SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A firewall evasion technique whereby packets are wrapped in HTTP - as a covert channel to the target.
POST
HTTP
HTTP tunneling
security kernel
2. A proprietary - open - wireless technology used for transferring data from fixed and mobile devices over short distances.
polymorphic virus
Telnet
Access Control List (ACL)
Bluetooth
3. Nmap grepable output
Simple Mail Transfer Protocol (SMTP)
--randomize_hosts -O OS fingerprinting
-oG
Overwhelm CAM table to convert switch to hub mode
4. FTP Bounce Attack
LDAP
-oN
key exchange protocol
-b
5. A Unix-like computer operating system descending from the BSD. Open-BSD includes a number of security features absent or optional in other operating systems.
OpenBSD
Internet Protocol (IP)
User Datagram Protocol (UDP)
steganography
6. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.
--randomize_hosts -O OS fingerprinting
POST
SAM
Local Administrator
7. The means by which a recipient of a message can ensure the identity of the sender and that neither party can deny having sent or received the message. The most common method is through digital certificates.
replay attack
self encrypting
non-repudiation
shoulder surfing
8. Port 389
Asymmetric
Man-in-the-middle attack
LDAP
Wi-Fi
9. Access by information systems (or users) communicating from outside the information system security perimeter.
Unicode
remote access
routed protocol
FreeBSD
10. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.
Google hacking
-sW
-sI
null session
11. An attack in which a hacker steps between two ends of an already-established communication session and uses specialized tools to guess sequence numbers to take over the channel.
session hijacking
Self Replicating
Virtual Local Area Network (VLAN)
Internal access to the network
12. ICMP Type/Code 3
risk transference
-PB
Destination Unreachable
Third Party
13. 18 U.S.C. 1029
Possession of access devices
self encrypting
CAM table
Mantrap
14. A utility that traces a packet from your computer to an Internet host - showing how many hops the packet takes to reach the host and how long the packet requires to complete the hop.
Traceroute
Internet Protocol (IP)
false negative
overt channel
15. A hybrid of the HTTP and SSL/TLS protocols that provides encrypted communication and secure identification of a web server.
Minimum acceptable level of risk
Hypertext Transfer Protocol Secure (HTTPS)
Ethical Hacker
personal identification number (PIN)
16. Method used by antivirus software to detect new - unknown viruses that have not yet been identified; based on a piece-by-piece examination of a program - looking for a sequence or sequences of instructions that differentiate the virus from 'normal' p
Corrective Controls
integrity
heuristic scanning
ISO 17799
17. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive
Vulnerability Management
Application Layer
Data Link layer
Asynchronous
18. A wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator - or has been created to allow a hacker to conduct a man-in-the-middle attack.
serialize scans & 0.4 sec wait
rogue access point
Boot Sector Virus
Pretty Good Privacy (PGP)
19. A virus written in a macro language and usually embedded in document or spreadsheet files.
Network Address Translation (NAT)
Three-Way (TCP) Handshake
security kernel
Macro virus
20. A comparison metric for different biometric devices and technologies; the point at which the false acceptance rate (FAR) equals the
Crossover Error Rate (CER)
smart card
segment
ring topology
21. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.
Biometrics
firewall
shoulder surfing
service level agreements (SLAs)
22. A protocol for transporting data packets across a packet switched internetwork (such as the Internet). IP is a routed protocol.
Internet Protocol (IP)
Open System Interconnection (OSI) Reference Model
Administratively Prohibited
secure channel
23. A data encryption/decryption program often used for e-mail and file storage.
Pretty Good Privacy (PGP)
Accountability
White Box Testing
Address Resolution Protocol (ARP)
24. A security objective that ensures a resource can be accessed only by authorized users. This is also the property that sensitive information is not disclosed to unauthorized individuals - entities - or processes.
Active Attack
Echo request
Confidentiality
A procedure for identifying active hosts on a network.
25. Created by the U.S. Federal Communications Commission to uniquely identify mobile devices; often represented as an 11-digit decimal number or eight-digit hexadecimal number.
Routing Information Protocol (RIP)
Electronic serial number
firewalking
Console Port
26. A section or subset of the network. Often a router or other routing device provides the end point of the segment.
DNS enumeration
segment
Syslog
security bulletins
27. Network Scanning
Serial Line Internet Protocol (SLIP)
security bulletins
A procedure for identifying active hosts on a network.
port scanning
28. Any item of value or worth to an organization - whether physical or virtual.
Algorithm
Asset
The automated process of proactively identifying vulnerabilities of computing systems present in a network
parallel scan & 300 sec timeout & 1.25 sec/probe
29. A command that instructs the system processor to do nothing. Many overflow attacks involve stringing several NOP operations together (known as a NOP sled).
