Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Safeguards or countermeasures to avoid - counteract - or minimize security risks.






2. A computer virus that infects and spreads in multiple ways.






3. Software code - a portion of data - or sequence of commands intended to take advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software or hardware.






4. nmap all output






5. A means of exchanging information from one entity to another using a process that does not provide an attacker the opportunity to reorder - delete - insert - or read information.






6. A type of DNS transfer - where all records from an SOA are transmitted to the requestor. Zone transfers have two options: full (opcode AXFR) and incremental (IXFR).






7. nmap






8. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






9. Traffic-passing technique used by bridges and switches in which traffic received on an interface is sent out all interfaces on the device except the interface on which the information was originally received. Traffic on a switch is flooded when it is






10. The act of checking some sequence of tokens for the presence of the constituents of some pattern.






11. Also known as the dot-dot-slash attack. Using directory traversal - the attacker attempts to access restricted directories and execute commands outside intended web server directories by using the URL to redirect to an unintended folder location.






12. Part of a service contract where the level of service is formally defined; may be required as part of the initial pen test agreements.






13. A device providing temporary - on-demand - point-to-point network access to users.






14. PI and PT Ping






15. The process of sending a packet or frame toward the destination. In a switch - messages are forwarded only to the port they are addressed to.






16. The act of using numerous electronic serial numbers on a cell phone until a valid number is located.






17. ex 02






18. An attacker who breaks into computer systems with malicious intent - without the owner's knowledge or permission.






19. The last portion of the SID that identifies the user to the system in Windows. A RID of 500 identifies the administrator account.






20. Aggressive scan timing






21. A data encryption/decryption program often used for e-mail and file storage.






22. A host designed to collect data on suspicious activity.






23. The set of all hardware - firmware - and/or software components critical to IT security. Bugs or vulnerabilities occurring inside the TCB might jeopardize the security properties of the entire system.






24. Controlling access to a network by analyzing the headers of incoming and outgoing packets - and letting them pass or discarding them based on rule sets created by a network administrator. A packet filter allows or denies packets based on destination






25. LAN standard - defined by ANSI X3T9.5 - specifying a 100Mbps token-passing network using fiber-optic cable and a dualring architecture for redundancy - with transmission distances of up to two kilometers.






26. An organization's threshold for the seven areas of information security responsibility. This level is established based on the objectives for maintaining confidentiality - integrity - and availability of the organization's IT assets and infrastructur






27. An attack with the goal of preventing authorized users from accessing services and preventing the normal operation of computers and networks.






28. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is - clearance) of users to access information of such sensi






29. 18 U.S.C. 1030






30. An early network application that provides information on users currently logged on to a machine.






31. Evaluation in which testers attempt to penetrate the network.






32. A computer process that requests a service from another computer and accepts the server's responses.






33. The rate at which a biometric system will incorrectly identify an unauthorized individual and allow them access (see false negative).






34. A utility that sends an ICMP Echo message to determine if a specific IP address is accessible; if the message receives a reply - the address is reachable.






35. Unauthorized access to information such as a calendar - contact list - e-mails - and text messages on a wireless device through a Bluetooth connection.






36. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.






37. Any item of value or worth to an organization - whether physical or virtual.






38. Hex 04






39. White hat






40. RPC Scan






41. Version Detection Scan






42. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.






43. An attack where the hacker repeats a portion of a cryptographic exchange in hopes of fooling the system into setting up a communications channel.






44. A self-replicating - self-propagating - self-contained program that uses networking mechanisms to spread itself.






45. A protocol for exchanging packets over a serial line.






46. A social-engineering attack that manipulates the victim into calling the attacker for help.






47. A function that is easy to compute in one direction - yet believed to be difficult to compute in the opposite direction (finding its inverse) without special information - called the 'trapdoor.' Widely used in cryptography.






48. Drawing symbols in public places to alert others to an open Wi-Fi network. War chalking can include the SSIDs - administrative passwords to APs - and other information.






49. Controls to detect anomalies or undesirable events occurring on a system.






50. The level of importance assigned to an IT asset