Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Recording the time - normally in a log file - when an event happens or when information is created or modified.






2. Provides router-to-router or host-to-network connections over asynchronous and synchronous circuits.






3. A security objective that ensures a resource can be accessed only by authorized users. This is also the property that sensitive information is not disclosed to unauthorized individuals - entities - or processes.






4. The Security Accounts Manager file in Windows stores all the password hashes for the system.






5. The basis of this kind of security is that an individual user - or program operating on the user's behalf - is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the use






6. A means of exchanging information from one entity to another using a process that does not provide an attacker the opportunity to reorder - delete - insert - or read information.






7. An Internet routing protocol used to exchange routing information within an autonomous system.






8. Occurs when authorized users accumulate excess privileges on a system due to moving from position to position.






9. In regard to hash algorithms - this occurs when two or more distinct inputs produce the same output.






10. Evaluation in which testers attempt to penetrate the network.






11. An enumeration technique used to provide information about a computer system; generally used for operating system identification (also known as fingerprinting).






12. Literally - 'not balanced or the same.' In computing - asymmetric refers to a difference in networking speeds upstream to downstream. In cryptography - it's the use of more than one key for encryption/authentication purposes.






13. The rate at which a biometric system will incorrectly reject an access attempt by an authorized user.






14. A device that receives and sends data packets between two or more networks; the packet headers and a forwarding table provide the router with the information necessary for deciding which interface to use to forward packets.






15. The monetary loss that can be expected for an asset due to risk over a one-year period. ALE is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as ALE = ARO






16. MAC Flooding






17. Incremental Substitution






18. A partially protected zone on a network - not exposed to the full fury of the Internet - but not fully behind the firewall. This technique is typically used on parts of the network that must remain open to the public (such as a web server) but must a






19. Xmas Tree scan






20. An attack where the hacker manipulates parameters within the URL string in hopes of modifying data.






21. A cyber attacker who acts without permission from - and gives prior notice to - the resource owner. Also known as a malicious hacker.






22. A type of denial-of-service attack where a hacker sends thousands of SYN packets to the target with spoofed IP addresses.






23. Insane scan timing






24. The process of a system providing a fully qualified domain name (FQDN) to a local name server - for resolution to its corresponding IP address.






25. A simple PPP authentication mechanism in which the user name and password are transmitted in clear text to prove identity. PAP compares the user name and password to a table listing authorized users.






26. A card with a built-in microprocessor and memory used for identification or financial transactions. The card transfers data to and from a central computer when inserted into a reader.






27. A type of encryption where the same key is used to encrypt and decrypt the message.






28. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.






29. Normal scan timing






30. A nonroutable IP address range intended for use only within the confines of a single organization - falling within the predefined ranges of 10.0.0.0 - 172.16-31.0.0 - or 192.168.0.0.






31. Wireless LAN standards created by IEEE. 802.11a runs at up to 54Mbps at 5GHz - 802.11b runs at 11Mbps at 2.4GHz - 802.11g runs at 54Mbps at 2.4GHz - and 802.11n can run upwards of 150MBps.






32. A type of attack used to deny service to legitimate users of a network resource by intentionally overloading the network with illegitimate TCP connection requests. SYN packets are sent repeatedly to the target - but the corresponding SYN/ACK response






33. Controls internal to a system designed to resolve vulnerabilities and errors soon after they arise.






34. An Application layer protocol used primarily by Microsoft Windows to provide shared access to printers - files - and serial ports. It also provides an authenticated interprocess communication mechanism.






35. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.






36. A utility that traces a packet from your computer to an Internet host - showing how many hops the packet takes to reach the host and how long the packet requires to complete the hop.






37. A protocol for exchanging packets over a serial line.






38. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






39. The process of pinging each address within a subnet to map potential targets. Ping sweeps are unreliable and easily detectable - but very fast.






40. The process of systematically testing each port on a firewall to map rules and determine accessible ports.






41. A situation in which an IDS or other sensor triggers on an event as an intrusion attempt - when it was actually legitimate traffic.






42. A wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator - or has been created to allow a hacker to conduct a man-in-the-middle attack.






43. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






44. A cell phone attack in which the serial number from one cell phone is copied to another in an effort to copy the cell phone.






45. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






46. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.






47. An authentication method on point-to-point links - using a three-way handshake and a mutually agreed-upon key.






48. The act of searching for Wi-Fi wireless networks by a person in a moving vehicle - using a portable device.






49. A protocol defining packets that are able to be routed by a router.






50. A form of fraud in which someone pretends to be someone else by assuming that person's identity - typically in order to access resources or obtain credit and other benefits in that person's name.