Block Cipher
Confidentiality
parallel scan & 75 sec timeout & 0.3 sec/probe
NOP
30. An attack where the hacker manipulates parameters within the URL string in hopes of modifying data.
serialize scans & 15 sec wait
Certificate Authority (CA)
parameter tampering
encapsulation
31. Xmas Tree scan
risk assessment
-sX
network operations center (NOC)
parallel scan & 300 sec timeout & 1.25 sec/probe
32. An international organization composed of national standards bodies from over 75 countries. Developed the OSI reference model.
Ethical Hacker
International Organization for Standardization (ISO)
Simple Object Access Protocol (SOAP)
Malicious code
33. A security tool designed to protect a system or network against attacks by comparing traffic patterns against a list of both known attack signatures and general characteristics of how attacks may be carried out. Threats are rated and protective measu
-oA
INFOSEC Assessment Methodology (IAM)
secure channel
intrusion prevention system (IPS)
34. An announcement - typically from a software vendor - of a known security vulnerability in a program; often the bulletin contains instructions for the application of a software patch.
Wireless Local Area Network (WLAN)
security bulletins
Vulnerability Assessment
Vulnerability Scanning
35. A means of restricting access to system resources based on the sensitivity (as represented by a label) of the information contained in the system resource and the formal authorization (that is - clearance) of users to access information of such sensi
-sA
Multipartite virus
Mandatory access control (MAC)
Warm Site
36. LAN standard - defined by ANSI X3T9.5 - specifying a 100Mbps token-passing network using fiber-optic cable and a dualring architecture for redundancy - with transmission distances of up to two kilometers.
Zenmap
Fiber Distributed Data Interface (FDDI)
U P F
risk
37. A group of experts that handles computer security incidents.
Malicious code
security incident response team (SIRT)
single loss expectancy (SLE)
Data Link layer
38. Attacks that take advantage of the built-in code and scripts most off-the-shelf applications come with.
Extensible Authentication Protocol (EAP)
false rejection rate (FRR)
Open System Interconnection (OSI) Reference Model
shrink-wrap code attacks
39. The combination of all IT assets - resources - components - and systems.
heuristic scanning
Information Technology (IT) infrastructure
Application-Level Attacks
Bluesnarfing
40. Window Scan
Information Technology Security Evaluation Criteria (ITSEC)
-sW
intranet
-sP
41. A Canonical Name record within DNS - used to provide an alias for a domain name.
SAM
CNAME record
Internet Assigned Number Authority (IANA)
inference attack
42. A method for detecting malicious code on a computer where the files are compared to signatures of known viruses stored in a database.
heuristic scanning
Virtual Local Area Network (VLAN)
signature scanning
fully qualified domain name (FQDN)
43. Nmap ml output
Asset
Open System Interconnection (OSI) Reference Model
-oX
Internet service provider (ISP)
44. Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality - integrity - or availability of an information system. A virus - worm - Trojan horse - or other code-based entity that infects a
Level II assessment
Denial of Service (DoS)
Wi-Fi
Malicious code
45. An attack against an authentication protocol in which the attacker intercepts data in transit along the network between the claimant and verifier - but does not alter the data (in other words - eavesdropping).
sidejacking
Zone transfer
Countermeasures
passive attack
46. A person or entity indirectly involved in a relationship between two principles.
Third Party
Hypertext Transfer Protocol (HTTP)
CIA triangle
Trapdoor Function
47. Attacks on the actual programming code of an application.
Application-Level Attacks
Authorization
session hijacking
self encrypting
48. Calculations of two components of risk: R - the magnitude of the potential loss (L) - and the probability - p - that the loss will occur.
quantitative risk assessment
Electronic Code Book (ECB)
TACACS
risk transference
49. The transmission of digital signals without precise clocking or synchronization.
asynchronous transmission
Level II assessment
Wi-Fi Protected Access (WPA)
Distributed DoS (DDoS)
50. The result of using a private key to encrypt a hash value for identification purposes within a PKI system. The signature can be decoded by the originator's public key - verifying his identity and providing non-repudiation. A valid digital signature g
Local Administrator
Digital Signature
Wide Area Network (WAN)
Mandatory access control (MAC)