Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A domain composed of all the systems sharing any given physical transport media. Systems within a collision domain may collide with each other during the transmission of data. Collisions can be managed by CSMA/CD (collision detection) or CSMA/CA (col






2. A U.S. Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system.






3. The process of systematically testing each port on a firewall to map rules and determine accessible ports.






4. A software or hardware application or device that captures user keystrokes.






5. Physical socket provided on routers and switches for cable connections between a computer and the router/switch. This connection enables the computer to configure - query - and troubleshoot the router/switch by use of a terminal emulator and a comman






6. Also known as a public key certificate - this is an electronic file that is used to verify a user's identity - providing non-repudiation throughout the sys-tem. Certificates contain the entity's public key - serial number - version - subject - algori






7. RPC Scan






8. A piece of software - provided by the vendor - intended to update or fix known - discovered problems in a computer program or its supporting data.






9. An Application layer protocol used primarily by Microsoft Windows to provide shared access to printers - files - and serial ports. It also provides an authenticated interprocess communication mechanism.






10. A principle in security engineering that attempts to use anonymity and secrecy (of design - implementation - and so on) to provide security; the footprint of the organization - entity - network - or system is kept as small as possible to avoid intere






11. Calculations of two components of risk: R - the magnitude of the potential loss (L) - and the probability - p - that the loss will occur.






12. A nonnumerical - subjective risk evaluation. Used with qualitative assessment (an evaluation of risk that results in ratings of none - low - medium - and high for the probability.)






13. A unique hostname that is used to identify resources on the Internet. Domain names start with a root (.) - then add a top level (.com - .gov - or .mil - for example) - and a given name space.






14. A networking configuration where all nodes are connected in a circle with no terminated ends on the cable.






15. Baseband LAN specification developed by Xerox Corporation - Intel - and Digital Equipment Corporation. One of the least expensive - most widely deployed networking standards; uses the CSMA/CD method of media access control.






16. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






17. Directing a protocol from one port to another.






18. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is - clearance) of users to access information of such sensi






19. Authentication confirms the identity of the user or device. Authorization determines the privileges (rights) of the user or device. Accounting records the access attempts - both successful and unsuccessful.






20. Computer software or hardware that can intercept and log traffic passing over a digital network.






21. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






22. An Internet Protocol Security (IPSec) header used to verify that the contents of a packet have not been modified while the packet was in transit.






23. Hex 29






24. Port 53






25. Attacks that take advantage of the built-in code and scripts most off-the-shelf applications come with.






26. Polymorphic Virus






27. An adapter that provides the physical connection to send and receive data between the computer and the network media.






28. Controls to detect anomalies or undesirable events occurring on a system.






29. The process of determining if a network entity (user or service) is legitimate






30. Controls internal to a system designed to resolve vulnerabilities and errors soon after they arise.






31. IP Protocol Scan






32. Malware designed to install some sort of virus - backdoor - and so on - on a target system.






33. The Security Accounts Manager file in Windows stores all the password hashes for the system.






34. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






35. TCP connect() scan






36. One or more locations from which control is exercised over a computer - television broadcast - or telecommunications network.






37. A firewall evasion technique whereby packets are wrapped in HTTP - as a covert channel to the target.






38. 1. The path a packet travels to reach the intended destination. Each individual device along the path traveled is called a hop. 2. Information contained on a device containing instructions for reaching other nodes on the network. This information can






39. Using conversation or some other interaction between people to gather useful information.






40. MAC Flooding






41. Malicious code that uses a polymorphic engine to mutate while keeping the original algorithm intact; the code changes itself each time it runs - but the function of the code will not change.






42. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






43. A method in cryptography by which cryptographic keys are exchanged between users - allowing use of a cryptographic algorithm (for example - the Diffie-Hellman key exchange).






44. Port 161/162






45. The process of recording activity on a system for monitoring and later review.






46. Shifting responsibility from one party to another






47. A non-self-replicating program that appears to have a useful purpose - but in reality has a different - malicious purpose.






48. An attack with the goal of preventing authorized users from accessing services and preventing the normal operation of computers and networks.






49. UDP Scan






50. The organization that governs the Internet's top-level domains - IP address allocation - and port number assignments.