Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Any item of value or worth to an organization - whether physical or virtual.






2. A nonnumerical - subjective risk evaluation. Used with qualitative assessment (an evaluation of risk that results in ratings of none - low - medium - and high for the probability.)






3. LAN standard - defined by ANSI X3T9.5 - specifying a 100Mbps token-passing network using fiber-optic cable and a dualring architecture for redundancy - with transmission distances of up to two kilometers.






4. The monetary loss that can be expected for an asset due to risk over a one-year period. ALE is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as ALE = ARO






5. nmap all output






6. An attack where the hacker positions himself between the client and the server - to intercept (and sometimes alter) data traveling between the two.






7. A method of defining what rights and permissions an entity has to a given resource. In networking - Access Control Lists are commonly associated with firewall and router traffic filtering rules.






8. The subjective - potential percentage of loss to a specific asset if a specific threat is realized. The exposure factor (EF) is a subjective value the person assessing risk must define.






9. A program designed to execute at a specific time to release malicious code onto the computer system or network.






10. A software or hardware defect that often results in system vulnerabilities.






11. The act of dialing all numbers within an organization to discover open modems.






12. NSA






13. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.






14. A program or piece of code inserted into a system - usually covertly - with the intent of compromising the confidentiality - integrity - or availability of the victim's data - applications - or operating system. Malware consists of viruses - worms -






15. A self-replicating - self-propagating - self-contained program that uses networking mechanisms to spread itself.






16. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






17. Using conversation or some other interaction between people to gather useful information.






18. Malware designed to install some sort of virus - backdoor - and so on - on a target system.






19. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






20. The monetary value assigned to an IT asset.






21. A piece of software - provided by the vendor - intended to update or fix known - discovered problems in a computer program or its supporting data.






22. A software program for remotely controlling a Microsoft Windows computer system over a network. Generally considered malware.






23. A configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just frames addressed to it






24. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






25. An attack that is direct in nature - usually where the attacker injects something into - or otherwise alters - the network or system target.






26. A tool that helps a company to compare its actual performance with its potential performance.






27. Port 88






28. A hacker who aims to bring down critical infrastructure for a 'cause' and does not worry about the penalties associated with his actions.






29. An announcement - typically from a software vendor - of a known security vulnerability in a program; often the bulletin contains instructions for the application of a software patch.






30. The default network authentication suite of protocols for Windows NT 4.0






31. A number assigned during TCP startup sessions that tracks how much information has been moved. This number is used by hackers when hijacking sessions.






32. An Ethernet networking system transmitting data at 100 million bits per second (Mbps) - 10 times the speed of an earlier Ethernet standard. Derived from the Ethernet 802.3 standard - it is also known as 100BaseT.






33. Black hat






34. An API that provides services related to the OSI model's Session layer - allowing applications on separate computers to communicate over a LAN.






35. A storage buffer that transparently stores data so future requests for the same data can be served faster.






36. A network architecture framework developed by ISO that describes the communications process between two systems across the Internet in seven distinct layers.






37. A file system used by the Mac OS.






38. 18 U.S.C. 1029






39. Wireless LAN standards created by IEEE. 802.11a runs at up to 54Mbps at 5GHz - 802.11b runs at 11Mbps at 2.4GHz - 802.11g runs at 54Mbps at 2.4GHz - and 802.11n can run upwards of 150MBps.






40. A unique numerical string - created by a hashing algorithm on a given piece of data - used to verify data integrity. Generally hashes are used to verify the integrity of files after download (comparison to the hash value on the site before download)






41. ICMP Type/Code 0-0






42. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.






43. A function that is easy to compute in one direction - yet believed to be difficult to compute in the opposite direction (finding its inverse) without special information - called the 'trapdoor.' Widely used in cryptography.






44. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






45. Idlescan






46. Attacks on the actual programming code of an application.






47. Freely and readily available information on an organization that can be gathered by a business entity about its competitor's customers - products - and marketing - and can be used by an attacker to build useful information for further attacks.






48. Port 135






49. Nmap grepable output






50. Sending packets or requests to another system to gain information to be used to identify weaknesses and protect the system from attacks.