SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
CEH: Certified Ethical Hacker
Start Test
Study First
Subjects
:
certifications
,
ceh
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Evaluation in which testers attempt to penetrate the network.
Open System Interconnection (OSI) Reference Model
Level III assessment
Information Technology (IT) security architecture and framework
Bluetooth
2. A protocol for transporting data packets across a packet switched internetwork (such as the Internet). IP is a routed protocol.
Three-Way (TCP) Handshake
Internet Protocol (IP)
Tumbling
Denial of Service (DoS)
3. The potential for damage to or loss of an IT asset
The automated process of proactively identifying vulnerabilities of computing systems present in a network
halo effect
risk
Cryptography
4. Security identifier. The method by which Windows identifies user - group - and computer accounts for rights and permissions.
SID
security incident response team (SIRT)
parameter tampering
End User Licensing Agreement (EULA)
5. A standard developed to enable routers to exchange messages containing information about routes to reach subnets in the network.
Routing Protocol
Client
Internet Protocol Security (IPSec) architecture
Kerberos
6. A term trademarked by the Wi-Fi Alliance - used to define a standard for devices to use to connect to a wireless network.
Wi-Fi
nslookup
-sI
gray hat
7. Weakness in an information system - system security procedures - internal controls - or implementation that could be exploited or triggered by a threat source.
Audit Data
Computer Emergency Response Team (CERT)
Database
Vulnerability
8. A small Trojan program that listens on port 777.
Distributed DoS (DDoS)
hot site
encryption
Tini
9. The means by which a recipient of a message can ensure the identity of the sender and that neither party can deny having sent or received the message. The most common method is through digital certificates.
Telnet
security defect
service level agreements (SLAs)
non-repudiation
10. Vulnerability Scanning
The automated process of proactively identifying vulnerabilities of computing systems present in a network
Console Port
reverse lookup; reverse DNS lookup
net use \[target ip]IPC$ '' /user:''
11. A formal set of rules describing data transmission - especially across a network. A protocol determines the type of error checking - the data compression method - how the sending device will indicate completion - how the receiving device will indicat
Level I assessment
Brute-Force Password Attack
protocol
Cold Site
12. A program or piece of code inserted into a system - usually covertly - with the intent of compromising the confidentiality - integrity - or availability of the victim's data - applications - or operating system. Malware consists of viruses - worms -
spoofing
Denial of Service (DoS)
Malware
Internet Assigned Number Authority (IANA)
13. An organization's threshold for the seven areas of information security responsibility. This level is established based on the objectives for maintaining confidentiality - integrity - and availability of the organization's IT assets and infrastructur
Information Technology (IT) infrastructure
protocol stack
Minimum acceptable level of risk
Hypertext Transfer Protocol (HTTP)
14. Confidentiality - Integrity - and Availability are the three aspects of security and make up the triangle.
Collision
CIA triangle
gray hat
-b
15. Layer 2 of the OSI reference model. This layer provides reliable transit of data across a physical link. The Data Link layer is concerned with physical addressing - network topology - access to the network medium - error detection - sequential delive
Data Link layer
Fraud and related activity in connection with computers
Information Technology (IT) asset criticality
Minimum acceptable level of risk
16. A non-self-replicating program that appears to have a useful purpose - but in reality has a different - malicious purpose.
Trojan Horse
NT LAN Manager (NTLM)
-oA
Defines legal email marketing
17. Controls to detect anomalies or undesirable events occurring on a system.
Digital Certificate
packet filtering
Countermeasures
Detective Controls
18. A mode of operation in a wireless LAN in which clients send data directly to one another without utilizing a wireless access point (WAP) - much like a point-to-point wired connection.
Ethical Hacker
ad hoc mode
Possession of access devices
Unicode
19. A communications channel that is being used for a purpose it was not intended for - usually to transfer information secretly.
-b
Algorithm
Covert Channel
POP 3
20. A point-to-point connection between two endpoints created to exchangedata. Typically a tunnel is either an encrypted connection - or a connection using a protocol in a method for which it was not designed. An encrypted connection forms a point-to-poi
404EE
Asymmetric
Defines legal email marketing
Tunnel
21. A section or subset of the network. Often a router or other routing device provides the end point of the segment.
segment
proxy server
Routing Protocol
Reconnaissance - Scanning - Gaining Access - Maintaining Access - Covering Tracks
22. A group of penetration testers that assess the security of an organization - which is often unaware of the existence of the team or the exact assignment.
