Quiz
CEH 3
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (43)
1The fundamental difference between symmetric and asymmetric key cryptographic systems is that symmetric key cryptography uses which of the following?
- AMultiple keys for non-repudiation of bulk data
- BDifferent keys on both ends of the transport medium
- CBulk encryption for data transmission over fiber
- DThe same key on each end of the transmission medium
2Which of the following is an example of an asymmetric encryption implementation?
- ASHA1
- BPGP
- C3DES
- DMD5
3A person approaches a network administrator and wants advice on how to send encrypted email from home. The end user does not want to have to pay for any license fees or manage server services. Which of the following is the most secure encryption protocol that the network administrator should recommend?
- AIPSEC
- BMIME
- CPGP
- DHTTPS
4To send a PGP encrypted message, which piece of information from the recipient must the sender have before encrypting the message?
- ARecipient’s private key
- BRecipient’s public key
- CMaster encryption key
- DSender’s public key
5Which of the following areas is considered a strength of symmetric key cryptography when compared with asymmetric algorithms?
- AScalability
- BSpeed
- CKey distribution
- DSecurity
6In which of the following password protection technique, random strings of characters are added to the password before calculating their hashes
- AKeyed Hashing
- BDouble Hashing
- CSalting
- DKey Stretching
7This asymmetry cipher is based on factoring the product of two large prime numbers.
What cipher is described above?- ARSA
- BSHA
- CRC5
- DMD5
8During the process of encryption and decryption, what keys are shared?
- APublic keys
- BPublic and private keys
- Cprivate keys
- DUser passwords
9Which of the following Secure Hashing Algorithm (SHA) provides better protection against brute force attacks by producing a 160-bit digest from a message with a maximum length of (264 – 1) bits and resembles the MD5 algorithm?
- ASHA-0
- BSHA-1
- CSHA-2
- DSHA-3
10After gaining access to the password hashes used to protect access to a web based application, knowledge of which cryptographic algorithms would be useful to gain access to the application?
- ASHA1
- BDiffie-Helman
- CRSA
- DAES
11Diffie-Hellman (DH) groups determine the strength of the key used in the key exchange process. Which of the following is the correct bit size of the Diffie-Hellman (DH) group 5?
- A768 bit key
- B1025 bit key
- C1536 bit key
- D2048 bit key
12Which cipher encrypts the plain text digit (bit or byte) one by one?
- AClassical cipher
- BBlock cipher
- CModern cipher
- DStream cipher
13An attacker has captured a target file that is encrypted with public key cryptography. Which of the attacks below is likely to be used to crack the target file?
- ATiming attack
- BReplay attack
- CMemory trade-off attack
- DChosen plain-text attack
14In which of the following cryptography attack methods, the attacker makes a series of interactive queries, choosing subsequent plaintexts based on the information from the previous encryptions?
- AAdaptive chosen-plaintext attack
- BKnown-plaintext attack
- CChosen-plaintext attack
- DCiphertext-only attack
15An attacker sniffs encrypted traffic from the network and is subsequently able to decrypt it. The attacker can now use which cryptanalytic technique to attempt to discover the encryption key?
- ABirthday attack
- BPlaintext attack
- CMeet in the middle attack
- DChosen ciphertext attack
16Which of the following cryptography attack is an understatement for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture?
- ACiphertext-only Attack
- BRubber Hose Attack
- CChosen-Cipher text Attack
- DTiming Attack
17Which of the following cryptography attack methods is usually performed without the use of a computer?
- ACiphertext-only attack
- BChosen key attack
- CRubber hose attack
- DRainbow table attack
18What is correct about digital signatures?
- AA digital signature cannot be moved from one signed document to another because it is the hash of the original document encrypted with the private key of the signing party.
- BDigital signatures may be used in different documents of the same type.
- CA digital signature cannot be moved from one signed document to another because it is a plain hash of the document content.
- DDigital signatures are issued once for each user and can be used everywhere until they expire.
19What two conditions must a digital signature meet?
- AMust be unique and have special characters.
- BHas to be legible and neat.
- CHas to be unforgeable, and has to be authentic.
- DHas to be the same number of characters as a physical signature and must be unique.
20Cryptography is the practice and study of techniques for secure communication in the presence of third parties (called adversaries). More generally, it is about constructing and analyzing protocols that overcome the influence of adversaries and that are related to various aspects in information security such as data confidentiality, data integrity, authentication, and non-repudiation. Modern cryptography intersects the disciplines of mathematics, computer science, and electrical engineering. Applications of cryptography include ATM cards, computer passwords, and electronic commerce.
Basic example to understand how cryptography works is given below:
SECURE (plain text)
+1 (+1 next letter. for example, the letter “”T”” is used for “”S”” to encrypt.)
TFDVSF (encrypted text)
+ = logic => Algorithm
1 = Factor => Key
Which of the following choices true about cryptography?- AAlgorithm is not the secret, key is the secret.
- BPublic-key cryptography, also known as asymmetric cryptography, public key is for decrypt, private key is for encrypt.
- CSymmetric-key algorithms are a class of algorithms for cryptography that use the different cryptographic keys for both encryption of plaintext and decryption of ciphertext
- DSecure Sockets Layer (SSL) use the asymmetric encryption both (public/private key pair) to deliver the shared session key and to achieve a communication way.
21Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?
- AIt is impossible to crack hashed user passwords unless the key used to encrypt them is obtained.
- BIf a user forgets the password, it can be easily retrieved using the hash key stored by administrators.
