Test your basic knowledge |

CEH: Certified Ethical Hacker

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. A set of rules defined to screen network packets based on source address - destination address - or protocol; these rules determine whether the packet will be forwarded or discarded.






2. Computer software or hardware that can intercept and log traffic passing over a digital network.






3. LM Hash for short passwords (under 7)






4. A decision to reduce the potential for damage to or loss of an IT asset by taking some type of action






5. A means of exchanging information from one entity to another using a process that does not provide an attacker the opportunity to reorder - delete - insert - or read information.






6. The potential for damage to or loss of an IT asset






7. An HTTP command to transmit text to a web server for processing. The opposite of an HTTP GET.






8. A business - government agency - or educational institution that provides access to the Internet.






9. A structured set of criteria for evaluating computer security within products and systems produced by European countries; it has been largely replaced by the Common Criteria.






10. A piece of software - provided by the vendor - intended to update or fix known - discovered problems in a computer program or its supporting data.






11. Freely and readily available information on an organization that can be gathered by a business entity about its competitor's customers - products - and marketing - and can be used by an attacker to build useful information for further attacks.






12. An attack technique that tricks your DNS server into believing it has received authentic information when - in reality - it has been provided fraudulent data. DNS cache poisoning affects user traffic by sending it to erroneous or malicious end points






13. A method of network traffic filtering that monitors the entire communications process - including the originator of the session and from which direction it started.






14. One or more locations from which control is exercised over a computer - television broadcast - or telecommunications network.






15. A symmetric key cryptographic algorithm that transforms a block of information at a time using a cryptographic key. For a block cipher algorithm - the length of the input block is the same as the length of the output block.






16. A wireless LAN security standard developed by IEEE. Requires Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).






17. Controls to detect anomalies or undesirable events occurring on a system.






18. Cracking Tools






19. 18 U.S.C. 1029






20. The last portion of the SID that identifies the user to the system in Windows. A RID of 500 identifies the administrator account.






21. Whether purposeful or the result of malware or other attack - a backdoor is a hidden capability in a system or program for bypassing normal computer authentication systems.






22. Self-contained network with a limited number of participants who extend limited trust to one another in order to accomplish an agreed-upon goal.






23. An attack where the hacker positions himself between the client and the server - to intercept (and sometimes alter) data traveling between the two.






24. A computer system that performs tasks dictated by an attacker from a remote location. Zombies may be active or idle - and owners of the systems generally do not know their systems are compromised.






25. The process of pinging each address within a subnet to map potential targets. Ping sweeps are unreliable and easily detectable - but very fast.






26. A unique hostname that is used to identify resources on the Internet. Domain names start with a root (.) - then add a top level (.com - .gov - or .mil - for example) - and a given name space.






27. Policy stating what users of a system can and cannot do with the organization's assets.






28. TCP connect() scan






29. An environmentally conditioned workspace partially equipped with IT and telecommunications equipment to support relocated IT operations in the event of a significant disruption.






30. A mode of operation in a wireless LAN in which clients send data directly to one another without utilizing a wireless access point (WAP) - much like a point-to-point wired connection.






31. Malware designed to install some sort of virus - backdoor - and so on - on a target system.






32. Evaluation in which testers attempt to penetrate the network.






33. A record showing which user has accessed a given resource and what operations the user performed during a given period.






34. Aggressive scan timing






35. Access by information systems (or users) communicating from outside the information system security perimeter.






36. A computer network confined to a relatively small area - such as a single building or campus - in which devices connect through high-frequency radio waves using IEEE standard 802.11.






37. A condition that occurs when more data is written to a buffer than it has space to store - and results in data corruption or other system errors. This is usually due to insufficient bounds checking - a bug - or improper configuration in the program c






38. Manipulating a search string with additional specific operators to search for vulnerabilities or very specific information.






39. The monetary value assigned to an IT asset.






40. The condition of a resource being ready for use and accessible by authorized users.






41. A text file stored within a browser by a web server that maintains information about the connection. Cookies are used to store information to maintain a unique but consistent surfing experience - but can also contain authentication parameters. Cookie






42. A wireless access point that has either been installed on a secure company network without explicit authorization from a local network administrator - or has been created to allow a hacker to conduct a man-in-the-middle attack.






43. Hex 10






44. A connectionless - layer 4 transport protocol. UDP is faster than TCP - but offers no reliability. A best effort is made to deliver the data - but no checks and verifications are performed to guarantee delivery. Therefore - UDP is termed a 'connectio






45. NSA






46. A technology where you advertise one IP address externally and data packets are rerouted to the appropriate IP address inside your network by a device providing translation services. In this way - IP addresses of machines on your internal network are






47. Software or hardware components that restrict access between a protected network and the Internet - or between other sets of networks - to block unwanted use or attacks.






48. PI and PT Ping






49. A function that is easy to compute in one direction - yet believed to be difficult to compute in the opposite direction (finding its inverse) without special information - called the 'trapdoor.' Widely used in cryptography.






50. CAN-SPAM