SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. An evaluation consisting of a document review - interviews - and demonstrations - as well as vulnerability scans and hands-on testing.
Level II assessment
Finding a directory listing and gaining access to a parent or root file for access to other files
Last In First Out (LIFO)
script kiddie
2. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.
security kernel
Ethical Hacker
POST
Secure Multipurpose Mail Extension (S/MIME)
3. A symmetric - block-cipher data-encryption standard that uses a variablelength key that can range from 32 bits to 448 bits.
Acceptable Use Policy (AUP)
Blowfish
security bulletins
Boot Sector Virus
4. A value used to control cryptographic operations - such as decryption -encryption - signature generation - and signature verification.
Brute-Force Password Attack
Cryptographic Key
Point-to-Point Tunneling Protocol (PPTP)
Smurf attack
5. An attack in which a hacker steps between two ends of an already-established communication session and uses specialized tools to guess sequence numbers to take over the channel.
Active Fingerprinting
Cloning
session hijacking
fragmentation
6. A string that represents the location of a web resource
Bluejacking
local area network (LAN)
risk acceptance
Uniform Resource Locator (URL)
7. A type of encryption where the same key is used to encrypt and decrypt the message.
NT LAN Manager (NTLM)
Authentication Header (AH)
symmetric encryption
War Dialing
8. Set of tools (applications or code) that enables administrator-level accessto a computer or computer network and is designed to obscure the fact that the system has been compromised. Rootkits are dangerous malware entities that provide administrator
Routing Protocol
Uniform Resource Locator (URL)
rootkit
flood
9. A protocol that uses a private key to encrypt data before transmitting confidential documents over the Internet; widely used on e-commerce - banking - and other sites requiring privacy.
Man-in-the-middle attack
CAM table
Secure Sockets Layer (SSL)
Address Resolution Protocol (ARP) table
10. Authentication confirms the identity of the user or device. Authorization determines the privileges (rights) of the user or device. Accounting records the access attempts - both successful and unsuccessful.
Vulnerability Scanning
POST
red team
Authentication - Authorization - and Accounting (AAA)
11. The act of searching for Wi-Fi wireless networks by a person in a moving vehicle - using a portable device.
Accountability
enumeration
Electronic Code Book (ECB)
War Driving
12. A non-self-replicating program that appears to have a useful purpose - but in reality has a different - malicious purpose.
Kerberos
Trojan Horse
TACACS
Console Port
13. Another term for firewalking
port knocking
replay attack
802.11 i
parameter tampering
14. The last portion of the SID that identifies the user to the system in Windows. A RID of 500 identifies the administrator account.
risk
RID Resource identifier
Distributed DoS (DDoS)
risk acceptance
15. A stand-alone computer - kept off the network - that is used for scanning potentially malicious media or software.
Fast Ethernet
-p <port ranges>
sheepdip
protocol stack
16. Aggressive scan timing
War Dialing
parallel scan & 300 sec timeout & 1.25 sec/probe
Telnet
Finding a directory listing and gaining access to a parent or root file for access to other files
17. Also known as the dot-dot-slash attack. Using directory traversal - the attacker attempts to access restricted directories and execute commands outside intended web server directories by using the URL to redirect to an unintended folder location.
serial scan & 300 sec wait
risk avoidance
Directory Traversal
Decryption
18. In penetration testing - this is a method of testing the security of a system or subnet without any previous knowledge of the device or network. Designed to simulate an attack by an outside intruder (usually from the Internet).
Black Box Testing
NOP
null session
Serial Line Internet Protocol (SLIP)
19. A type of DNS transfer - where all records from an SOA are transmitted to the requestor. Zone transfers have two options: full (opcode AXFR) and incremental (IXFR).
Biometrics
Zone transfer
Hacks with permission
HIDS
20. A technology where you advertise one IP address externally and data packets are rerouted to the appropriate IP address inside your network by a device providing translation services. In this way - IP addresses of machines on your internal network are
Network Address Translation (NAT)
MD5
MAC filtering
Wide Area Network (WAN)
21. A widely used authentication protocol developed at the MassachusettsInstitute of Technology (MIT). Kerberos authentication uses tickets - Ticket Granting Service - and Key Distribution Center.
key exchange protocol
Kerberos
symmetric encryption
Tunneling Virus
22. The organization that governs the Internet's top-level domains - IP address allocation - and port number assignments.
Tunnel
Asynchronous
-sR
Internet Assigned Number Authority (IANA)
23. Transmitting one protocol encapsulated inside another protocol.
Tunneling
Level III assessment
infrastructure mode
Event
24. A record showing which user has accessed a given resource and what operations the user performed during a given period.
Audit Trail
-oX
reconnaissance
Event
25. One or more locations from which control is exercised over a computer - television broadcast - or telecommunications network.
