitive Intelligence
-sO
6. In a classful IPv4 subnet - this is the network number with all binary 0s in the subnet part of the number. When written in decimal - the zero subnet has the same number as the classful network number.
John the Ripper - LOphtcrack - Ophtcrack - Cain and Abel
honeynet
Defines legal email marketing
Zero Subnet
7. Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality - integrity - or availability of an information system. A virus - worm - Trojan horse - or other code-based entity that infects a
Malicious code
steganography
intrusion detection system (IDS)
firewall
8. A well-known and studied phenomenon of human nature - whereby a single trait influences the perception of other traits.
-sP
-oX
halo effect
Trojan Horse
9. The means by which a recipient of a message can ensure the identity of the sender and that neither party can deny having sent or received the message. The most common method is through digital certificates.
gray hat
Ethical Hacker
Daemon
non-repudiation
10. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive
LDAP
Data Link layer
International Organization for Standardization (ISO)
Certificate
11. Controlling access to a network by analyzing the headers of incoming and outgoing packets - and letting them pass or discarding them based on rule sets created by a network administrator. A packet filter allows or denies packets based on destination
Vulnerability
packet filtering
passive attack
Zenmap
12. Also known as the dot-dot-slash attack. Using directory traversal - the attacker attempts to access restricted directories and execute commands outside intended web server directories by using the URL to redirect to an unintended folder location.
Directory Traversal
Multipurpose Internet Mail Extensions (MIME)
initial sequence number (ISN)
symmetric encryption
13. A secret - typically consisting of only decimal digits - that a claimant memorizes and uses to authenticate his identity
Database
RPC-DCOM
SYN attack
personal identification number (PIN)
14. A distance-vector routing protocol that employs the hop count as a routing metric. The 'hold down time -' used to define how long a route is held in memory - is 180 seconds. RIP prevents routing loops by implementing a limit on the number of hops all
Point-to-Point Tunneling Protocol (PPTP)
Due Care
Routing Information Protocol (RIP)
War Driving
15. A self-replicating - self-propagating - self-contained program that uses networking mechanisms to spread itself.
steganography
-sO
Worm
POST
16. Provides router-to-router or host-to-network connections over asynchronous and synchronous circuits.
null session
port scanning
Point-to-Point Protocol (PPP)
File Transfer Protocol (FTP)
17. A protocol for transporting data packets across a packet switched internetwork (such as the Internet). IP is a routed protocol.
Internet Protocol (IP)
network tap
S
gray hat
18. The public portion of an asymmetric key pair typically used to encrypt data or verify signatures. Public keys are shared and are used to encrypt messages.
public key
spoofing
integrity
port knocking
19. A cryptographic attack where bits are manipulated in the ciphertext itself to generate a predictable outcome in the plaintext once it is decrypted.
Active Attack
-sW
Copyright
Bit Flipping
20. A text file stored within a browser by a web server that maintains information about the connection. Cookies are used to store information to maintain a unique but consistent surfing experience - but can also contain authentication parameters. Cookie
Acceptable Use Policy (AUP)
Address Resolution Protocol (ARP)
-sI
Cookie
21. An industry standard protocol used for accessing and managing information within a directory service; an application protocol for querying and modifying data using directory services running over TCP/IP.
POST
Confidentiality
Lightweight Directory Access Protocol (LDAP)
Point-to-Point Tunneling Protocol (PPTP)
22. A network deployed as a trap to detect - deflect - or deter unauthorized use of information systems.
honeynet
Defense in Depth
red team
Due Care
23. A small Trojan program that listens on port 777.
MAC filtering
packet
Tini
-sL
24. A software or hardware defect that often results in system vulnerabilities.
NOP
Virtual Private Network (VPN)
Bug
Access Creep
25. RPC Scan
Google hacking
No previous knowledge of the network
Smurf attack
-sR
26. The condition of a resource being ready for use and accessible by authorized users.
public key
National Security Agency
Information Technology (IT) security architecture and framework
Availability
27. Malware designed to install some sort of virus - backdoor - and so on - on a target system.
Redundant Array of Independent Disks (RAID)
Level III assessment
Droppers
XOR Operation
28. Set of tools (applications or code) that enables administrator-level accessto a computer or computer network and is designed to obscure the fact that the system has been compromised. Rootkits are dangerous malware entities that provide administrator
Network Address Translation (NAT)
rootkit
Wide Area Network (WAN)
-sT
29. Formal description and evaluation of the vulnerabilities in an information system
Vulnerability Assessment
port redirection
Due Care
A
30. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.
