Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. In regard to hash algorithms - this occurs when two or more distinct inputs produce the same output.






2. Policy stating what users of a system can and cannot do with the organization's assets.






3. A protocol used to pass control and error messages between nodes on the Internet.






4. A malicious computer program with self-replication capabilities that attaches to another file and moves with the host from one computer to another.






5. An industry standard protocol used for accessing and managing information within a directory service; an application protocol for querying and modifying data using directory services running over TCP/IP.






6. Normal scan timing






7. Used for exchanging structured information - such as XML-based messages - in the implementation of web services






8. An Internet Protocol Security (IPSec) header used to verify that the contents of a packet have not been modified while the packet was in transit.






9. A security objective that ensures a resource can be accessed only by authorized users. This is also the property that sensitive information is not disclosed to unauthorized individuals - entities - or processes.






10. A sublayer of layer 2 of the OSI model - the Data Link layer. It provides addressing and channel access control mechanisms that enable several terminals or network nodes to communicate within a multipoint network.






11. An Ethernet networking system transmitting data at 100 million bits per second (Mbps) - 10 times the speed of an earlier Ethernet standard. Derived from the Ethernet 802.3 standard - it is also known as 100BaseT.






12. The transmission of digital signals without precise clocking or synchronization.






13. Idlescan






14. Confidentiality - Integrity - and Availability are the three aspects of security and make up the triangle.






15. A document describing information security guidelines - policies - procedures - and standards.






16. In penetration testing - enumeration is the act of querying a device or network segment thoroughly and systematically for information.






17. A decision to reduce the potential for damage to or loss of an IT asset by taking some type of action






18. Actions - devices - procedures - techniques - or other measures intended to reduce the vulnerability of an information system.






19. The result of using a private key to encrypt a hash value for identification purposes within a PKI system. The signature can be decoded by the originator's public key - verifying his identity and providing non-repudiation. A valid digital signature g






20. 1. The path a packet travels to reach the intended destination. Each individual device along the path traveled is called a hop. 2. Information contained on a device containing instructions for reaching other nodes on the network. This information can






21. A wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator - or has been created to allow a hacker to conduct a man-in-the-middle attack.






22. A method of evaluating the security of a computer system or network by simulating an attack from a malicious source.






23. A principle in security engineering that attempts to use anonymity and secrecy (of design - implementation - and so on) to provide security; the footprint of the organization - entity - network - or system is kept as small as possible to avoid intere






24. A fully qualified domain name consists of a host and domain name - including a top-level domain such as .com - .net - .mil - .edu -and so on.






25. A device providing temporary - on-demand - point-to-point network access to users.






26. A protocol that uses a private key to encrypt data before transmitting confidential documents over the Internet; widely used on e-commerce - banking - and other sites requiring privacy.






27. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






28. Hex 10






29. A business - government agency - or educational institution that provides access to the Internet.






30. A Windows-based GUI version of nmap.






31. The process of determining if a network entity (user or service) is legitimate






32. Name given to expert groups that handle computer security incidents.






33. Using conversation or some other interaction between people to gather useful information.






34. 18 U.S.C. 1029






35. Ping Scan






36. A device set up to send a response on behalf of an end node to the requesting host. Proxies are generally used to obfuscate the host from the Internet.






37. Host-based IDS. An IDS that resides on the host - protecting against file and folder manipulation and other host-based attacks and actions.






38. A network administration command-line tool available for many operating systems for querying the Domain Name System (DNS) to obtain domain name or IP address mappings or any other specific DNS record.






39. UDP Scan






40. Sneaky scan timing






41. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.






42. SYN Ping






43. A standard developed to enable routers to exchange messages containing information about routes to reach subnets in the network.






44. Part of a service contract where the level of service is formally defined; may be required as part of the initial pen test agreements.






45. An evaluation consisting of a document review - interviews - and demonstrations. No hands-on testing is performed.






46. In computer security - this is an algorithm that uses separate keys for encryption and decryption.






47. A social-engineering attack using computer resources - such as e-mail or IRC.






48. The monetary value assigned to an IT asset.






49. The default network authentication suite of protocols for Windows NT 4.0






50. A point of reference used to mark an initial state in order to manage change.