-PI
red team
Zero Subnet
reverse social engineering
23. Port 53
DNS
Echo Reply
Simple Network Management Protocol (SNMP)
Secure Sockets Layer (SSL)
24. A suite of protocols used for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session. This suite includes protocols for establishing mutual authentication between agents at the sessio
enumeration
non-repudiation
hybrid attack
Internet Protocol Security (IPSec) architecture
25. A routing protocol developed to be used within a single organization.
Digital Certificate
Interior Gateway Protocol (IGP)
RPC-DCOM
Active Directory (AD)
26. The steps taken to gather evidence and information on the targets you wish to attack.
risk transference
Interior Gateway Protocol (IGP)
reconnaissance
National Security Agency
27. The monetary loss that can be expected for an asset due to risk over a one-year period. ALE is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as ALE = ARO
The automated process of proactively identifying vulnerabilities of computing systems present in a network
-PT
firewalking
Annualized Loss Expectancy (ALE)
28. In penetration testing - this is a method of testing the security of a system or subnet without any previous knowledge of the device or network. Designed to simulate an attack by an outside intruder (usually from the Internet).
non-repudiation
Black Box Testing
Asymmetric
Simple Object Access Protocol (SOAP)
29. A program designed to browse websites in an automated - methodical manner. Sometimes these programs are used to harvest information from websites - such as e-mail addresses.
-PI
-p <port ranges>
Address Resolution Protocol (ARP)
Web Spider
30. A distance-vector routing protocol that employs the hop count as a routing metric. The 'hold down time -' used to define how long a route is held in memory - is 180 seconds. RIP prevents routing loops by implementing a limit on the number of hops all
Internet Protocol (IP)
spoofing
Certificate Authority (CA)
Routing Information Protocol (RIP)
31. Controlling access to a network by analyzing the headers of incoming and outgoing packets - and letting them pass or discarding them based on rule sets created by a network administrator. A packet filter allows or denies packets based on destination
packet filtering
rogue access point
Unicode
Hacks with permission
32. A means of exchanging information from one entity to another using a process that does not provide an attacker the opportunity to reorder - delete - insert - or read information.
secure channel
Event
quality of service (QoS)
Level III assessment
33. The rate at which a biometric system will incorrectly reject an access attempt by an authorized user.
steganography
Asymmetric Algorithm
Daisy Chaining
false rejection rate (FRR)
34. Access by information systems (or users) communicating from outside the information system security perimeter.
remote access
reverse lookup; reverse DNS lookup
Ethernet
EDGAR database
35. In a classful IPv4 subnet - this is the network number with all binary 0s in the subnet part of the number. When written in decimal - the zero subnet has the same number as the classful network number.
Asset
Zero Subnet
Real application encompassing Trojan
encapsulation
36. The basis of this kind of security is that an individual user - or program operating on the user's behalf - is allowed to specify explicitly the types of access other users (or programs executing on their behalf) may have to information under the use
Discretionary Access Control (DAC)
Active Fingerprinting
Google hacking
FTP
37. In penetration testing - enumeration is the act of querying a device or network segment thoroughly and systematically for information.
spyware
enumeration
smart card
Lightweight Directory Access Protocol (LDAP)
38. A standard for encrypting and authenticating MIME data; used primarily for Internet e-mail.
Secure Multipurpose Mail Extension (S/MIME)
Malicious code
Access Creep
Tunneling Virus
39. ICMP Ping
Bluetooth
Point-to-Point Protocol (PPP)
segment
-PI
40. A derogatory term used to describe an attacker - usually new to the field - who uses simple - easy-to-follow scripts or programs developed by others to attack computer systems and networks and deface websites.
Cryptography
script kiddie
Bit Flipping
Multipurpose Internet Mail Extensions (MIME)
41. A method for detecting malicious code on a computer where the files are compared to signatures of known viruses stored in a database.
local area network (LAN)
OpenBSD
steganography
signature scanning
42. Malicious code that uses a polymorphic engine to mutate while keeping the original algorithm intact; the code changes itself each time it runs - but the function of the code will not change.
polymorphic virus
Certificate Authority (CA)
footprinting
XOR Operation
43. A storage buffer that transparently stores data so future requests for the same data can be served faster.
Eavesdropping
CAM table
Availability
Cache
44. ICMP Netmask
Real application encompassing Trojan
-PM
NetBus
Exploit
45. An attack against an authentication protocol in which the attacker intercepts data in transit along the network between the claimant and verifier - but does not alter the data (in other words - eavesdropping).
War Chalking
Malicious code
queue
passive attack
46. Injecting traffic into the network to identify the operating system of a device.
Active Fingerprinting
File Transfer Protocol (FTP)
Virtual Local Area Network (VLAN)
risk avoidance
47. A host designed to collect data on suspicious activity.
firewalking
Archive
honeypot
-sF
48. Authentication confirms the identity of the user or device. Authorization determines the privileges (rights) of the user or device. Accounting records the access attempts - both successful and unsuccessful.
phishing
Authentication - Authorization - and Accounting (AAA)
router
Zero Subnet
49. Hex 14
Hypertext Transfer Protocol Secure (HTTPS)
security breach or security incident
A R
Routing Information Protocol (RIP)
50. A sublayer of layer 2 of the OSI model - the Data Link layer. It provides addressing and channel access control mechanisms that enable several terminals or network nodes to communicate within a multipoint network.
security controls
Copyright
Bluesnarfing
Media Access Control (MAC)