Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A symmetric key cryptographic algorithm that transforms a block of information at a time using a cryptographic key. For a block cipher algorithm - the length of the input block is the same as the length of the output block.






2. A program designed to browse websites in an automated - methodical manner. Sometimes these programs are used to harvest information from websites - such as e-mail addresses.






3. A social-engineering attack that manipulates the victim into calling the attacker for help.






4. An anonymous connection to an administrative share (IPC$) on a Windows machine. Null sessions allow for enumeration of Windows machines - among other attacks.






5. A TCP flag notifying an originating station that the preceding packet (or packets) has been received.






6. ICMP Type/Code 11






7. don't ping






8. A wireless LAN security standard developed by IEEE. Requires Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).






9. A program designed to execute at a specific time to release malicious code onto the computer system or network.






10. The act of secretly listening to the private conversations of others without their consent. This can also be done over telephone lines (wiretapping) - e-mail - instant messaging - and other methods of communication considered private






11. The set of all hardware - firmware - and/or software components critical to IT security. Bugs or vulnerabilities occurring inside the TCB might jeopardize the security properties of the entire system.






12. An Application layer protocol used by local email clients to retrieve e-mail from a remote server over a TCP/IP connection.






13. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






14. Looking over an authorized user's shoulder in order to steal information (such as authentication information).






15. A protocol defining packets that are able to be routed by a router.






16. A proprietary - open - wireless technology used for transferring data from fixed and mobile devices over short distances.






17. A storage buffer that transparently stores data so future requests for the same data can be served faster.






18. A systematic process for the assessment of security vulnerabilities.






19. A NAT method in which multiple internal hosts - using private IP addressing - can be mapped through a single public IP address using the session IDs and port numbers. An internal global IP address can support in excess of 65 -000 concurrent TCP and U






20. The organization that governs the Internet's top-level domains - IP address allocation - and port number assignments.






21. A group of people - gathered together by a business entity - working to address a specific problem or goal.






22. Port 137/138/139






23. A network architecture framework developed by ISO that describes the communications process between two systems across the Internet in seven distinct layers.






24. Used to find the domain name associated with an IP address; the opposite of a DNS lookup.






25. A group of penetration testers that assess the security of an organization - which is often unaware of the existence of the team or the exact assignment.






26. A denial-of-service attack where the attacker sends a ping to the network's broadcast address from the spoofed IP address of the target. All systems in the subnet then respond to the spoofed address - eventually flooding the device.






27. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive






28. Hashing algorithm that results in a 128-bit output.






29. A virus written in a macro language and usually embedded in document or spreadsheet files.






30. A set of related communications protocols operating together as a group to address communication at some or all of the seven layers of the OSI reference model.






31. A card with a built-in microprocessor and memory used for identification or financial transactions. The card transfers data to and from a central computer when inserted into a reader.






32. The rate at which a biometric system will incorrectly identify an unauthorized individual and allow them access (see false negative).






33. A computer process that requests a service from another computer and accepts the server's responses.






34. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






35. The act of searching for Wi-Fi wireless networks by a person in a moving vehicle - using a portable device.






36. A data encryption/decryption program often used for e-mail and file storage.






37. An attack where the hacker positions himself between the client and the server - to intercept (and sometimes alter) data traveling between the two.






38. Ports 20/21






39. 18 U.S.C. 1030






40. A set of exclusive rights granted by the law of a jurisdiction to the author or creator of an original work - including the right to copy - distribute - and adapt the work.






41. An early network application that provides information on users currently logged on to a machine.






42. Physical socket provided on routers and switches for cable connections between a computer and the router/switch. This connection enables the computer to configure - query - and troubleshoot the router/switch by use of a terminal emulator and a comman






43. Computer software or hardware that can intercept and log traffic passing over a digital network.






44. A network deployed as a trap to detect - deflect - or deter unauthorized use of information systems.






45. Part of a service contract where the level of service is formally defined; may be required as part of the initial pen test agreements.






46. Controls to detect anomalies or undesirable events occurring on a system.






47. A legal limit on the amount of financial liability and remedies the organization is responsible for taking on.






48. An electronic version of junk mail. Unsolicited commercial e-mail sent to numerous recipients.






49. A backlog of packets stored in buffers and waiting to be forwarded over an interface.






50. Insane scan timing