Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A technology that establishes a tunnel to create a private - dedicated - leased-line network over the Internet. The data is encrypted so it's readable only by the sender and receiver. Companies commonly use VPNs to allow employees to connect securely






2. A limit on the amount of time or number of iterations or transmissions in computer and network technology a packet can experience before it will be discarded.






3. A sublayer of layer 2 of the OSI model - the Data Link layer. It provides addressing and channel access control mechanisms that enable several terminals or network nodes to communicate within a multipoint network.






4. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






5. ICMP Timestamp






6. A group of experts that handles computer security incidents.






7. A social-engineering attack using computer resources - such as e-mail or IRC.






8. An Application layer protocol used primarily by Microsoft Windows to provide shared access to printers - files - and serial ports. It also provides an authenticated interprocess communication mechanism.






9. Looking over an authorized user's shoulder in order to steal information (such as authentication information).






10. The process of using easily accessible DNS records to map a target network's internal hosts.






11. An e-mail message warning users of a nonexistent virus and encouraging them to pass on the message to other users.






12. A physical security attack where the attacker sifts through garbage and recycle bins for information that may be useful on current and future attacks






13. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






14. A form of fraud in which someone pretends to be someone else by assuming that person's identity - typically in order to access resources or obtain credit and other benefits in that person's name.






15. A connection-oriented - layer 4 protocol for transporting data over network segments. TCP is considered reliable because it guarantees delivery and the proper reordering of transmitted packets. This protocol is used for most long-haul traffic on the






16. A type of DNS transfer - where all records from an SOA are transmitted to the requestor. Zone transfers have two options: full (opcode AXFR) and incremental (IXFR).






17. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






18. A denial-of-service attack where the attacker sends a ping to the network's broadcast address from the spoofed IP address of the target. All systems in the subnet then respond to the spoofed address - eventually flooding the device.






19. A communications protocol used for browsing the Internet.






20. The organization that governs the Internet's top-level domains - IP address allocation - and port number assignments.






21. An Application layer protocol for managing devices on an IP network.






22. An organization's threshold for the seven areas of information security responsibility. This level is established based on the objectives for maintaining confidentiality - integrity - and availability of the organization's IT assets and infrastructur






23. A biometric device that uses pattern-recognition techniques based on images of the irises of an individual's eyes.






24. The contents of a packet. A system attack requires the attacker to deliver a malicious payload that is acted upon and executed by the system.






25. A hardware device used to log keystrokes covertly. Hardware keystroke loggers are very dangerous due to the fact that they cannot be detected through regular software/anti-malware scanning.






26. A standard that provides best-practice recommendations on information security management for use by those responsible for initiating - implementing - or maintaining Information Security Management Systems (ISMS). Information security is defined with






27. Port 135






28. Devices - connected to one or more switches - grouped logically into a single broadcast domain. VLANs enable administrators to divide the devices connected to the switches into multiple VLANs without requiring separate physical switches.






29. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






30. All measures and techniques taken to gather information about an intended target. Footprinting can be passive or active.






31. FTP Bounce Attack






32. Start of Authority record. This record identifies the primary name server for the zone. The SOA record contains the host name of the server responsible for all DNS records within the namespace - as well as the basic properties of the domain.






33. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.






34. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






35. A software program for remotely controlling a Microsoft Windows computer system over a network. Generally considered malware.






36. A standard developed to enable routers to exchange messages containing information about routes to reach subnets in the network.






37. A wireless LAN device that acts as a central point for all wireless traffic. The AP is connected to both the wireless LAN and the wired LAN - providing wireless clients access to network resources.






38. A protocol that uses a private key to encrypt data before transmitting confidential documents over the Internet; widely used on e-commerce - banking - and other sites requiring privacy.






39. A trusted entity that issues and revokes public key certificates. In a network - a CA is a trusted entity that issues - manages - and revokes security credentials and public keys for message encryption and/or authentication. Within a public key infra






40. Injecting traffic into the network to identify the operating system of a device.






41. A point of reference used to mark an initial state in order to manage change.






42. A routing protocol developed to be used within a single organization.






43. A device or service designed to obfuscate traffic between a client and the Internet. Generally used to make activity on the Internet as untraceable as possible.






44. A brand name of analog scrambling and de-scrambling equipment for cable and satellite television - invented primarily to keep consumer Television receive-only (TVRO) satellite equipment from receiving TV programming except on a subscription basis.






45. Software code - a portion of data - or sequence of commands intended to take advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software or hardware.






46. An attacker who breaks into computer systems with malicious intent - without the owner's knowledge or permission.






47. Process of breaking a packet into smaller units when it is being transmitted over a network medium that's unable to support a transmission unit the original size of the packet.






48. CAN-SPAM






49. The change or growth of a project's scope






50. The secret portion of an asymmetric key pair typically used to decrypt or digitally sign data. The private key is never shared and is always used for decryption - with one notable exception: The private key is used to encrypt the digital signature.