Information Technology (IT) asset valuation
-oG
S
network operations center (NOC)
26. Also known as a public key certificate - this is an electronic file that is used to verify a user's identity - providing non-repudiation throughout the sys-tem. Certificates contain the entity's public key - serial number - version - subject - algori
Blowfish
Digital Certificate
A S
Self Replicating
27. An Internet routing protocol used to exchange routing information within an autonomous system.
OpenBSD
Sign in Seal
Interior Gateway Protocol (IGP)
scope creep
28. Also known as a digital certificate - this is an electronic file used to verify a user's identity - providing non-repudiation throughout the system It is also a set of data that uniquely identifies an entity. Certificates contain the entity's public
Eavesdropping
Presentation layer
Administratively Prohibited
Certificate
29. An industry standard protocol used for accessing and managing information within a directory service; an application protocol for querying and modifying data using directory services running over TCP/IP.
Lightweight Directory Access Protocol (LDAP)
Electronic Code Book (ECB)
Minimum acceptable level of risk
promiscuous mode
30. In computer security - this is an algorithm that uses separate keys for encryption and decryption.
operating system attack
Asymmetric Algorithm
Temporal Key Integrity Protocol (TKIP)
public key infrastructure (PKI)
31. An Application layer protocol for sending electronic mail between servers.
intrusion detection system (IDS)
Challenge Handshake Authentication Protocol (CHAP)
Simple Mail Transfer Protocol (SMTP)
Wireless Local Area Network (WLAN)
32. A condition that occurs when more data is written to a buffer than it has space to store - and results in data corruption or other system errors. This is usually due to insufficient bounds checking - a bug - or improper configuration in the program c
inference attack
role-based access control
Hacks with permission
Buffer Overflow
33. LM Hash for short passwords (under 7)
serial scan & 300 sec wait
CAM table
Three-Way (TCP) Handshake
404EE
34. Software code - a portion of data - or sequence of commands intended to take advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software or hardware.
impersonation
International Organization for Standardization (ISO)
Redundant Array of Independent Disks (RAID)
Exploit
35. The conveying of official access or legal power to a person or entity.
802.11 i
Active Attack
Authorization
Asset
36. A set of related communications protocols operating together as a group to address communication at some or all of the seven layers of the OSI reference model.
NT LAN Manager (NTLM)
protocol stack
Mantrap
National Security Agency
37. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.
remote access
Ethical Hacker
firewall
ISO 17799
38. Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality - integrity - or availability of an information system. A virus - worm - Trojan horse - or other code-based entity that infects a
security by obscurity
open source
Malicious code
keylogger
39. A derogatory term used to describe an attacker - usually new to the field - who uses simple - easy-to-follow scripts or programs developed by others to attack computer systems and networks and deface websites.
-sA
script kiddie
Temporal Key Integrity Protocol (TKIP)
Due Care
40. A file system used by the Mac OS.
S
Kerberos
Hierarchical File System (HFS)
-PB
41. The result of using a private key to encrypt a hash value for identification purposes within a PKI system. The signature can be decoded by the originator's public key - verifying his identity and providing non-repudiation. A valid digital signature g
Digital Signature
Discretionary Access Control (DAC)
Minimum acceptable level of risk
Confidentiality
42. A value assigned to uniquely identify a single wide area network (WAN) in wireless LANs. SSIDs are broadcast by default - and are sent in the header of every packet. SSIDs provide no encryption or security.
Service Set Identifier (SSID)
Tunneling
asynchronous transmission
null session
43. A software or hardware application or device that captures user keystrokes.
TACACS
-sA
protocol stack
keylogger
44. A social-engineering attack that manipulates the victim into calling the attacker for help.
Port Address Translation (PAT)
Assessment
reverse social engineering
Pretty Good Privacy (PGP)
45. Port 22
Information Technology (IT) asset valuation
Kerberos
Algorithm
SSH
46. A protocol used for sending and receiving log information for nodes on a network.
firewalking
encapsulation
Syslog
Challenge Handshake Authentication Protocol (CHAP)
47. A backlog of packets stored in buffers and waiting to be forwarded over an interface.
phishing
Timestamping
Time exceeded
queue
48. A set of rules defined by a system administrator that indicates whether access is allowed or denied to resource objects.
Transmission Control Protocol (TCP)
rule-based access control
Client
Denial of Service (DoS)
49. ICMP Type/Code 0-0
-oN
MAC filtering
Echo Reply
Domain Name System (DNS)
50. A network architecture framework developed by ISO that describes the communications process between two systems across the Internet in seven distinct layers.
Open System Interconnection (OSI) Reference Model
Domain Name System (DNS)
FTP
Written Authorization