Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Formal description and evaluation of the vulnerabilities in an information system






2. A mode of operation for a block cipher - with the characteristic that each possible block of plaintext has a defined corresponding ciphertext value - and vice versa






3. A point-to-point connection between two endpoints created to exchangedata. Typically a tunnel is either an encrypted connection - or a connection using a protocol in a method for which it was not designed. An encrypted connection forms a point-to-poi






4. nmap all output






5. The act of dialing all numbers within an organization to discover open modems.






6. An authentication method on point-to-point links - using a three-way handshake and a mutually agreed-upon key.






7. The use of deceptive computer-based means to trick individuals into disclosing sensitive personal information






8. A symmetric key cipher where plaintext bits are combined with a pseudo-random cipher bit stream (keystream) - typically by an exclusive-or (XOR) operation. In a stream cipher the plaintext digits are encrypted one at a time - and the transformation o






9. A backup facility with the electrical and physical components of a computer facility - but with no computer equipment in place. The site is ready to receive the necessary replacement computer equipment in the event the user has to move from his main






10. Evaluation in which testers attempt to penetrate the network.






11. Host-based IDS. An IDS that resides on the host - protecting against file and folder manipulation and other host-based attacks and actions.






12. A nonroutable IP address range intended for use only within the confines of a single organization - falling within the predefined ranges of 10.0.0.0 - 172.16-31.0.0 - or 192.168.0.0.






13. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.






14. A software or hardware defect that often results in system vulnerabilities.






15. Baseband LAN specification developed by Xerox Corporation - Intel - and Digital Equipment Corporation. One of the least expensive - most widely deployed networking standards; uses the CSMA/CD method of media access control.






16. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.






17. A hardware device used to log keystrokes covertly. Hardware keystroke loggers are very dangerous due to the fact that they cannot be detected through regular software/anti-malware scanning.






18. A standard developed to enable routers to exchange messages containing information about routes to reach subnets in the network.






19. A command that instructs the system processor to do nothing. Many overflow attacks involve stringing several NOP operations together (known as a NOP sled).






20. The ability to trace actions performed on a system to a specific user or system entity.






21. Malicious code that uses a polymorphic engine to mutate while keeping the original algorithm intact; the code changes itself each time it runs - but the function of the code will not change.






22. A query and response protocol widely used for querying databases that store the registered users or assignees of an Internet resource - such as a domain name - an IP address - or an autonomous system.






23. Any item of value or worth to an organization - whether physical or virtual.






24. A decision to reduce the potential for damage to or loss of an IT asset by taking some type of action






25. A condition that occurs when more data is written to a buffer than it has space to store - and results in data corruption or other system errors. This is usually due to insufficient bounds checking - a bug - or improper configuration in the program c






26. Polite scan timing






27. A situation in which an IDS or other sensor triggers on an event as an intrusion attempt - when it was actually legitimate traffic.






28. Chronological record of system activities to enable the reconstruction and examination of the sequence of events and changes in an event.






29. 1. The path a packet travels to reach the intended destination. Each individual device along the path traveled is called a hop. 2. Information contained on a device containing instructions for reaching other nodes on the network. This information can






30. The cyclical practice of identifying - classifying - remediating - and mitigating vulnerabilities.






31. A protocol that uses a private key to encrypt data before transmitting confidential documents over the Internet; widely used on e-commerce - banking - and other sites requiring privacy.






32. In penetration testing - this is a method of testing the security of a system or subnet without any previous knowledge of the device or network. Designed to simulate an attack by an outside intruder (usually from the Internet).






33. An Application layer protocol for sending electronic mail between servers.






34. Hex 12






35. Access by information systems (or users) communicating from outside the information system security perimeter.






36. A penetration test in which the ethical hacker has limited knowledge of the intended target(s). Designed to simulate an internal - but non-systemadministrator-level attack.






37. Incremental Substitution






38. Port 31337






39. The science or study of protecting information - whether in transit or at rest - by using techniques to render the information unusable to anyone who does not possess the means to decrypt it.






40. A method for detecting malicious code on a computer where the files are compared to signatures of known viruses stored in a database.






41. Nmap ml output






42. A wireless LAN security standard developed by IEEE. Requires Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).






43. The exploitation of a security vulnerability






44. The means by which a recipient of a message can ensure the identity of the sender and that neither party can deny having sent or received the message. The most common method is through digital certificates.






45. Computer software or hardware that can intercept and log traffic passing over a digital network.






46. An attack against an authentication protocol in which the attacker intercepts data in transit along the network between the claimant and verifier - but does not alter the data (in other words - eavesdropping).






47. A limit on the amount of time or number of iterations or transmissions in computer and network technology a packet can experience before it will be discarded.






48. The art and science of creating a covert message or image within another message - image - audio - or video file.






49. ICMP Timestamp






50. A defined measure of service within a network system