Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A type of denial-of-service attack where a hacker sends thousands of SYN packets to the target with spoofed IP addresses.






2. A brand name of analog scrambling and de-scrambling equipment for cable and satellite television - invented primarily to keep consumer Television receive-only (TVRO) satellite equipment from receiving TV programming except on a subscription basis.






3. The change or growth of a project's scope






4. A pen testing method where the attacker knows all information about the internal network. It is designed to simulate an attack by a disgruntled systems administrator - or similar level.






5. The security property that data is not modified in an unauthorized and undetected manner. Also - the principle and measures taken to ensure that data received is in the exact same condition and state as when it was originally transmitted.






6. A self-replicating malicious program that attempts installation beneath antivirus software by directly intercepting the interrupt handlers of the operating system to evade detection.






7. A point of reference used to mark an initial state in order to manage change.






8. A term representing the responsibility managers and their organizations have to provide information security to ensure the type of control - the cost of control - and the deployment of control are appropriate for the system being managed.






9. A standard for encrypting e-mail - web pages - and other stream-oriented information transmitted over the Internet.






10. An approach to restricting system access to authorized users in which roles are created for various job functions. The permissions to perform certain operations are assigned to specific roles. Members of staff (or other system users) are assigned par






11. A set of related communications protocols operating together as a group to address communication at some or all of the seven layers of the OSI reference model.






12. Activities to determine the extent to which a security control is implemented correctly - operating as intended - and producing the desired outcome with respect to meeting the security requirements for the system.






13. An Application layer protocol - using TCP - for transporting files across an Internet connection. FTP transmits in clear text.






14. Describes practices in production and development that promote access to the end product's source materials.






15. An unknown deficiency in software or some other product that results in a security vulnerability being identified.






16. FIN Scan






17. A tool that helps a company to compare its actual performance with its potential performance.






18. Evaluation in which testers attempt to penetrate the network.






19. ICMP Type/Code 8






20. A measurable - physical characteristic used to recognize the identity - or verify the claimed identity - of an applicant. Facial images - fingerprints - and handwriting samples are all examples of biometrics.






21. A group of experts that handles computer security incidents.






22. A class of algorithms for cryptography that use the same cryptographic key for both decryption and encryption.






23. TCP SYN Scan






24. A wireless LAN device that acts as a central point for all wireless traffic. The AP is connected to both the wireless LAN and the wired LAN - providing wireless clients access to network resources.






25. Set of tools (applications or code) that enables administrator-level accessto a computer or computer network and is designed to obscure the fact that the system has been compromised. Rootkits are dangerous malware entities that provide administrator






26. A formal set of rules describing data transmission - especially across a network. A protocol determines the type of error checking - the data compression method - how the sending device will indicate completion - how the receiving device will indicat






27. A social-engineering attack that manipulates the victim into calling the attacker for help.






28. ICMP Timestamp






29. A type of malware that covertly collects information about a user.






30. Software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality - integrity - or availability of an information system. A virus - worm - Trojan horse - or other code-based entity that infects a






31. Network Scanning






32. Sneaky scan timing






33. A system used by the Securities and Exchange Commission (SEC) for companies and businesses to transmit required filings and information. The EDGAR database performs automated collection - validation - indexing - acceptance - and forwarding of submiss






34. Monitoring of telephone or Internet conversations - typically by covert means.






35. An e-mail message warning users of a nonexistent virus and encouraging them to pass on the message to other users.






36. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive






37. Port 135






38. The act of secretly listening to the private conversations of others without their consent. This can also be done over telephone lines (wiretapping) - e-mail - instant messaging - and other methods of communication considered private






39. Authentication confirms the identity of the user or device. Authorization determines the privileges (rights) of the user or device. Accounting records the access attempts - both successful and unsuccessful.






40. A program designed to browse websites in an automated - methodical manner. Sometimes these programs are used to harvest information from websites - such as e-mail addresses.






41. Also known as a public key certificate - this is an electronic file that is used to verify a user's identity - providing non-repudiation throughout the sys-tem. Certificates contain the entity's public key - serial number - version - subject - algori






42. An attacker who breaks into computer systems with malicious intent - without the owner's knowledge or permission.






43. A data encryption/decryption program often used for e-mail and file storage.






44. The act of dialing all numbers within an organization to discover open modems.






45. A connection-oriented - layer 4 protocol for transporting data over network segments. TCP is considered reliable because it guarantees delivery and the proper reordering of transmitted packets. This protocol is used for most long-haul traffic on the






46. White box test






47. A widely used authentication protocol developed at the MassachusettsInstitute of Technology (MIT). Kerberos authentication uses tickets - Ticket Granting Service - and Key Distribution Center.






48. Phases of an attack






49. Provides router-to-router or host-to-network connections over asynchronous and synchronous circuits.






50. A device or service designed to obfuscate traffic between a client and the Internet. Generally used to make activity on the Internet as untraceable as possible.