Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The basis of this kind of security is that an individual user - or program operating on the user's behalf - is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the use






2. In computer security - this is an algorithm that uses separate keys for encryption and decryption.






3. ICMP Type/Code 11






4. Freely and readily available information on an organization that can be gathered by a business entity about its competitor's customers - products - and marketing - and can be used by an attacker to build useful information for further attacks.






5. Establish Null Session






6. The subjective - potential percentage of loss to a specific asset if a specific threat is realized. The exposure factor (EF) is a subjective value the person assessing risk must define.






7. A software or hardware application or device that captures user keystrokes.






8. Process of breaking a packet into smaller units when it is being transmitted over a network medium that's unable to support a transmission unit the original size of the packet.






9. TCP connect() scan






10. A section or subset of the network. Often a router or other routing device provides the end point of the segment.






11. A hacker who aims to bring down critical infrastructure for a 'cause' and does not worry about the penalties associated with his actions.






12. An extensible mechanism for e-mail. A variety of MIME types exist for sending content such as audio - binary - or video using the Simple Mail Transfer Protocol (SMTP).






13. ACK Scan






14. The security property that data is not modified in an unauthorized and undetected manner. Also - the principle and measures taken to ensure that data received is in the exact same condition and state as when it was originally transmitted.






15. Text or data in its encrypted form; the result of plaintext being input into a cryptographic algorithm.






16. An early network application that provides information on users currently logged on to a machine.






17. A method of evaluating the security of a computer system or network by simulating an attack from a malicious source.






18. The lack of clocking (imposed time ordering) on a bit stream.






19. Insane scan timing






20. Black hat






21. Port 135






22. The act of checking some sequence of tokens for the presence of the constituents of some pattern.






23. A limit on the amount of time or number of iterations or transmissions in computer and network technology a packet can experience before it will be discarded.






24. An attack against an authentication protocol in which the attacker intercepts data in transit along the network between the claimant and verifier - but does not alter the data (in other words - eavesdropping).






25. A protocol defining packets that are able to be routed by a router.






26. A string that represents the location of a web resource






27. Polite scan timing






28. The process of determining if a network entity (user or service) is legitimate






29. Also known as a public key certificate - this is an electronic file that is used to verify a user's identity - providing non-repudiation throughout the sys-tem. Certificates contain the entity's public key - serial number - version - subject - algori






30. Malicious code that uses a polymorphic engine to mutate while keeping the original algorithm intact; the code changes itself each time it runs - but the function of the code will not change.






31. Security measures - such as a locked door - perimeter fence - or security guard - to prevent or deter physical access to a facility - resource - or information stored on physical media.






32. FTP Bounce Attack






33. The science or study of protecting information - whether in transit or at rest - by using techniques to render the information unusable to anyone who does not possess the means to decrypt it.






34. A method of falsely identifying the source of data packets; often used by hackers to make it difficult to trace where an attack originated.






35. A network traffic management technique designed to allow applications to specify the route a packet will take to a destination - regardless of what the route tables between the two systems say.






36. A symmetric key cipher where plaintext bits are combined with a pseudo-random cipher bit stream (keystream) - typically by an exclusive-or (XOR) operation. In a stream cipher the plaintext digits are encrypted one at a time - and the transformation o






37. A type 0 ICMP message used to reply to ECHO requests. Used with ping to verify network layer connectivity between hosts.






38. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive






39. A limited-function version of the Internetworking Operating System (IOS) - held in read-only memory in some earlier models of Cisco devices - capable of performing several seldom-needed low-level functions such as loading a new IOS into Flash memory






40. An enumeration technique used to provide information about a computer system; generally used for operating system identification (also known as fingerprinting).






41. A hardware device used to log keystrokes covertly. Hardware keystroke loggers are very dangerous due to the fact that they cannot be detected through regular software/anti-malware scanning.






42. The public portion of an asymmetric key pair typically used to encrypt data or verify signatures. Public keys are shared and are used to encrypt messages.






43. Also known as a digital certificate - this is an electronic file used to verify a user's identity - providing non-repudiation throughout the system It is also a set of data that uniquely identifies an entity. Certificates contain the entity's public






44. A principle in security engineering that attempts to use anonymity and secrecy (of design - implementation - and so on) to provide security; the footprint of the organization - entity - network - or system is kept as small as possible to avoid intere






45. The means by which a recipient of a message can ensure the identity of the sender and that neither party can deny having sent or received the message. The most common method is through digital certificates.






46. A hacking method for stealing the cookies used during a session build and replaying them for unauthorized connection purposes.






47. A method of defining what rights and permissions an entity has to a given resource. In networking - Access Control Lists are commonly associated with firewall and router traffic filtering rules.






48. The monetary loss that can be expected for an asset due to risk over a one-year period. ALE is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as ALE = ARO






49. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.






50. Port 137/138/139