SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. An authentication method on point-to-point links - using a three-way handshake and a mutually agreed-upon key.
Hacks without permission
Challenge Handshake Authentication Protocol (CHAP)
Ciphertext
Daisy Chaining
2. A software or hardware application or device that captures user keystrokes.
qualitative analysis
RxBoot
keylogger
hot site
3. A connection-oriented - layer 4 protocol for transporting data over network segments. TCP is considered reliable because it guarantees delivery and the proper reordering of transmitted packets. This protocol is used for most long-haul traffic on the
Virtual Local Area Network (VLAN)
Reconnaissance - Scanning - Gaining Access - Maintaining Access - Covering Tracks
asynchronous transmission
Transmission Control Protocol (TCP)
4. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.
Vulnerability Management
Internet service provider (ISP)
network tap
limitation of liability and remedies
5. A firewall evasion technique whereby packets are wrapped in HTTP - as a covert channel to the target.
Antivirus (AV) software
HTTP tunneling
RID Resource identifier
Echo request
6. A person or entity indirectly involved in a relationship between two principles.
Third Party
Level II assessment
-sW
private key
7. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.
Denial of Service (DoS)
Level I assessment
Daisy Chaining
Timestamping
8. The set of all hardware - firmware - and/or software components critical to IT security. Bugs or vulnerabilities occurring inside the TCB might jeopardize the security properties of the entire system.
Trusted Computer Base (TCB)
Exposure Factor
role-based access control
Digital Certificate
9. A method of password cracking whereby all possible options are systematically enumerated until a match is found. These attacks try every password (or authentication option) - one after another - until successful. Bruteforce attacks take a long time t
Time To Live (TTL)
NT LAN Manager (NTLM)
Brute-Force Password Attack
Anonymizer
10. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.
Collision Domain
Google hacking
service level agreements (SLAs)
Tunneling Virus
11. A method of defining what rights and permissions an entity has to a given resource. In networking - Access Control Lists are commonly associated with firewall and router traffic filtering rules.
Access Control List (ACL)
Virus
Collision
Domain Name
12. A connectionless - layer 4 transport protocol. UDP is faster than TCP - but offers no reliability. A best effort is made to deliver the data - but no checks and verifications are performed to guarantee delivery. Therefore - UDP is termed a 'connectio
User Datagram Protocol (UDP)
Accountability
Digital Signature
Asymmetric Algorithm
13. The basis of this kind of security is that an individual user - or program operating on the user's behalf - is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the use
Discretionary Access Control (DAC)
Information Technology (IT) asset criticality
flood
Defines legal email marketing
14. Freely and readily available information on an organization that can be gathered by a business entity about its competitor's customers - products - and marketing - and can be used by an attacker to build useful information for further attacks.
Countermeasures
network tap
Competitive Intelligence
serial scan & 300 sec wait
15. Software or hardware components that restrict access between a protected network and the Internet - or between other sets of networks - to block unwanted use or attacks.
firewall
smart card
Methodology
network interface card (NIC)
16. A card with a built-in microprocessor and memory used for identification or financial transactions. The card transfers data to and from a central computer when inserted into a reader.
Videocipher II Satellite Encryption System
Community String
smart card
GET
17. Start of Authority record. This record identifies the primary name server for the zone. The SOA record contains the host name of the server responsible for all DNS records within the namespace - as well as the basic properties of the domain.
Daemon
SOA record
Digital Certificate
keylogger
18. Aggressive scan timing
RID Resource identifier
parallel scan & 300 sec timeout & 1.25 sec/probe
File Transfer Protocol (FTP)
Daisy Chaining
19. Port 161/162
Cracker
Man-in-the-middle attack
Finding a directory listing and gaining access to a parent or root file for access to other files
SNMP
20. Microsoft SID 500
Authentication - Authorization - and Accounting (AAA)
Anonymizer
Local Administrator
Telnet
21. A networking configuration where all nodes are connected in a circle with no terminated ends on the cable.
Echo Reply
ring topology
Post Office Protocol 3 (POP3)
-PP
22. An unknown deficiency in software or some other product that results in a security vulnerability being identified.
security defect
Domain Name
SYN flood attack
-sW
23. Describes practices in production and development that promote access to the end product's source materials.
Man-in-the-middle attack
-PT
remote procedure call (RPC)
open source
24. An organized collection of data.
404EE
Database
remote procedure call (RPC)
Domain Name System (DNS) cache poisoning
25. Set of tools (applications or code) that enables administrator-level accessto a computer or computer network and is designed to obscure the fact that the system has been compromised. Rootkits are dangerous malware entities that provide administrator
White Box Testing
parallel scan
Address Resolution Protocol (ARP)
rootkit
26. A method used to prevent IDS detection by dividing the request into multiple parts that are sent in different packets
RPC-DCOM
session splicing
U P F
Network Basic Input/Output System (NetBIOS)
27. All measures and techniques taken to gather information about an intended target. Footprinting can be passive or active.
Rijndael
footprinting
limitation of liability and remedies
Tumbling
28. A communications channel that is being used for a purpose it was not intended for - usually to transfer information secretly.
infrastructure mode
ISO 17799
Annualized Loss Expectancy (ALE)
Covert Channel
29. Vulnerability Scanning
Network Address Translation (NAT)
net use \[target ip]IPC$ '' /user:''
The automated process of proactively identifying vulnerabilities of computing systems present in a network
EDGAR database
30. The concept of having more than one person required to complete a task
separation of duties
Covert Channel
Authentication
Backdoor
31. A configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just frames addressed to it
Auditing
Back orifice
promiscuous mode
-sU
32. A nontechnical method of hacking. Social engineering is the art of manipulating people - whether in person (human-based) or via computing methods (computer-based) - into providing sensitive information.
Methodology
Hacks without permission
social engineering
Contingency Plan
33. A backup facility with the electrical and physical components of a computer facility - but with no computer equipment in place. The site is ready to receive the necessary replacement computer equipment in the event the user has to move from his main
Level II assessment
intranet
source routing
Cold Site
34. An attack where the hacker repeats a portion of a cryptographic exchange in hopes of fooling the system into setting up a communications channel.
John the Ripper - LOphtcrack - Ophtcrack - Cain and Abel
MAC filtering
replay attack
Buffer
35. A protocol for exchanging packets over a serial line.
Serial Line Internet Protocol (SLIP)
intranet
NetBSD
Sign in Seal
36. Window Scan
-sW
Target Of Engagement (TOE)
Web Spider
Sign in Seal
37. A systematic process for the assessment of security vulnerabilities.
impersonation
INFOSEC Assessment Methodology (IAM)
Cache
Vulnerability Management
38. A distance-vector routing protocol that employs the hop count as a routing metric. The 'hold down time -' used to define how long a route is held in memory - is 180 seconds. RIP prevents routing loops by implementing a limit on the number of hops all
Baseline
Routing Information Protocol (RIP)
Service Set Identifier (SSID)
Black Hat
39. Originally an extension of PPP - this is a protocol for authentication used within wireless networks. Works with multiple authentication measures.
Bluesnarfing
Extensible Authentication Protocol (EAP)
fragmentation
Adware
40. UDP Scan
A R
Availability
-sU
Port Address Translation (PAT)
41. The ability to trace actions performed on a system to a specific user or system entity.
Asynchronous
Accountability
Wrapper
replay attack
42. A virus designed to infect the master boot record.
Master boot record infector
heuristic scanning
Virtual Local Area Network (VLAN)
risk
43. Part of a service contract where the level of service is formally defined; may be required as part of the initial pen test agreements.
Media Access Control (MAC)
SID
NOP
service level agreements (SLAs)
44. The act of checking some sequence of tokens for the presence of the constituents of some pattern.
Macro virus
Presentation layer
pattern matching
false negative
45. The rate at which a biometric system will incorrectly reject an access attempt by an authorized user.
spoofing
false rejection rate (FRR)
qualitative analysis
ping sweep
46. A method of permitting only MAC addresses in a preapproved list network access. Addresses not matching are blocked.
honeypot
MAC filtering
separation of duties
Vulnerability Scanning
47. A self-replicating malicious program that attempts installation beneath antivirus software by directly intercepting the interrupt handlers of the operating system to evade detection.
Temporal Key Integrity Protocol (TKIP)
Cache
Fast Ethernet
Tunneling Virus
48. A method in cryptography by which cryptographic keys are exchanged between users - allowing use of a cryptographic algorithm (for example - the Diffie-Hellman key exchange).
key exchange protocol
rogue access point
Access Point (AP)
SID
49. An API that provides services related to the OSI model's Session layer - allowing applications on separate computers to communicate over a LAN.
CAM table
Network Basic Input/Output System (NetBIOS)
-sV
network tap
50. An Application layer protocol for sending electronic mail between servers.
Internet Assigned Number Authority (IANA)
Lightweight Directory Access Protocol (LDAP)
Third Party
Simple Mail Transfer Protocol (SMTP)