Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The process of sending a packet or frame toward the destination. In a switch - messages are forwarded only to the port they are addressed to.






2. A software or hardware defect that often results in system vulnerabilities.






3. Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality - integrity - or availability of an information system. A virus - worm - Trojan horse - or other code-based entity that infects a






4. A command that instructs the system processor to do nothing. Many overflow attacks involve stringing several NOP operations together (known as a NOP sled).






5. In penetration testing - this is a method of testing the security of a system or subnet without any previous knowledge of the device or network. Designed to simulate an attack by an outside intruder (usually from the Internet).






6. Created by the U.S. Federal Communications Commission to uniquely identify mobile devices; often represented as an 11-digit decimal number or eight-digit hexadecimal number.






7. A communications channel that is being used for a purpose it was not intended for - usually to transfer information secretly.






8. A hacking method for stealing the cookies used during a session build and replaying them for unauthorized connection purposes.






9. A method of permitting only MAC addresses in a preapproved list network access. Addresses not matching are blocked.






10. A situation in which an IDS or other sensor triggers on an event as an intrusion attempt - when it was actually legitimate traffic.






11. A skilled hacker that straddles the line between white hat (hacking only with permission and within guidelines) and black hat (malicious hacking for personal gain). Gray hats sometime perform illegal acts to exploit technology with the intent of achi






12. Controls internal to a system designed to resolve vulnerabilities and errors soon after they arise.






13. Conversion of plaintext to ciphertext through the use of a cryptographic algorithm.






14. An Internet Protocol Security (IPSec) header used to verify that the contents of a packet have not been modified while the packet was in transit.






15. A Unix-like computer operating system descending from the BSD. Open-BSD includes a number of security features absent or optional in other operating systems.






16. In regard to hash algorithms - this occurs when two or more distinct inputs produce the same output.






17. A stand-alone computer - kept off the network - that is used for scanning potentially malicious media or software.






18. Port 80/81/8080






19. The combination of all IT assets - resources - components - and systems.






20. A value assigned to uniquely identify a single wide area network (WAN) in wireless LANs. SSIDs are broadcast by default - and are sent in the header of every packet. SSIDs provide no encryption or security.






21. Baseband LAN specification developed by Xerox Corporation - Intel - and Digital Equipment Corporation. One of the least expensive - most widely deployed networking standards; uses the CSMA/CD method of media access control.






22. A symmetric - block-cipher data-encryption standard that uses a variablelength key that can range from 32 bits to 448 bits.






23. A trusted entity that issues and revokes public key certificates. In a network - a CA is a trusted entity that issues - manages - and revokes security credentials and public keys for message encryption and/or authentication. Within a public key infra






24. A record showing which user has accessed a given resource and what operations the user performed during a given period.






25. A one-way mathematical function that generates a fixedlength numerical string (hash) from a given data input. MD5 and SHA-1 are hashing algorithms.






26. As an identification device becomes more sensitive or accurate - its FAR decreases while its FRR increases. The CER is the point at which these two rates are equal - or cross over.






27. A form of fraud in which someone pretends to be someone else by assuming that person's identity - typically in order to access resources or obtain credit and other benefits in that person's name.






28. Port 161/162






29. A person or entity indirectly involved in a relationship between two principles.






30. The conveying of official access or legal power to a person or entity.






31. An Application layer protocol used by local email clients to retrieve e-mail from a remote server over a TCP/IP connection.






32. A limit on the amount of time or number of iterations or transmissions in computer and network technology a packet can experience before it will be discarded.






33. An international encoding standard - working within multiple languages and scripts - that represents each letter - digit - or symbol with a unique numeric value that applies across different platforms.






34. A protocol used to pass control and error messages between nodes on the Internet.






35. Also known as the dot-dot-slash attack. Using directory traversal - the attacker attempts to access restricted directories and execute commands outside intended web server directories by using the URL to redirect to an unintended folder location.






36. The directory service created by Microsoft for use on itsnetworks. Provides a variety of network services using Lightweight Directory Access Protocol (LDAP) - Kerberos-based authentication - and single sign-on for user access to network-based resourc






37. The means by which a recipient of a message can ensure the identity of the sender and that neither party can deny having sent or received the message. The most common method is through digital certificates.






38. A set of related communications protocols operating together as a group to address communication at some or all of the seven layers of the OSI reference model.






39. A communications protocol used for browsing the Internet.






40. A standard for encrypting e-mail - web pages - and other stream-oriented information transmitted over the Internet.






41. A mathematical operation requiring two binary inputs: If the inputs match - the output is a 0 - otherwise it is a 1.






42. A business - government agency - or educational institution that provides access to the Internet.






43. A denial-of-service technique that uses numerous hosts to perform the attack.






44. A nonnumerical - subjective risk evaluation. Used with qualitative assessment (an evaluation of risk that results in ratings of none - low - medium - and high for the probability.)






45. A point of reference used to mark an initial state in order to manage change.






46. Port 53






47. A device that provides access between two or more networks. Gateways are typically used to connect dissimilar networks.






48. A string used for authentication in SNMP. The public community string is used for read-only searches - whereas the private community string is used for read/write. Community strings are transmitted in clear text in SNMPv1. SNMPv3 provides encryption






49. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






50. A virus that plants itself in a system's boot sector and infects the master boot record.