Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Layer 7 of the OSI reference model. The Application layer provides services to applications - which allow them access to the network. Protocols such as FTP and SMTP reside here.






2. A protocol for transporting data packets across a packet switched internetwork (such as the Internet). IP is a routed protocol.






3. Also known as a public key certificate - this is an electronic file that is used to verify a user's identity - providing non-repudiation throughout the sys-tem. Certificates contain the entity's public key - serial number - version - subject - algori






4. A fully qualified domain name consists of a host and domain name - including a top-level domain such as .com - .net - .mil - .edu -and so on.






5. A type of attack used to deny service to legitimate users of a network resource by intentionally overloading the network with illegitimate TCP connection requests. SYN packets are sent repeatedly to the target - but the corresponding SYN/ACK response






6. A protocol for exchanging packets over a serial line.






7. Directing a protocol from one port to another.






8. A protocol used to pass control and error messages between nodes on the Internet.






9. A method in cryptography by which cryptographic keys are exchanged between users - allowing use of a cryptographic algorithm (for example - the Diffie-Hellman key exchange).






10. An inspection of a place where a company or individual proposes to work - to gather the necessary information for a design or risk assessment.






11. A protocol used for sending and receiving log information for nodes on a network.






12. Port 135






13. Transmitting one protocol encapsulated inside another protocol.






14. Any kind of connection that allows you to see all traffic passing by. Generally used in reference to a NIDS (network-based IDS) to monitor all traffic.






15. A programming principle whereby the last piece of data added to the stack is the first piece of data taken off.






16. MAC Flooding






17. nmap






18. The monetary loss that can be expected for an asset due to risk over a one-year period. ALE is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as ALE = ARO






19. White hat






20. A utility that sends an ICMP Echo message to determine if a specific IP address is accessible; if the message receives a reply - the address is reachable.






21. A mode of operation for a block cipher - with the characteristic that each possible block of plaintext has a defined corresponding ciphertext value - and vice versa






22. A virus that plants itself in a system's boot sector and infects the master boot record.






23. A penetration test in which the ethical hacker has limited knowledge of the intended target(s). Designed to simulate an internal - but non-systemadministrator-level attack.






24. The subjective - potential percentage of loss to a specific asset if a specific threat is realized. The exposure factor (EF) is a subjective value the person assessing risk must define.






25. A unique numerical string - created by a hashing algorithm on a given piece of data - used to verify data integrity. Generally hashes are used to verify the integrity of files after download (comparison to the hash value on the site before download)






26. An API that provides services related to the OSI model's Session layer - allowing applications on separate computers to communicate over a LAN.






27. An international encoding standard - working within multiple languages and scripts - that represents each letter - digit - or symbol with a unique numeric value that applies across different platforms.






28. An environmentally conditioned workspace partially equipped with IT and telecommunications equipment to support relocated IT operations in the event of a significant disruption.






29. A U.S. Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system.






30. A well-known and studied phenomenon of human nature - whereby a single trait influences the perception of other traits.






31. A wireless networking mode where all clients connect to the wireless network through a central access point.






32. A symmetric key cryptographic algorithm that transforms a block of information at a time using a cryptographic key. For a block cipher algorithm - the length of the input block is the same as the length of the output block.






33. A malicious computer program with self-replication capabilities that attaches to another file and moves with the host from one computer to another.






34. A secret - typically consisting of only decimal digits - that a claimant memorizes and uses to authenticate his identity






35. Evaluation in which testers attempt to penetrate the network.






36. Self-contained network with a limited number of participants who extend limited trust to one another in order to accomplish an agreed-upon goal.






37. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






38. A system used by the Securities and Exchange Commission (SEC) for companies and businesses to transmit required filings and information. The EDGAR database performs automated collection - validation - indexing - acceptance - and forwarding of submiss






39. The default network authentication suite of protocols for Windows NT 4.0






40. White box test






41. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






42. The exploitation of a security vulnerability






43. The basis of this kind of security is that an individual user - or program operating on the user's behalf - is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the use






44. Nmap grepable output






45. Polite scan timing






46. An attack against an authentication protocol in which the attacker intercepts data in transit along the network between the claimant and verifier - but does not alter the data (in other words - eavesdropping).






47. A hacker who aims to bring down critical infrastructure for a 'cause' and does not worry about the penalties associated with his actions.






48. All measures and techniques taken to gather information about an intended target. Footprinting can be passive or active.






49. ICMP Type/Code 3






50. The steps taken to gather evidence and information on the targets you wish to attack.