Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Policy stating what users of a system can and cannot do with the organization's assets.






2. A one-way mathematical function that generates a fixedlength numerical string (hash) from a given data input. MD5 and SHA-1 are hashing algorithms.






3. An attack that is direct in nature - usually where the attacker injects something into - or otherwise alters - the network or system target.






4. ICMP Ping






5. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.






6. A security objective that ensures a resource can be accessed only by authorized users. This is also the property that sensitive information is not disclosed to unauthorized individuals - entities - or processes.






7. Terminal Access Controller Access-Control System. A remote authentication protocol that is used to communicate with an authentication server commonly used in Unix networks.






8. A free and popular version of the Unix operating system.






9. Hex 14






10. A backlog of packets stored in buffers and waiting to be forwarded over an interface.






11. A nonroutable IP address range intended for use only within the confines of a single organization - falling within the predefined ranges of 10.0.0.0 - 172.16-31.0.0 - or 192.168.0.0.






12. Content Addressable Memory table. Holds all the MAC-address-to-port mappings on a switch.






13. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






14. TCP connect() scan






15. A set of related communications protocols operating together as a group to address communication at some or all of the seven layers of the OSI reference model.






16. A brand name of analog scrambling and de-scrambling equipment for cable and satellite television - invented primarily to keep consumer Television receive-only (TVRO) satellite equipment from receiving TV programming except on a subscription basis.






17. Window Scan






18. A method in cryptography by which cryptographic keys are exchanged between users - allowing use of a cryptographic algorithm (for example - the Diffie-Hellman key exchange).






19. Provides router-to-router or host-to-network connections over asynchronous and synchronous circuits.






20. A firewall evasion technique whereby packets are wrapped in HTTP - as a covert channel to the target.






21. A person or entity indirectly involved in a relationship between two principles.






22. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






23. A symmetric - block-cipher data-encryption standard that uses a variablelength key that can range from 32 bits to 448 bits.






24. The condition of a resource being ready for use and accessible by authorized users.






25. A portion of memory used to temporarily store output or input data.






26. A cell phone attack in which the serial number from one cell phone is copied to another in an effort to copy the cell phone.






27. Management policy and procedures designed to maintain or restore business operations - including computer operations - possibly at an alternate location - in the event of emergencies - system failures - or disaster.






28. Computer software or hardware that can intercept and log traffic passing over a digital network.






29. A command that instructs the system processor to do nothing. Many overflow attacks involve stringing several NOP operations together (known as a NOP sled).






30. A type of denial-of-service attack where a hacker sends thousands of SYN packets to the target with spoofed IP addresses.






31. Also known as a public key certificate - this is an electronic file that is used to verify a user's identity - providing non-repudiation throughout the sys-tem. Certificates contain the entity's public key - serial number - version - subject - algori






32. Provides data encryption for IEEE 802.11 wireless networks so data can only be decrypted by the intended recipients.






33. Weakness in an information system - system security procedures - internal controls - or implementation that could be exploited or triggered by a threat source.






34. An attack technique that tricks your DNS server into believing it has received authentic information when - in reality - it has been provided fraudulent data. DNS cache poisoning affects user traffic by sending it to erroneous or malicious end points






35. Cracking Tools






36. The software product or system that is the subject of an evaluation.






37. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






38. Controls to detect anomalies or undesirable events occurring on a system.






39. Shifting responsibility from one party to another






40. A utility that sends an ICMP Echo message to determine if a specific IP address is accessible; if the message receives a reply - the address is reachable.






41. Hex 04






42. A group of experts that handles computer security incidents.






43. A small Trojan program that listens on port 777.






44. A virus designed to infect the master boot record.






45. A backup facility with the electrical and physical components of a computer facility - but with no computer equipment in place. The site is ready to receive the necessary replacement computer equipment in the event the user has to move from his main






46. A Windows-based GUI version of nmap.






47. A programming principle whereby the last piece of data added to the stack is the first piece of data taken off.






48. A standard developed to enable routers to exchange messages containing information about routes to reach subnets in the network.






49. Authentication confirms the identity of the user or device. Authorization determines the privileges (rights) of the user or device. Accounting records the access attempts - both successful and unsuccessful.






50. Also known as a digital certificate - this is an electronic file used to verify a user's identity - providing non-repudiation throughout the system It is also a set of data that uniquely identifies an entity. Certificates contain the entity's public