Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. An attack where the hacker positions himself between the client and the server - to intercept (and sometimes alter) data traveling between the two.






2. Xmas Tree scan






3. A non-self-replicating program that appears to have a useful purpose - but in reality has a different - malicious purpose.






4. A biometric device that uses pattern-recognition techniques based on images of the irises of an individual's eyes.






5. Provides router-to-router or host-to-network connections over asynchronous and synchronous circuits.






6. A legal limit on the amount of financial liability and remedies the organization is responsible for taking on.






7. A business - government agency - or educational institution that provides access to the Internet.






8. A storage buffer that transparently stores data so future requests for the same data can be served faster.






9. Independent review and examination of records and activities to assess the adequacy of system controls - to ensure compliance with established policies and operational procedures - and to recommend necessary changes.






10. A skilled hacker that straddles the line between white hat (hacking only with permission and within guidelines) and black hat (malicious hacking for personal gain). Gray hats sometime perform illegal acts to exploit technology with the intent of achi






11. A type of malware that covertly collects information about a user.






12. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.






13. A physical security attack where the attacker sifts through garbage and recycle bins for information that may be useful on current and future attacks






14. Port 88






15. Content Addressable Memory table. Holds all the MAC-address-to-port mappings on a switch.






16. Controls to detect anomalies or undesirable events occurring on a system.






17. nmap all output






18. The condition of a resource being ready for use and accessible by authorized users.






19. An attack where the hacker repeats a portion of a cryptographic exchange in hopes of fooling the system into setting up a communications channel.






20. A network deployed as a trap to detect - deflect - or deter unauthorized use of information systems.






21. A method of evaluating the security of a computer system or network by simulating an attack from a malicious source.






22. ICMP Type/Code 11






23. A symmetric key cipher where plaintext bits are combined with a pseudo-random cipher bit stream (keystream) - typically by an exclusive-or (XOR) operation. In a stream cipher the plaintext digits are encrypted one at a time - and the transformation o






24. A domain composed of all the systems sharing any given physical transport media. Systems within a collision domain may collide with each other during the transmission of data. Collisions can be managed by CSMA/CD (collision detection) or CSMA/CA (col






25. A VPN tunneling protocol with encryption. PPTP connects two nodes in a VPN by using one TCP port for negotiation and authentication and one IP protocol for data transfer.






26. An API that provides services related to the OSI model's Session layer - allowing applications on separate computers to communicate over a LAN.






27. TCP SYN Scan






28. A comparison metric for different biometric devices and technologies; the point at which the false acceptance rate (FAR) equals the






29. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.






30. Polymorphic Virus






31. A computer virus that infects and spreads in multiple ways.






32. Vulnerability Scanning






33. A self-replicating - self-propagating - self-contained program that uses networking mechanisms to spread itself.






34. Actions - devices - procedures - techniques - or other measures intended to reduce the vulnerability of an information system.






35. A social-engineering effort in which the attacker pretends to be an employee - a valid user - or even an executive to elicit information or access.






36. A list of IP addresses and corresponding MAC addresses stored on a local computer.






37. An application that monitors a computer or network to identify - and prevent - malware. AV is usually signature-based - and can take multiple actions on defined malware files/activity.






38. A secret - typically consisting of only decimal digits - that a claimant memorizes and uses to authenticate his identity






39. The central part of a computer or communications system hardware firmware - and software that implements the basic security procedures for controlling access to system resources.






40. A principle in security engineering that attempts to use anonymity and secrecy (of design - implementation - and so on) to provide security; the footprint of the organization - entity - network - or system is kept as small as possible to avoid intere






41. A method in cryptography by which cryptographic keys are exchanged between users - allowing use of a cryptographic algorithm (for example - the Diffie-Hellman key exchange).






42. Hex 29






43. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






44. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






45. A Canonical Name record within DNS - used to provide an alias for a domain name.






46. Created by the U.S. Federal Communications Commission to uniquely identify mobile devices; often represented as an 11-digit decimal number or eight-digit hexadecimal number.






47. An attack with the goal of preventing authorized users from accessing services and preventing the normal operation of computers and networks.






48. FIN Scan






49. The process of using an application to remotely identify open ports on a system (for example - whether systems allow connections through those ports).






50. The process of systematically testing each port on a firewall to map rules and determine accessible ports.