Network Security & Vulnerability Flashcards
7 cards from real EJPT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Network Security & Vulnerability flashcards as text
Which port and protocol does DNS primarily use for standard queries?
Answer: UDP 53
DNS uses UDP on port 53 for standard queries because it is faster; TCP 53 is used for zone transfers and responses exceeding 512 bytes.
What is a 'zombie scan' (also called an idle scan) used for in Nmap?
Answer: Using a third-party idle host's IP ID sequence to perform a port scan while hiding the scanner's true IP
An idle scan (-sI) exploits a 'zombie' host with predictable IP ID increments to infer port states on the target, making the scan appear to originate from the zombie host.
During a black-box engagement, a tester discovers port 161/UDP is open. Which service is most likely running?
Answer: SNMP
UDP port 161 is the standard port for SNMP (Simple Network Management Protocol), which can expose device configuration and network topology if community strings are weak.
Which type of firewall inspects packet headers only and makes filtering decisions based on source/destination IP and port?
Answer: Packet filtering firewall
A packet filtering firewall operates at Layers 3 and 4, making allow/deny decisions based solely on IP addresses, ports, and protocol without tracking connection state.
A penetration tester uses `hydra -l admin -P rockyou.txt ssh://192.168.1.5`. What is this command doing?
Answer: Brute-forcing SSH login for the 'admin' user using the rockyou.txt wordlist
This Hydra command attempts to authenticate to SSH on 192.168.1.5 as 'admin', cycling through every password in the rockyou.txt wordlist — a dictionary brute-force attack.
What does the term 'pivot' mean in penetration testing?
Answer: Using a compromised host as a relay to attack systems on otherwise unreachable network segments
Pivoting involves using a compromised machine as a proxy or tunnel to reach internal network segments that would otherwise be inaccessible from the attacker's position.
Which vulnerability allows an attacker to read files outside the web root by manipulating file path parameters with sequences like '../../../etc/passwd'?
Answer: Directory Traversal (Path Traversal)
Directory traversal (path traversal) exploits insufficient input validation on file path parameters, allowing attackers to use `../` sequences to escape the web root and read arbitrary files.