Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The act of checking some sequence of tokens for the presence of the constituents of some pattern.






2. The act of searching for Wi-Fi wireless networks by a person in a moving vehicle - using a portable device.






3. A decision to reduce the potential for damage to or loss of an IT asset by taking some type of action






4. FTP Bounce Attack






5. A method of evaluating the security of a computer system or network by simulating an attack from a malicious source.






6. Independent review and examination of records and activities to assess the adequacy of system controls - to ensure compliance with established policies and operational procedures - and to recommend necessary changes.






7. A self-replicating - self-propagating - self-contained program that uses networking mechanisms to spread itself.






8. Weakness in an information system - system security procedures - internal controls - or implementation that could be exploited or triggered by a threat source.






9. A security tool designed to protect a system or network against attacks by comparing traffic patterns against a list of both known attack signatures and general characteristics of how attacks may be carried out. Threats are rated and reported.






10. Created by the U.S. Federal Communications Commission to uniquely identify mobile devices; often represented as an 11-digit decimal number or eight-digit hexadecimal number.






11. UDP Scan






12. A domain composed of all the systems sharing any given physical transport media. Systems within a collision domain may collide with each other during the transmission of data. Collisions can be managed by CSMA/CD (collision detection) or CSMA/CA (col






13. A cell phone attack in which the serial number from one cell phone is copied to another in an effort to copy the cell phone.






14. Layer 7 of the OSI reference model. The Application layer provides services to applications - which allow them access to the network. Protocols such as FTP and SMTP reside here.






15. The software product or system that is the subject of an evaluation.






16. Any circumstance or event with the potential to adversely impact organizationaloperations - organizational assets - or individuals through an information system via unauthorized access - destruction - disclosure - modification of information - and/or






17. An attack where the hacker manipulates parameters within the URL string in hopes of modifying data.






18. A virus that plants itself in a system's boot sector and infects the master boot record.






19. A method for detecting malicious code on a computer where the files are compared to signatures of known viruses stored in a database.






20. A card with a built-in microprocessor and memory used for identification or financial transactions. The card transfers data to and from a central computer when inserted into a reader.






21. A device that receives and sends data packets between two or more networks; the packet headers and a forwarding table provide the router with the information necessary for deciding which interface to use to forward packets.






22. The process of embedding information into a digital signal in a way that makes it difficult to remove.






23. Port 135






24. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






25. Literally - 'not balanced or the same.' In computing - asymmetric refers to a difference in networking speeds upstream to downstream. In cryptography - it's the use of more than one key for encryption/authentication purposes.






26. Any item of value or worth to an organization - whether physical or virtual.






27. A method used to prevent IDS detection by dividing the request into multiple parts that are sent in different packets






28. Port 22






29. A group of penetration testers that assess the security of an organization - which is often unaware of the existence of the team or the exact assignment.






30. nmap






31. A well-known and studied phenomenon of human nature - whereby a single trait influences the perception of other traits.






32. A type of encryption where the same key is used to encrypt and decrypt the message.






33. 1. The path a packet travels to reach the intended destination. Each individual device along the path traveled is called a hop. 2. Information contained on a device containing instructions for reaching other nodes on the network. This information can






34. Self-contained network with a limited number of participants who extend limited trust to one another in order to accomplish an agreed-upon goal.






35. Policy stating what users of a system can and cannot do with the organization's assets.






36. CAN-SPAM






37. Attacks on the actual programming code of an application.






38. A storage buffer that transparently stores data so future requests for the same data can be served faster.






39. A set of rules defined to screen network packets based on source address - destination address - or protocol; these rules determine whether the packet will be forwarded or discarded.






40. A device set up to send a response on behalf of an end node to the requesting host. Proxies are generally used to obfuscate the host from the Internet.






41. A protocol that uses a private key to encrypt data before transmitting confidential documents over the Internet; widely used on e-commerce - banking - and other sites requiring privacy.






42. A hacker who aims to bring down critical infrastructure for a 'cause' and does not worry about the penalties associated with his actions.






43. Black box test






44. A network architecture framework developed by ISO that describes the communications process between two systems across the Internet in seven distinct layers.






45. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is - clearance) of users to access information of such sensi






46. An attack that is direct in nature - usually where the attacker injects something into - or otherwise alters - the network or system target.






47. A person or entity indirectly involved in a relationship between two principles.






48. FIN Scan






49. Insane scan timing






50. The secret portion of an asymmetric key pair typically used to decrypt or digitally sign data. The private key is never shared and is always used for decryption - with one notable exception: The private key is used to encrypt the digital signature.