Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The rate at which a biometric system will incorrectly reject an access attempt by an authorized user.






2. An outdated symmetric cipher encryption algorithm - previously U.S. government-approved and used by business and civilian government agencies. DES is no longer considered secure due to the ease with which the entire keyspace can be attempted using mo






3. Devices - connected to one or more switches - grouped logically into a single broadcast domain. VLANs enable administrators to divide the devices connected to the switches into multiple VLANs without requiring separate physical switches.






4. A type of DNS transfer - where all records from an SOA are transmitted to the requestor. Zone transfers have two options: full (opcode AXFR) and incremental (IXFR).






5. Nmap grepable output






6. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive






7. A software or hardware defect that often results in system vulnerabilities.






8. Port 135






9. Drawing symbols in public places to alert others to an open Wi-Fi network. War chalking can include the SSIDs - administrative passwords to APs - and other information.






10. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.






11. In penetration testing - enumeration is the act of querying a device or network segment thoroughly and systematically for information.






12. An Application layer protocol - using TCP - for transporting files across an Internet connection. FTP transmits in clear text.






13. Weakness in an information system - system security procedures - internal controls - or implementation that could be exploited or triggered by a threat source.






14. An attack where the hacker positions himself between the client and the server - to intercept (and sometimes alter) data traveling between the two.






15. A defined measure of service within a network system






16. A social-engineering attack using computer resources - such as e-mail or IRC.






17. The process of embedding information into a digital signal in a way that makes it difficult to remove.






18. A stand-alone computer - kept off the network - that is used for scanning potentially malicious media or software.






19. Port 137/138/139






20. A wireless networking mode where all clients connect to the wireless network through a central access point.






21. Physical socket provided on routers and switches for cable connections between a computer and the router/switch. This connection enables the computer to configure - query - and troubleshoot the router/switch by use of a terminal emulator and a comman






22. A connectionless - layer 4 transport protocol. UDP is faster than TCP - but offers no reliability. A best effort is made to deliver the data - but no checks and verifications are performed to guarantee delivery. Therefore - UDP is termed a 'connectio






23. Actions - devices - procedures - techniques - or other measures intended to reduce the vulnerability of an information system.






24. A device set up to send a response on behalf of an end node to the requesting host. Proxies are generally used to obfuscate the host from the Internet.






25. A virus designed to infect the master boot record.






26. A collection of historical records or the place where they are kept. In computing - an archive generally refers to backup copies of logs and/or data.






27. A utility that sends an ICMP Echo message to determine if a specific IP address is accessible; if the message receives a reply - the address is reachable.






28. Using conversation or some other interaction between people to gather useful information.






29. ICMP Netmask






30. An electronic version of junk mail. Unsolicited commercial e-mail sent to numerous recipients.






31. A social-engineering attack that manipulates the victim into calling the attacker for help.






32. The last portion of the SID that identifies the user to the system in Windows. A RID of 500 identifies the administrator account.






33. A method of evaluating the security of a computer system or network by simulating an attack from a malicious source.






34. An authentication method on point-to-point links - using a three-way handshake and a mutually agreed-upon key.






35. The software product or system that is the subject of an evaluation.






36. Also known as a digital certificate - this is an electronic file used to verify a user's identity - providing non-repudiation throughout the system It is also a set of data that uniquely identifies an entity. Certificates contain the entity's public






37. The process of transforming ciphertext into plaintext through the use of a cryptographic algorithm.






38. Ports 20/21






39. The act of using numerous electronic serial numbers on a cell phone until a valid number is located.






40. Malicious code that uses a polymorphic engine to mutate while keeping the original algorithm intact; the code changes itself each time it runs - but the function of the code will not change.






41. Hashing algorithm that results in a 128-bit output.






42. ACK Scan






43. The steps taken to gather evidence and information on the targets you wish to attack.






44. The level of importance assigned to an IT asset






45. A social-engineering effort in which the attacker pretends to be an employee - a valid user - or even an executive to elicit information or access.






46. A background process found in Unix - Linux - Solaris - and other Unix-based operating systems.






47. A Canonical Name record within DNS - used to provide an alias for a domain name.






48. Used for exchanging structured information - such as XML-based messages - in the implementation of web services






49. An organization's threshold for the seven areas of information security responsibility. This level is established based on the objectives for maintaining confidentiality - integrity - and availability of the organization's IT assets and infrastructur






50. Another term for firewalking