Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Using conversation or some other interaction between people to gather useful information.






2. Also known as the dot-dot-slash attack. Using directory traversal - the attacker attempts to access restricted directories and execute commands outside intended web server directories by using the URL to redirect to an unintended folder location.






3. A person or entity indirectly involved in a relationship between two principles.






4. A cell phone attack in which the serial number from one cell phone is copied to another in an effort to copy the cell phone.






5. Insane scan timing






6. Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality - integrity - or availability of an information system. A virus - worm - Trojan horse - or other code-based entity that infects a






7. A query and response protocol widely used for querying databases that store the registered users or assignees of an Internet resource - such as a domain name - an IP address - or an autonomous system.






8. A text file stored within a browser by a web server that maintains information about the connection. Cookies are used to store information to maintain a unique but consistent surfing experience - but can also contain authentication parameters. Cookie






9. ICMP Netmask






10. Host-based IDS. An IDS that resides on the host - protecting against file and folder manipulation and other host-based attacks and actions.






11. A point-to-point connection between two endpoints created to exchangedata. Typically a tunnel is either an encrypted connection - or a connection using a protocol in a method for which it was not designed. An encrypted connection forms a point-to-poi






12. The directory service created by Microsoft for use on itsnetworks. Provides a variety of network services using Lightweight Directory Access Protocol (LDAP) - Kerberos-based authentication - and single sign-on for user access to network-based resourc






13. An unknown deficiency in software or some other product that results in a security vulnerability being identified.






14. A method of falsely identifying the source of data packets; often used by hackers to make it difficult to trace where an attack originated.






15. Any network incident that prompts some kind of log entry or other notification.






16. A hacker who aims to bring down critical infrastructure for a 'cause' and does not worry about the penalties associated with his actions.






17. An international organization composed of national standards bodies from over 75 countries. Developed the OSI reference model.






18. ICMP Type/Code 3-13






19. Polite scan timing






20. An evaluation conducted to determine the potential for damage to or loss of an IT asset.






21. A secret - typically consisting of only decimal digits - that a claimant memorizes and uses to authenticate his identity






22. Hex 10






23. Software used to bind a Trojan and a legitimate program together so the Trojan will be installed when the legitimate program is executed.






24. The process of systematically testing each port on a firewall to map rules and determine accessible ports.






25. The act of secretly listening to the private conversations of others without their consent. This can also be done over telephone lines (wiretapping) - e-mail - instant messaging - and other methods of communication considered private






26. A record showing which user has accessed a given resource and what operations the user performed during a given period.






27. A condition that occurs when more data is written to a buffer than it has space to store - and results in data corruption or other system errors. This is usually due to insufficient bounds checking - a bug - or improper configuration in the program c






28. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






29. The transmission of digital signals without precise clocking or synchronization.






30. A program or piece of code inserted into a system - usually covertly - with the intent of compromising the confidentiality - integrity - or availability of the victim's data - applications - or operating system. Malware consists of viruses - worms -






31. An attack with the goal of preventing authorized users from accessing services and preventing the normal operation of computers and networks.






32. A comparison metric for different biometric devices and technologies; the point at which the false acceptance rate (FAR) equals the






33. A cryptographic attack where bits are manipulated in the ciphertext itself to generate a predictable outcome in the plaintext once it is decrypted.






34. A software program for remotely controlling a Microsoft Windows computer system over a network. Generally considered malware.






35. A method of defining what rights and permissions an entity has to a given resource. In networking - Access Control Lists are commonly associated with firewall and router traffic filtering rules.






36. Controls internal to a system designed to resolve vulnerabilities and errors soon after they arise.






37. Version Detection Scan






38. A mode of operation for a block cipher - with the characteristic that each possible block of plaintext has a defined corresponding ciphertext value - and vice versa






39. A principle in security engineering that attempts to use anonymity and secrecy (of design - implementation - and so on) to provide security; the footprint of the organization - entity - network - or system is kept as small as possible to avoid intere






40. A computer process that requests a service from another computer and accepts the server's responses.






41. Directory Transversal






42. A point of reference used to mark an initial state in order to manage change.






43. A standard for encrypting and authenticating MIME data; used primarily for Internet e-mail.






44. RPC Scan






45. Injecting traffic into the network to identify the operating system of a device.






46. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.






47. Provides data encryption for IEEE 802.11 wireless networks so data can only be decrypted by the intended recipients.






48. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.






49. A trusted entity that issues and revokes public key certificates. In a network - a CA is a trusted entity that issues - manages - and revokes security credentials and public keys for message encryption and/or authentication. Within a public key infra






50. The organization that governs the Internet's top-level domains - IP address allocation - and port number assignments.