- CHashing is faster compared to more traditional encryption algorithms.
- DPasswords stored using hashes are non-reversible, making finding the password much more difficult.
22For messages sent through an insecure channel, a properly implemented digital signature gives the receiver reason to believe the message was sent by the claimed sender. While using a digital signature, the message digest is encrypted with which key?
- ASender’s public key
- BReceiver’s private key
- CReceiver’s public key
- DSender’s private key
23When setting up a wireless network, an administrator enters a pre-shared key for security. Which of the following is true?
- AThe key entered is a symmetric key used to encrypt the wireless data.
- BThe key entered is a hash that is used to prove the integrity of the wireless data.
- CThe key entered is based on the Diffie-Hellman method.
- DThe key is an RSA key used to encrypt the wireless data.
24In the software security development life cycle process, threat modeling occurs in which phase?
- ADesign
- BRequirements
- CVerification
- DImplementation
25What is the main disadvantage of the scripting languages as opposed to compiled programming languages?
- AScripting languages are hard to learn.
- BScripting languages are not object-oriented.
- CScripting languages cannot be used to create graphical user interfaces.
- DScripting languages are slower because they require an interpreter to run the code.
26What is the role of test automation in security testing?
- AIt can accelerate benchmark tests and repeat them with a consistent test setup. But it cannot replace manual testing completely.
- BTest automation is not usable in security due to the complexity of the tests
- CIt should be used exclusively. Manual testing is outdated because of low speed and possible test setup inconsistencies
- DIt is an option but it tends to be very expensive
27Which of the following is a design pattern based on distinct pieces of software providing application functionality as services to other applications?
- AService Oriented Architecture
- BObject Oriented Architecture
- CLean Coding
- DAgile Process
28Which of the following is a common Service Oriented Architecture (SOA) vulnerability?
- ACross-site scripting
- BSQL injection
- CVPath injection
- DXML denial of service issues
29Websites and web portals that provide web services commonly use the Simple Object Access Protocol (SOAP). Which of the following is an incorrect definition or characteristics of the protocol?
- ABased on XML
- BProvides a structured model for messaging
- CExchanges data between web services
- DOnly compatible with the application protocol HTTP
30SOAP services use which technology to format information?
- ASATA
- BPCI
- CXML
- DISDN
31A software tester is randomly generating invalid inputs in an attempt to crash the program. Which of the following is a software testing technique used to determine if a software program properly handles a wide range of invalid input?
- AMutating
- BRandomizing
- CFuzzing
- DBounding
32Which of the following is an adaptive SQL injection testing technique used to discover coding errors by inputting massive amounts of random data and observing the changes in the output?
- ADynamic Testing
- BFunction Testing
- CFuzzing Testing
- DStatic Testing
33Sid is a judge for a programming contest. Before the code reaches him it goes through a restricted OS and is tested there. If it passes, then it moves onto Sid. What is this middle step called?
- AThird party running the code
- BFuzzy-testing the code
- CString validating the code
- DSandboxing the code
34Which of the following is a restriction being enforced in “white box testing?”
- AOnly the internal operation of a system is known to the tester
- BThe internal operation of a system is completely known to the tester
- CThe internal operation of a system is only partly accessible to the tester
- DOnly the external operation of a system is accessible to the tester
35The “gray box testing” methodology enforces what kind of restriction?
- AThe internal operation of a system is only partly accessible to the tester.
- BThe internal operation of a system is completely known to the tester.
- COnly the external operation of a system is accessible to the tester.
- DOnly the internal operation of a system is known to the tester.
36The “black box testing” methodology enforces what kind of restriction?
- AThe internal operation of a system is only partly accessible to the tester.
- BThe internal operation of a system is completely known to the tester.
- COnly the external operation of a system is accessible to the tester.
- DOnly the internal operation of a system is known to the tester.
37A penetration tester is hired to do a risk assessment of a company’s DMZ. The rules of engagement states that the penetration test be done from an external IP address with no prior knowledge of the internal IT systems.
What kind of test is being performed?- Awhite box
- Bgrey box
- Cblack box
- Dred box
38What type of analysis is performed when an attacker has partial knowledge of inner-workings of the application?
- ABlack-box
- BAnnounced
- CGrey-box
- DWhite-box
39Seth is starting a penetration test from inside the network. He hasn’t been given any information about the network. What type of test is he conducting?
- AInternal, Whitebox
- BInternal, Blackbox
- CExternal, Whitebox
- DExternal, Blackbox
40Risks = Threats x Vulnerabilities is referred to as the:
- ARisk equation
- BThreat assessment
- CBIA equation
- DDisaster recovery formula
41In Risk Management, how is the term “likelihood” related to the concept of “threat?”
- ALikelihood is the probability that a threat-source will exploit a vulnerability.
- BLikelihood is a possible threat-source that may exploit a vulnerability.
- CLikelihood is the likely source of a threat that could exploit a vulnerability
- DLikelihood is the probability that a vulnerability is a threat-source.
42What kind of risk will remain even if all theoretically possible safety measures would be applied?
- AResidual risk
- BInherent risk
- CImpact risk
- DDeferred risk
43If the final set of security controls does not eliminate all risk in a system, what could be done next?
- AContinue to apply controls until there is zero risk.
- BIgnore any remaining risk.
- CIf the residual risk is low enough, it can be accepted.
- DRemove current controls since they are not completely effective.
Information
- Description
- Quiz on CEH 3, created by L V on 21/06/2019.
- Author
- L V
- Language
- English
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz