Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The condition of a resource being ready for use and accessible by authorized users.






2. A U.S. Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system.






3. A proprietary - open - wireless technology used for transferring data from fixed and mobile devices over short distances.






4. Polymorphic Virus






5. An authentication method on point-to-point links - using a three-way handshake and a mutually agreed-upon key.






6. Network Scanning






7. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.






8. The concept of having more than one person required to complete a task






9. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






10. A method of external testing whereby several systems or resources are used together to effect an attack.






11. Attacks that take advantage of the built-in code and scripts most off-the-shelf applications come with.






12. The act of searching for Wi-Fi wireless networks by a person in a moving vehicle - using a portable device.






13. A person or entity indirectly involved in a relationship between two principles.






14. Xmas Tree scan






15. Directory Transversal






16. The combination of all IT assets - resources - components - and systems.






17. An e-mail message warning users of a nonexistent virus and encouraging them to pass on the message to other users.






18. A symmetric key cipher where plaintext bits are combined with a pseudo-random cipher bit stream (keystream) - typically by an exclusive-or (XOR) operation. In a stream cipher the plaintext digits are encrypted one at a time - and the transformation o






19. Content Addressable Memory table. Holds all the MAC-address-to-port mappings on a switch.






20. Self-contained network with a limited number of participants who extend limited trust to one another in order to accomplish an agreed-upon goal.






21. RPC Scan






22. Port 80/81/8080






23. An industry standard protocol used for accessing and managing information within a directory service; an application protocol for querying and modifying data using directory services running over TCP/IP.






24. A method of network traffic filtering that monitors the entire communications process - including the originator of the session and from which direction it started.






25. A list of IP addresses and corresponding MAC addresses stored on a local computer.






26. A domain composed of all the systems sharing any given physical transport media. Systems within a collision domain may collide with each other during the transmission of data. Collisions can be managed by CSMA/CD (collision detection) or CSMA/CA (col






27. Software code - a portion of data - or sequence of commands intended to take advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software or hardware.






28. An Application layer protocol used by local email clients to retrieve e-mail from a remote server over a TCP/IP connection.






29. A cell phone attack in which the serial number from one cell phone is copied to another in an effort to copy the cell phone.






30. Polite scan timing






31. Authentication confirms the identity of the user or device. Authorization determines the privileges (rights) of the user or device. Accounting records the access attempts - both successful and unsuccessful.






32. A set of rules defined by a system administrator that indicates whether access is allowed or denied to resource objects.






33. A programming principle whereby the last piece of data added to the stack is the first piece of data taken off.






34. A social-engineering attack using computer resources - such as e-mail or IRC.






35. The level of importance assigned to an IT asset






36. The process of using an application to remotely identify open ports on a system (for example - whether systems allow connections through those ports).






37. Steps taken to identify and limit risks to an acceptable or reasonable level of exposure.






38. CAN-SPAM






39. A cyber attacker who acts without permission from - and gives prior notice to - the resource owner. Also known as a malicious hacker.






40. An unknown deficiency in software or some other product that results in a security vulnerability being identified.






41. Monitoring of telephone or Internet conversations - typically by covert means.






42. A technology where you advertise one IP address externally and data packets are rerouted to the appropriate IP address inside your network by a device providing translation services. In this way - IP addresses of machines on your internal network are






43. A VPN tunneling protocol with encryption. PPTP connects two nodes in a VPN by using one TCP port for negotiation and authentication and one IP protocol for data transfer.






44. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






45. Recording the time - normally in a log file - when an event happens or when information is created or modified.






46. Wrapper or Binder






47. A program designed to browse websites in an automated - methodical manner. Sometimes these programs are used to harvest information from websites - such as e-mail addresses.






48. The last portion of the SID that identifies the user to the system in Windows. A RID of 500 identifies the administrator account.






49. Hex 14






50. An evaluation consisting of a document review - interviews - and demonstrations - as well as vulnerability scans and hands-on testing.