CVA Vulnerability Assessment Tools & Techniques 2 — Questions and Answers
Question 1: Which Nmap scan type sends a SYN packet and waits for a SYN-ACK without completing the three-way handshake?
- UDP scan (-sU)
- SYN stealth scan (-sS) (Correct answer)
- Connect scan (-sT)
- NULL scan (-sN)
Correct answer: SYN stealth scan (-sS)
SYN stealth scan (-sS) sends a SYN packet and tears down the connection after receiving SYN-ACK, leaving no completed TCP session in logs.
Question 2: What is the primary purpose of the Metasploit Framework's 'auxiliary' modules?
- Delivering shellcode payloads
- Exploiting remote vulnerabilities
- Scanning, fuzzing, and information gathering without exploitation (Correct answer)
- Generating post-exploitation reports
Correct answer: Scanning, fuzzing, and information gathering without exploitation
Auxiliary modules perform support tasks such as scanning, fuzzing, sniffing, and banner grabbing without launching an exploit against a target.
Question 3: A vulnerability assessor needs to identify open ports on a target that blocks ICMP. Which Nmap technique is MOST appropriate?
- Ping sweep (-sn)
- OS detection (-O)
- TCP SYN scan with ICMP disabled (-Pn) (Correct answer)
- Version detection (-sV)
Correct answer: TCP SYN scan with ICMP disabled (-Pn)
Using -Pn tells Nmap to skip host discovery and scan ports directly, bypassing ICMP-blocking firewalls.
Question 4: Which tool is specifically designed to identify web application vulnerabilities such as SQL injection and XSS through automated crawling?
- Wireshark
- Nikto (Correct answer)
- Tcpdump
- Netcat
Correct answer: Nikto
Nikto is an open-source web server scanner that tests for dangerous files, misconfigurations, and common web vulnerabilities including SQL injection and XSS.
Question 5: In the context of vulnerability scanning, what does a 'false positive' result mean?
- A vulnerability exists but the scanner missed it
- The scanner reports a vulnerability that does not actually exist (Correct answer)
- A critical vulnerability is reported with low severity
- A scan completes without detecting any vulnerabilities
Correct answer: The scanner reports a vulnerability that does not actually exist
A false positive occurs when a scanner flags a condition as a vulnerability when the system is not actually vulnerable, requiring manual verification.
Question 6: Which OWASP tool is used for intercepting and modifying HTTP/HTTPS traffic between a browser and web application?
- OpenVAS
- OWASP ZAP (Correct answer)
- Nessus
- Burp Suite Community
Correct answer: OWASP ZAP
OWASP ZAP (Zed Attack Proxy) acts as a man-in-the-middle proxy to intercept, inspect, and modify web traffic for security testing.
Question 7: What is 'credentialed scanning' and why is it preferred in vulnerability assessments?
- Scanning only systems for which written permission is obtained
- Providing the scanner with login credentials to perform deeper internal checks (Correct answer)
- Using encrypted channels to transmit scan results
- Scanning from an authenticated network segment only
Correct answer: Providing the scanner with login credentials to perform deeper internal checks
Credentialed scanning provides the scanner with valid credentials so it can log into systems and audit installed software, patches, and configurations from the inside.
CVA Vulnerability Assessment Tools & Techniques 2
Which Nmap scan type sends a SYN packet and waits for a SYN-ACK without completing the three-way handshake?