CEH v10 EXAM | Questions And Answers Latest {2024- 2025} A+ Graded | 100% Verified
OSI Reference Model - Open System Interconnection Reference Model
Divides network communications into 7 distinct layers and conceptually describes how each layer is
used. Divides protocols among layers as well.
Please Do Not Throw Sausage Pizza Away
1) Physical
2) Data Link
3) Network
4) Transport
5) Session
6) Presentation
7) Application
Slide 1-55
TCP/IP - A set of communications protocols that allows hosts on a network to talk to one another
DMZ - Demilitarized Zone: A controlled buffer network between you and the uncontrolled chaos of the
network.
Production Network Zone - A restricted zone that strictly controls direct access from uncontrolled zones.
The PNZ does not hold users.
Intranet Zone - A controlled zone that has little to no heavy restrictions.
Management Network Zone - An area you'd generally find with VLANs and maybe controlled via IPSec.
,Resources for Vulnerabilities - Microsoft Vulnerability Research: technet.microsoft.com
Security Focus: www.securityfocus.com
Hackerstorm: www.hackerstorm.co.uk
Exploit Database: www.exploit-db.com
Security Magazine: www.securitymagazine.com
Trend Micro: www.trendmicro.com
Dark Reading: www.darkreading.com
Vulnerability Categories - Misconfigurations
Default Installations
Buffer Overflows
Unpatched systems
Design Flaws
OS Flaws
App Flaws
Open Services
Default Passwords
Security, Functionality and Usability Triangle -
Hack Value - It is the notion among hackers that something is worth doing or is interesting
vulnerability - A flaw or weakness that allows a threat agent to bypass security.
zero day - An attacker used an undocumented and unknown application exploit to gain access
Payload -
Daisy Chaining -
, Bots -
Doxing -
IRT - Incident Response Team. A group of experts that respond to security incidents. Also known as
CERT, CIRT, or SIRT.
Incident Management - the process responsible for managing how incidents are identified and corrected
Risk Analysis Matrix - A quadrant used to map the likelihood of a risk occurring against the
consequences (or impact) that risk would have.
preventive
Corrective
Detective -
BIA - Business impact analysis: The BIA identifies critical business or mission requirements and includes
elements such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs), but it doesn't
identify solutions.
MTD - Maximum Tolerable Downtime--The total time a system can be inoperable before and
organization is severely impacted.
BCP - Business continuity plan. A plan that helps an organization predict and plan for potential outages
of critical services or functions. It includes disaster recovery elements that provide the steps used to
return critical functions to operation after an outage. A BIA is a part of a BCP and the BIA drives
decisions to create redundancies such as failover clusters or alternate sites.
DRP - Disaster recovery plan. A document designed to help a company respond to disasters, such as
hurricanes, floods, and fires. It includes a hierarchical list of critical systems and often prioritizes services
to restore after an outage. Testing validates the plan. Recovered systems are tested before returning
OSI Reference Model - Open System Interconnection Reference Model
Divides network communications into 7 distinct layers and conceptually describes how each layer is
used. Divides protocols among layers as well.
Please Do Not Throw Sausage Pizza Away
1) Physical
2) Data Link
3) Network
4) Transport
5) Session
6) Presentation
7) Application
Slide 1-55
TCP/IP - A set of communications protocols that allows hosts on a network to talk to one another
DMZ - Demilitarized Zone: A controlled buffer network between you and the uncontrolled chaos of the
network.
Production Network Zone - A restricted zone that strictly controls direct access from uncontrolled zones.
The PNZ does not hold users.
Intranet Zone - A controlled zone that has little to no heavy restrictions.
Management Network Zone - An area you'd generally find with VLANs and maybe controlled via IPSec.
,Resources for Vulnerabilities - Microsoft Vulnerability Research: technet.microsoft.com
Security Focus: www.securityfocus.com
Hackerstorm: www.hackerstorm.co.uk
Exploit Database: www.exploit-db.com
Security Magazine: www.securitymagazine.com
Trend Micro: www.trendmicro.com
Dark Reading: www.darkreading.com
Vulnerability Categories - Misconfigurations
Default Installations
Buffer Overflows
Unpatched systems
Design Flaws
OS Flaws
App Flaws
Open Services
Default Passwords
Security, Functionality and Usability Triangle -
Hack Value - It is the notion among hackers that something is worth doing or is interesting
vulnerability - A flaw or weakness that allows a threat agent to bypass security.
zero day - An attacker used an undocumented and unknown application exploit to gain access
Payload -
Daisy Chaining -
, Bots -
Doxing -
IRT - Incident Response Team. A group of experts that respond to security incidents. Also known as
CERT, CIRT, or SIRT.
Incident Management - the process responsible for managing how incidents are identified and corrected
Risk Analysis Matrix - A quadrant used to map the likelihood of a risk occurring against the
consequences (or impact) that risk would have.
preventive
Corrective
Detective -
BIA - Business impact analysis: The BIA identifies critical business or mission requirements and includes
elements such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs), but it doesn't
identify solutions.
MTD - Maximum Tolerable Downtime--The total time a system can be inoperable before and
organization is severely impacted.
BCP - Business continuity plan. A plan that helps an organization predict and plan for potential outages
of critical services or functions. It includes disaster recovery elements that provide the steps used to
return critical functions to operation after an outage. A BIA is a part of a BCP and the BIA drives
decisions to create redundancies such as failover clusters or alternate sites.
DRP - Disaster recovery plan. A document designed to help a company respond to disasters, such as
hurricanes, floods, and fires. It includes a hierarchical list of critical systems and often prioritizes services
to restore after an outage. Testing validates the plan. Recovered systems are tested before returning
