Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A security protocol used in IEEE 802.11i to replace WEP without the requirement to replace legacy hardware.






2. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






3. Sending unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones - PDAs - or laptop computers.






4. A trusted entity that issues and revokes public key certificates. In a network - a CA is a trusted entity that issues - manages - and revokes security credentials and public keys for message encryption and/or authentication. Within a public key infra






5. The act of searching for Wi-Fi wireless networks by a person in a moving vehicle - using a portable device.






6. A group of penetration testers that assess the security of an organization - which is often unaware of the existence of the team or the exact assignment.






7. The contents of a packet. A system attack requires the attacker to deliver a malicious payload that is acted upon and executed by the system.






8. A standard that provides best-practice recommendations on information security management for use by those responsible for initiating - implementing - or maintaining Information Security Management Systems (ISMS). Information security is defined with






9. A computer network confined to a relatively small area - such as a single building or campus.






10. An Application layer protocol for sending electronic mail between servers.






11. A type of encryption where the same key is used to encrypt and decrypt the message.






12. A method in cryptography by which cryptographic keys are exchanged between users - allowing use of a cryptographic algorithm (for example - the Diffie-Hellman key exchange).






13. An evaluation consisting of a document review - interviews - and demonstrations - as well as vulnerability scans and hands-on testing.






14. A firewall evasion technique whereby packets are wrapped in HTTP - as a covert channel to the target.






15. Black box test






16. Policy stating what users of a system can and cannot do with the organization's assets.






17. Layer 6 of the OSI reference model. The Presentation layer ensures information sent by the Application layer of the sending system will be readable by the Application layer of the receiving system.






18. Window Scan






19. The transmission of digital signals without precise clocking or synchronization.






20. FIN Scan






21. Two or more LANs connected by a high-speed line across a large geographical area.






22. Looking over an authorized user's shoulder in order to steal information (such as authentication information).






23. The rate at which a biometric system will incorrectly reject an access attempt by an authorized user.






24. Metamorphic Virus






25. A term representing the responsibility managers and their organizations have to provide information security to ensure the type of control - the cost of control - and the deployment of control are appropriate for the system being managed.






26. ex 02






27. A background process found in Unix - Linux - Solaris - and other Unix-based operating systems.






28. A method used to prevent IDS detection by dividing the request into multiple parts that are sent in different packets






29. Traffic-passing technique used by bridges and switches in which traffic received on an interface is sent out all interfaces on the device except the interface on which the information was originally received. Traffic on a switch is flooded when it is






30. An attack against an authentication protocol in which the attacker intercepts data in transit along the network between the claimant and verifier - but does not alter the data (in other words - eavesdropping).






31. Attacks on the actual programming code of an application.






32. An agreement between the penetration tester and the client detailing the activities the tester is permitted to perform.






33. A communications protocol used for browsing the Internet.






34. A command that instructs the system processor to do nothing. Many overflow attacks involve stringing several NOP operations together (known as a NOP sled).






35. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.






36. An announcement - typically from a software vendor - of a known security vulnerability in a program; often the bulletin contains instructions for the application of a software patch.






37. An attack that exploits the common mistake many people make when installing operating systems






38. A storage buffer that transparently stores data so future requests for the same data can be served faster.






39. Provides router-to-router or host-to-network connections over asynchronous and synchronous circuits.






40. A secret - typically consisting of only decimal digits - that a claimant memorizes and uses to authenticate his identity






41. Start of Authority record. This record identifies the primary name server for the zone. The SOA record contains the host name of the server responsible for all DNS records within the namespace - as well as the basic properties of the domain.






42. The monetary value expected from the occurrence of a risk on an asset. It is mathematically expressed as single loss expectancy (SLE) = asset value (AV)






43. The secret portion of an asymmetric key pair typically used to decrypt or digitally sign data. The private key is never shared and is always used for decryption - with one notable exception: The private key is used to encrypt the digital signature.






44. Formal description and evaluation of the vulnerabilities in an information system






45. Drawing symbols in public places to alert others to an open Wi-Fi network. War chalking can include the SSIDs - administrative passwords to APs - and other information.






46. A computer security expert who performs security audits and penetration tests against systems or network segments - with the owner's full knowledge and permission - in an effort to increase security.






47. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.






48. Vulnerability Scanning






49. Content Addressable Memory table. Holds all the MAC-address-to-port mappings on a switch.






50. The change or growth of a project's scope