SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. An evaluation conducted to determine the potential for damage to or loss of an IT asset.
proxy server
risk assessment
Due Care
Defense in Depth
2. A software program for remotely controlling a Microsoft Windows computer system over a network. Generally considered malware.
SYN flood attack
routed protocol
NetBus
hot site
3. Transmitting one protocol encapsulated inside another protocol.
Tunneling
Vulnerability Management
Secure Sockets Layer (SSL)
Replacing numbers in a url to access other files
4. Directory Transversal
separation of duties
Finding a directory listing and gaining access to a parent or root file for access to other files
-sF
symmetric encryption
5. All measures and techniques taken to gather information about an intended target. Footprinting can be passive or active.
security controls
spam
footprinting
hashing algorithm
6. A software or hardware application or device that captures user keystrokes.
International Organization for Standardization (ISO)
keylogger
symmetric encryption
patch
7. Normal scan timing
Domain Name
intrusion detection system (IDS)
parallel scan
keylogger
8. A penetration test in which the ethical hacker has limited knowledge of the intended target(s). Designed to simulate an internal - but non-systemadministrator-level attack.
hash
gray box testing
Password Authentication Protocol (PAP)
Hypertext Transfer Protocol Secure (HTTPS)
9. An extensible mechanism for e-mail. A variety of MIME types exist for sending content such as audio - binary - or video using the Simple Mail Transfer Protocol (SMTP).
initial sequence number (ISN)
Multipurpose Internet Mail Extensions (MIME)
Fraud and related activity in connection with computers
Access Control List (ACL)
10. A method of external testing whereby several systems or resources are used together to effect an attack.
Black Hat
Distributed DoS (DDoS)
Daisy Chaining
enumeration
11. The process of embedding information into a digital signal in a way that makes it difficult to remove.
Cache
Audit Data
stream cipher
Digital Watermarking
12. ICMP Type/Code 8
Echo request
Smurf attack
SAM
Media Access Control (MAC)
13. 18 U.S.C. 1030
symmetric encryption
Fraud and related activity in connection with computers
Overwhelm CAM table to convert switch to hub mode
Wi-Fi
14. Hex 04
enumeration
R
TACACS
false rejection rate (FRR)
15. Metamorphic Virus
Accountability
Console Port
Self Replicating
Droppers
16. A security protocol for wireless local area networks defined in the 802.11b standard; intended to provide the same level of security as a wired LAN. WEP is not considered strong security - although it does authenticate clients to access points - encr
infrastructure mode
Wired Equivalent Privacy (WEP)
sniffer
-sL
17. An unknown deficiency in software or some other product that results in a security vulnerability being identified.
Transport Layer Security (TLS)
Packet Internet Groper (ping)
security defect
Wrapper
18. A stand-alone computer - kept off the network - that is used for scanning potentially malicious media or software.
sheepdip
inference attack
-sW
Authentication
19. A partially protected zone on a network - not exposed to the full fury of the Internet - but not fully behind the firewall. This technique is typically used on parts of the network that must remain open to the public (such as a web server) but must a
Cloning
Event
Demilitarized Zone (DMZ)
Electronic serial number
20. A network traffic management technique designed to allow applications to specify the route a packet will take to a destination - regardless of what the route tables between the two systems say.
Man-in-the-middle attack
source routing
Open System Interconnection (OSI) Reference Model
A R
21. A program designed to execute at a specific time to release malicious code onto the computer system or network.
Time Bomb
Daemon
Due Care
promiscuous mode
22. A data encryption/decryption program often used for e-mail and file storage.
segment
Pretty Good Privacy (PGP)
Extensible Authentication Protocol (EAP)
Due Diligence
23. Port 31337
John the Ripper - LOphtcrack - Ophtcrack - Cain and Abel
Simple Mail Transfer Protocol (SMTP)
Back orifice
risk acceptance
24. In penetration testing - enumeration is the act of querying a device or network segment thoroughly and systematically for information.
limitation of liability and remedies
enumeration
LDAP
pattern matching
25. A derogatory term used to describe an attacker - usually new to the field - who uses simple - easy-to-follow scripts or programs developed by others to attack computer systems and networks and deface websites.
script kiddie
EDGAR database
NetBSD
Media Access Control (MAC)
26. Also known as a digital certificate - this is an electronic file used to verify a user's identity - providing non-repudiation throughout the system It is also a set of data that uniquely identifies an entity. Certificates contain the entity's public
Wi-Fi
Certificate
piggybacking
ring topology
27. An anonymous connection to an administrative share (IPC$) on a Windows machine. Null sessions allow for enumeration of Windows machines - among other attacks.