serialize scans & 0.4 sec wait
qualitative analysis
Blowfish
Assessment
31. Controls to detect anomalies or undesirable events occurring on a system.
Open System Interconnection (OSI) Reference Model
Detective Controls
ad hoc mode
encryption
32. Port 53
Zombie
File Allocation Table (FAT)
identity theft
DNS
33. A computer network confined to a relatively small area - such as a single building or campus - in which devices connect through high-frequency radio waves using IEEE standard 802.11.
Directory Traversal
serialize scans & 15 sec wait
session hijacking
Wireless Local Area Network (WLAN)
34. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.
Cloning
Internet Control Message Protocol (ICMP)
Last In First Out (LIFO)
Level I assessment
35. A principle in security engineering that attempts to use anonymity and secrecy (of design - implementation - and so on) to provide security; the footprint of the organization - entity - network - or system is kept as small as possible to avoid intere
Buffer Overflow
-sT
Access Point (AP)
security by obscurity
36. Calculations of two components of risk: R - the magnitude of the potential loss (L) - and the probability - p - that the loss will occur.
-sW
Trapdoor Function
Domain Name System (DNS)
quantitative risk assessment
37. A skilled hacker that straddles the line between white hat (hacking only with permission and within guidelines) and black hat (malicious hacking for personal gain). Gray hats sometime perform illegal acts to exploit technology with the intent of achi
Asset
Kerberos
POP 3
gray hat
38. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.
signature scanning
Third Party
spyware
symmetric algorithm
39. A protocol for exchanging packets over a serial line.
Serial Line Internet Protocol (SLIP)
National Security Agency
NetBus
Cracker
40. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.
Digital Watermarking
-sI
National Security Agency
Information Technology Security Evaluation Criteria (ITSEC)
41. Method used by antivirus software to detect new - unknown viruses that have not yet been identified; based on a piece-by-piece examination of a program - looking for a sequence or sequences of instructions that differentiate the virus from 'normal' p
Cold Site
Local Administrator
heuristic scanning
LDAP
42. Establish Null Session
Malicious code
remote procedure call (RPC)
net use \[target ip]IPC$ '' /user:''
Warm Site
43. An informed decision to accept the potential for damage to or loss of an IT asset.
Echo request
Internet Protocol Security (IPSec) architecture
risk acceptance
heuristic scanning
44. Also known as a digital certificate - this is an electronic file used to verify a user's identity - providing non-repudiation throughout the system It is also a set of data that uniquely identifies an entity. Certificates contain the entity's public
Asset
Wiretapping
Certificate
POP 3
45. A nonnumerical - subjective risk evaluation. Used with qualitative assessment (an evaluation of risk that results in ratings of none - low - medium - and high for the probability.)
Threat
Hypertext Transfer Protocol Secure (HTTPS)
false rejection rate (FRR)
qualitative analysis
46. Evaluation in which testers attempt to penetrate the network.
Malware
Simple Mail Transfer Protocol (SMTP)
Bit Flipping
Level III assessment
47. The result of using a private key to encrypt a hash value for identification purposes within a PKI system. The signature can be decoded by the originator's public key - verifying his identity and providing non-repudiation. A valid digital signature g
-b
Eavesdropping
Digital Signature
Cookie
48. Port 31337
node
red team
Auditing
Back orifice
49. A network administration command-line tool available for many operating systems for querying the Domain Name System (DNS) to obtain domain name or IP address mappings or any other specific DNS record.
out-of-band signaling
CNAME record
Asset
nslookup
50. The steps taken to gather evidence and information on the targets you wish to attack.
impersonation
reconnaissance
Computer-Based Attack
Virus Hoax