SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A method of falsely identifying the source of data packets; often used by hackers to make it difficult to trace where an attack originated.
impersonation
spoofing
-sS
NetBus
2. Also known as the dot-dot-slash attack. Using directory traversal - the attacker attempts to access restricted directories and execute commands outside intended web server directories by using the URL to redirect to an unintended folder location.
serial scan & 300 sec wait
Directory Traversal
SYN attack
Echo request
3. A hybrid of the HTTP and SSL/TLS protocols that provides encrypted communication and secure identification of a web server.
honeynet
Hypertext Transfer Protocol Secure (HTTPS)
rogue access point
security kernel
4. Two or more LANs connected by a high-speed line across a large geographical area.
Wide Area Network (WAN)
Bit Flipping
Ethernet
Digital Signature
5. A software or hardware application or device that captures user keystrokes.
Authorization
Bit Flipping
keylogger
Hacks without permission
6. A system used by the Securities and Exchange Commission (SEC) for companies and businesses to transmit required filings and information. The EDGAR database performs automated collection - validation - indexing - acceptance - and forwarding of submiss
port knocking
EDGAR database
Pretty Good Privacy (PGP)
Due Care
7. The process of determining if a network entity (user or service) is legitimate
hardware keystroke logger
smart card
-sR
Authentication
8. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is - clearance) of users to access information of such sensi
ad hoc mode
Mandatory access control (MAC)
ping sweep
Application-Level Attacks
9. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.
risk acceptance
Level I assessment
halo effect
Ciphertext
10. The monetary value assigned to an IT asset.
Due Care
Information Technology (IT) asset valuation
Transmission Control Protocol (TCP)
Information Technology (IT) asset criticality
11. A situation in which an IDS or other sensor triggers on an event as an intrusion attempt - when it was actually legitimate traffic.
File Allocation Table (FAT)
false negative
reverse lookup; reverse DNS lookup
XOR Operation
12. A security tool designed to protect a system or network against attacks by comparing traffic patterns against a list of both known attack signatures and general characteristics of how attacks may be carried out. Threats are rated and protective measu
intrusion prevention system (IPS)
SYN flood attack
single loss expectancy (SLE)
Wrapper
13. A condition that occurs when more data is written to a buffer than it has space to store - and results in data corruption or other system errors. This is usually due to insufficient bounds checking - a bug - or improper configuration in the program c
Antivirus (AV) software
Tumbling
Buffer Overflow
session splicing
14. An Internet Protocol Security (IPSec) header used to verify that the contents of a packet have not been modified while the packet was in transit.
Finding a directory listing and gaining access to a parent or root file for access to other files
Trusted Computer System Evaluation Criteria (TCSEC)
Authentication Header (AH)
Wi-Fi Protected Access (WPA)
15. A section or subset of the network. Often a router or other routing device provides the end point of the segment.
fragmentation
GET
segment
heuristic scanning
16. Port 22
HTTP
Information Technology (IT) asset valuation
SSH
404EE
17. Drawing symbols in public places to alert others to an open Wi-Fi network. War chalking can include the SSIDs - administrative passwords to APs - and other information.
security controls
War Chalking
false rejection rate (FRR)
XOR Operation
18. The act of checking some sequence of tokens for the presence of the constituents of some pattern.
Due Diligence
Active Attack
pattern matching
Presentation layer
19. Vulnerability Scanning
-sO
Network Address Translation (NAT)
The automated process of proactively identifying vulnerabilities of computing systems present in a network
HIDS
20. In penetration testing - enumeration is the act of querying a device or network segment thoroughly and systematically for information.
reverse social engineering
enumeration
replay attack
National Security Agency
21. A series of documents and notes on standards used or proposed for use on the Internet; each is identified by a number.
port redirection
Level I assessment
Request for Comments (RFC)
White Box Testing
22. A hacker who aims to bring down critical infrastructure for a 'cause' and does not worry about the penalties associated with his actions.
