Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A penetration test in which the ethical hacker has limited knowledge of the intended target(s). Designed to simulate an internal - but non-systemadministrator-level attack.






2. A social-engineering attack using computer resources - such as e-mail or IRC.






3. A symmetric - block-cipher data-encryption standard that uses a variablelength key that can range from 32 bits to 448 bits.






4. A method of external testing whereby several systems or resources are used together to effect an attack.






5. A self-replicating - self-propagating - self-contained program that uses networking mechanisms to spread itself.






6. A wireless LAN security standard developed by IEEE. Requires Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).






7. A simple PPP authentication mechanism in which the user name and password are transmitted in clear text to prove identity. PAP compares the user name and password to a table listing authorized users.






8. A cryptographic attack where bits are manipulated in the ciphertext itself to generate a predictable outcome in the plaintext once it is decrypted.






9. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






10. Attacks that take advantage of the built-in code and scripts most off-the-shelf applications come with.






11. A security tool designed to protect a system or network against attacks by comparing traffic patterns against a list of both known attack signatures and general characteristics of how attacks may be carried out. Threats are rated and reported.






12. Another term for firewalking






13. A protocol used for sending and receiving log information for nodes on a network.






14. A fully operational off-site data-processing facility equipped with hardware and system software to be used in the event of a disaster.






15. A protocol defining packets that are able to be routed by a router.






16. The public portion of an asymmetric key pair typically used to encrypt data or verify signatures. Public keys are shared and are used to encrypt messages.






17. A security protocol used in IEEE 802.11i to replace WEP without the requirement to replace legacy hardware.






18. Content Addressable Memory table. Holds all the MAC-address-to-port mappings on a switch.






19. A form of fraud in which someone pretends to be someone else by assuming that person's identity - typically in order to access resources or obtain credit and other benefits in that person's name.






20. Literally - 'not balanced or the same.' In computing - asymmetric refers to a difference in networking speeds upstream to downstream. In cryptography - it's the use of more than one key for encryption/authentication purposes.






21. Aggressive scan timing






22. Polymorphic Virus






23. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






24. A type of malware that covertly collects information about a user.






25. Attacks on the actual programming code of an application.






26. A device set up to send a response on behalf of an end node to the requesting host. Proxies are generally used to obfuscate the host from the Internet.






27. Incremental Substitution






28. ICMP Type/Code 3-13






29. A utility that sends an ICMP Echo message to determine if a specific IP address is accessible; if the message receives a reply - the address is reachable.






30. An Application layer protocol for sending electronic mail between servers.






31. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.






32. The lack of clocking (imposed time ordering) on a bit stream.






33. The conveying of official access or legal power to a person or entity.






34. A portion of memory used to temporarily store output or input data.






35. A hybrid of the HTTP and SSL/TLS protocols that provides encrypted communication and secure identification of a web server.






36. A communications channel that is being used for a purpose it was not intended for - usually to transfer information secretly.






37. don't ping






38. Formerly Redundant Array of Inexpensive Disks; a technology that provides increased storage functions and reliability through redundancy. This is achieved by combining multiple disk drive components into a logical unit - where data is distributed acr






39. A U.S. Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system.






40. A set of exclusive rights granted by the law of a jurisdiction to the author or creator of an original work - including the right to copy - distribute - and adapt the work.






41. A limited-function version of the Internetworking Operating System (IOS) - held in read-only memory in some earlier models of Cisco devices - capable of performing several seldom-needed low-level functions such as loading a new IOS into Flash memory






42. An environmentally conditioned workspace partially equipped with IT and telecommunications equipment to support relocated IT operations in the event of a significant disruption.






43. The security property that data is not modified in an unauthorized and undetected manner. Also - the principle and measures taken to ensure that data received is in the exact same condition and state as when it was originally transmitted.






44. A denial-of-service attack where the attacker sends a ping to the network's broadcast address from the spoofed IP address of the target. All systems in the subnet then respond to the spoofed address - eventually flooding the device.






45. LAN standard - defined by ANSI X3T9.5 - specifying a 100Mbps token-passing network using fiber-optic cable and a dualring architecture for redundancy - with transmission distances of up to two kilometers.






46. Two or more LANs connected by a high-speed line across a large geographical area.






47. An attack that exploits the common mistake many people make when installing operating systems






48. A software or hardware application or device that captures user keystrokes.






49. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.






50. A method of permitting only MAC addresses in a preapproved list network access. Addresses not matching are blocked.