Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. The Security Accounts Manager file in Windows stores all the password hashes for the system.






2. An Internet Protocol Security (IPSec) header used to verify that the contents of a packet have not been modified while the packet was in transit.






3. An extensible mechanism for e-mail. A variety of MIME types exist for sending content such as audio - binary - or video using the Simple Mail Transfer Protocol (SMTP).






4. A legal limit on the amount of financial liability and remedies the organization is responsible for taking on.






5. Hex 10






6. A query and response protocol widely used for querying databases that store the registered users or assignees of an Internet resource - such as a domain name - an IP address - or an autonomous system.






7. Vulnerability Scanning






8. An anonymous connection to an administrative share (IPC$) on a Windows machine. Null sessions allow for enumeration of Windows machines - among other attacks.






9. Method used by antivirus software to detect new - unknown viruses that have not yet been identified; based on a piece-by-piece examination of a program - looking for a sequence or sequences of instructions that differentiate the virus from 'normal' p






10. White box test






11. A communications path - such as the Internet - authorized for data transmission within a computer system or network.






12. The ability to trace actions performed on a system to a specific user or system entity.






13. A piece of software - provided by the vendor - intended to update or fix known - discovered problems in a computer program or its supporting data.






14. ICMP Netmask






15. An attack where the hacker manipulates parameters within the URL string in hopes of modifying data.






16. ACK Scan






17. A device set up to send a response on behalf of an end node to the requesting host. Proxies are generally used to obfuscate the host from the Internet.






18. A list of IP addresses and corresponding MAC addresses stored on a local computer.






19. Port 22






20. Sending unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones - PDAs - or laptop computers.






21. A standard that provides best-practice recommendations on information security management for use by those responsible for initiating - implementing - or maintaining Information Security Management Systems (ISMS). Information security is defined with






22. An early network application that provides information on users currently logged on to a machine.






23. Weakness in an information system - system security procedures - internal controls - or implementation that could be exploited or triggered by a threat source.






24. Network Scanning






25. An inspection of a place where a company or individual proposes to work - to gather the necessary information for a design or risk assessment.






26. A social-engineering effort in which the attacker pretends to be an employee - a valid user - or even an executive to elicit information or access.






27. Provides data encryption for IEEE 802.11 wireless networks so data can only be decrypted by the intended recipients.






28. Text or data in its encrypted form; the result of plaintext being input into a cryptographic algorithm.






29. Aggressive scan timing






30. Port 31337






31. The process of systematically testing each port on a firewall to map rules and determine accessible ports.






32. Hashing algorithm that results in a 128-bit output.






33. Freely and readily available information on an organization that can be gathered by a business entity about its competitor's customers - products - and marketing - and can be used by an attacker to build useful information for further attacks.






34. A type 0 ICMP message used to reply to ECHO requests. Used with ping to verify network layer connectivity between hosts.






35. An Ethernet networking system transmitting data at 100 million bits per second (Mbps) - 10 times the speed of an earlier Ethernet standard. Derived from the Ethernet 802.3 standard - it is also known as 100BaseT.






36. nmap






37. A documented process for a procedure designed to be consistent - repeatable - and accountable.






38. The change or growth of a project's scope






39. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






40. Idlescan






41. An industry standard protocol used for accessing and managing information within a directory service; an application protocol for querying and modifying data using directory services running over TCP/IP.






42. A security tool designed to protect a system or network against attacks by comparing traffic patterns against a list of both known attack signatures and general characteristics of how attacks may be carried out. Threats are rated and reported.






43. The transmission of digital signals without precise clocking or synchronization.






44. A free and popular version of the Unix operating system.






45. A denial-of-service attack where the attacker sends a ping to the network's broadcast address from the spoofed IP address of the target. All systems in the subnet then respond to the spoofed address - eventually flooding the device.






46. Describes practices in production and development that promote access to the end product's source materials.






47. The potential for damage to or loss of an IT asset






48. A business - government agency - or educational institution that provides access to the Internet.






49. Two or more LANs connected by a high-speed line across a large geographical area.






50. A cyber attacker who acts without permission from - and gives prior notice to - the resource owner. Also known as a malicious hacker.