Digital Signature
remote access
Daemon
null session
28. An Application layer protocol used primarily by Microsoft Windows to provide shared access to printers - files - and serial ports. It also provides an authenticated interprocess communication mechanism.
hash
routed protocol
Common Internet File System/Server Message Block
Active Attack
29. Chronological record of system activities to enable the reconstruction and examination of the sequence of events and changes in an event.
Audit Data
protocol stack
impersonation
Overwhelm CAM table to convert switch to hub mode
30. ICMP Type/Code 0-0
smart card
source routing
SOA record
Echo Reply
31. ICMP Timestamp
Replacing numbers in a url to access other files
Droppers
node
-PP
32. A formal set of rules describing data transmission - especially across a network. A protocol determines the type of error checking - the data compression method - how the sending device will indicate completion - how the receiving device will indicat
Worm
Finding a directory listing and gaining access to a parent or root file for access to other files
network interface card (NIC)
protocol
33. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.
Request for Comments (RFC)
Copyright
Acknowledgment (ACK)
Exploit
34. A wireless LAN security standard developed by IEEE. Requires Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).
802.11 i
-sA
Tunneling Virus
Block Cipher
35. Formerly Redundant Array of Inexpensive Disks; a technology that provides increased storage functions and reliability through redundancy. This is achieved by combining multiple disk drive components into a logical unit - where data is distributed acr
Virtual Local Area Network (VLAN)
Vulnerability Management
Redundant Array of Independent Disks (RAID)
Brute-Force Password Attack
36. A computer network confined to a relatively small area - such as a single building or campus.
Level I assessment
local area network (LAN)
heuristic scanning
sniffer
37. A business - government agency - or educational institution that provides access to the Internet.
Auditing
network interface card (NIC)
Internet service provider (ISP)
Internet Protocol (IP)
38. A distance-vector routing protocol that employs the hop count as a routing metric. The 'hold down time -' used to define how long a route is held in memory - is 180 seconds. RIP prevents routing loops by implementing a limit on the number of hops all
Database
Routing Information Protocol (RIP)
Access Creep
session splicing
39. Name given to expert groups that handle computer security incidents.
Domain Name
Computer Emergency Response Team (CERT)
Exploit
Transmission Control Protocol (TCP)
40. A legal limit on the amount of financial liability and remedies the organization is responsible for taking on.
Transport Layer Security (TLS)
TACACS
limitation of liability and remedies
hash
41. The Security Accounts Manager file in Windows stores all the password hashes for the system.
fragmentation
Pretty Good Privacy (PGP)
Console Port
SAM
42. An attack in which the hacker can derive information from the ciphertext without actually decoding it. Sensitive information can be considered compromised if an adversary can infer its real value with a high level of confidence.
initial sequence number (ISN)
inference attack
INFOSEC Assessment Methodology (IAM)
Internet Protocol (IP)
43. Software that has advertisements embedded within. Generally displays ads in the form of pop-ups.
Console Port
-PI
Archive
Adware
44. Two or more LANs connected by a high-speed line across a large geographical area.
CNAME record
Lightweight Directory Access Protocol (LDAP)
Filter
Wide Area Network (WAN)
45. Start of Authority record. This record identifies the primary name server for the zone. The SOA record contains the host name of the server responsible for all DNS records within the namespace - as well as the basic properties of the domain.
protocol
ECHO reply
Digital Certificate
SOA record
46. A software or hardware defect that often results in system vulnerabilities.
initial sequence number (ISN)
Time To Live (TTL)
integrity
Bug
47. A device that receives and sends data packets between two or more networks; the packet headers and a forwarding table provide the router with the information necessary for deciding which interface to use to forward packets.
Auditing
LDAP
router
-sR
48. A nonnumerical - subjective risk evaluation. Used with qualitative assessment (an evaluation of risk that results in ratings of none - low - medium - and high for the probability.)
qualitative analysis
HTTP
Data Encryption Standard (DES)
SYN flood attack
49. Calculations of two components of risk: R - the magnitude of the potential loss (L) - and the probability - p - that the loss will occur.
Post Office Protocol 3 (POP3)
polymorphic virus
Lightweight Directory Access Protocol (LDAP)
quantitative risk assessment
50. Black hat
Hacks without permission
--randomize_hosts -O OS fingerprinting
-b
Assessment