Local Administrator
SSH
Master boot record infector
suicide hacker
23. A protocol that uses a private key to encrypt data before transmitting confidential documents over the Internet; widely used on e-commerce - banking - and other sites requiring privacy.
node
Secure Sockets Layer (SSL)
Whois
Antivirus (AV) software
24. ICMP Ping
rogue access point
Cookie
-PS
-PI
25. Nmap normal output
initial sequence number (ISN)
physical security
single loss expectancy (SLE)
-oN
26. nmap all output
-oA
Internet service provider (ISP)
Cache
Internal access to the network
27. The art and science of creating a covert message or image within another message - image - audio - or video file.
steganography
Wireless Local Area Network (WLAN)
-sW
Request for Comments (RFC)
28. A device that receives and sends data packets between two or more networks; the packet headers and a forwarding table provide the router with the information necessary for deciding which interface to use to forward packets.
site survey
gray box testing
quality of service (QoS)
router
29. A type of denial-of-service attack where a hacker sends thousands of SYN packets to the target with spoofed IP addresses.
SYN attack
net use \[target ip]IPC$ '' /user:''
protocol stack
Countermeasures
30. A standard for encrypting e-mail - web pages - and other stream-oriented information transmitted over the Internet.
Authentication
-PP
Digital Watermarking
Transport Layer Security (TLS)
31. An Application layer protocol used by local email clients to retrieve e-mail from a remote server over a TCP/IP connection.
Virus Hoax
spoofing
Post Office Protocol 3 (POP3)
intrusion detection system (IDS)
32. Black box test
Confidentiality
Sign in Seal
No previous knowledge of the network
key exchange protocol
33. Injecting traffic into the network to identify the operating system of a device.
War Dialing
integrity
Active Fingerprinting
-PB
34. The set of all hardware - firmware - and/or software components critical to IT security. Bugs or vulnerabilities occurring inside the TCB might jeopardize the security properties of the entire system.
Bit Flipping
802.11
Zero Subnet
Trusted Computer Base (TCB)
35. ICMP Type/Code 11
Time exceeded
service level agreements (SLAs)
Authentication
-sO
36. A collection of historical records or the place where they are kept. In computing - an archive generally refers to backup copies of logs and/or data.
Active Attack
rogue access point
Archive
Fast Ethernet
37. Network Scanning
Simple Network Management Protocol (SNMP)
Cryptographic Key
Vulnerability Assessment
A procedure for identifying active hosts on a network.
38. A mathematical operation requiring two binary inputs: If the inputs match - the output is a 0 - otherwise it is a 1.
Algorithm
reverse lookup; reverse DNS lookup
XOR Operation
Cold Site
39. The process of recording activity on a system for monitoring and later review.
hashing algorithm
Auditing
keylogger
infrastructure mode
40. The process of attaching a particular protocol header and trailer to a unit of data before transmission on the network. Occurs at layer 2 of the OSI reference model.
Administratively Prohibited
encapsulation
self encrypting
patch
41. Phases of an attack
Reconnaissance - Scanning - Gaining Access - Maintaining Access - Covering Tracks
Level I assessment
firewall
risk avoidance
42. Microsoft SID 500
Certificate Authority (CA)
replay attack
Local Administrator
gateway
43. A query and response protocol widely used for querying databases that store the registered users or assignees of an Internet resource - such as a domain name - an IP address - or an autonomous system.
impersonation
Minimum acceptable level of risk
Whois
logic bomb
44. A standard that provides best-practice recommendations on information security management for use by those responsible for initiating - implementing - or maintaining Information Security Management Systems (ISMS). Information security is defined with
Droppers
ring topology
ISO 17799
Authentication
45. Hex 10
A
sniffer
local area network (LAN)
Simple Mail Transfer Protocol (SMTP)
46. A limit on the amount of time or number of iterations or transmissions in computer and network technology a packet can experience before it will be discarded.
Time To Live (TTL)
SYN attack
Mandatory access control (MAC)
Simple Network Management Protocol (SNMP)
47. A wireless LAN security standard developed by IEEE. Requires Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).
impersonation
MD5
Real application encompassing Trojan
802.11 i
48. An international encoding standard - working within multiple languages and scripts - that represents each letter - digit - or symbol with a unique numeric value that applies across different platforms.
Internet Assigned Number Authority (IANA)
RPC-DCOM
Detective Controls
Unicode
49. A computer placed outside a firewall to provide public services to other Internet sites - and hardened to resist external attacks.
Black Box Testing
Active Directory (AD)
Bastion host
Assessment
50. Management policy and procedures designed to maintain or restore business operations - including computer operations - possibly at an alternate location - in the event of emergencies - system failures - or disaster.
infrastructure mode
RxBoot
Contingency Plan
Console Port