eJPT - eLearnSecurity Junior Penetration Tester Vulnerability Assessment Questions and Answers — Questions and Answers
Question 1: A penetration tester is conducting a vulnerability assessment and wants to simulate the perspective of an external attacker with no prior knowledge of the internal network. Which type of scan would be MOST appropriate for this objective?
- Authenticated scan
- Unauthenticated scan (Correct answer)
- Passive scan
- Credentialed scan
Correct answer: Unauthenticated scan
An unauthenticated scan is performed without any special credentials or privileges. It mimics how an external attacker would see the system, identifying vulnerabilities that are exposed to the public internet without any login access.
Question 2: During a vulnerability assessment, a junior penetration tester uses a tool that actively sends specially crafted packets to target systems to elicit responses and identify potential weaknesses. This method, however, risks disrupting network operations. Which vulnerability scanning technique is being used?
- Passive scanning
- Credentialed scanning
- Active scanning (Correct answer)
- Compliance scanning
Correct answer: Active scanning
Active scanning involves directly interacting with target systems by sending probes, packets, and queries to gather information and identify vulnerabilities. This direct interaction makes it more thorough but also carries a risk of impacting the performance or stability of the targeted network or services.
Question 3: Which of the following is the PRIMARY purpose of the Common Vulnerability Scoring System (CVSS)?
- To provide a unique identifier for each vulnerability discovered.
- To offer a standardized framework for rating the severity of vulnerabilities. (Correct answer)
- To automatically patch and remediate identified system weaknesses.
- To catalog exploits and proof-of-concept code for vulnerabilities.
Correct answer: To offer a standardized framework for rating the severity of vulnerabilities.
The primary purpose of CVSS is to provide a standardized, open framework for communicating the characteristics and severity of software vulnerabilities. It assigns a numerical score from 0-10 to help organizations prioritize their response and remediation efforts.
Question 4: A penetration tester needs to perform a vulnerability scan that provides the most comprehensive and accurate view of a system's security posture by looking at its configuration, patch levels, and installed software from an 'insider' perspective. Which scanning method should be chosen?
- Passive scan
- Unauthenticated scan
- Black-box scan
- Authenticated scan (Correct answer)
Correct answer: Authenticated scan
An authenticated (or credentialed) scan uses valid user credentials to log into the target system. This allows the scanner to access the file system, configuration settings, and installed software list, providing a much more detailed and accurate report on vulnerabilities like missing patches and misconfigurations that are not visible externally.
Question 5: While Nmap is primarily known as a network port scanner, its capabilities can be extended to perform vulnerability assessments using which of its features?
- The Nmap Version Detection Engine (-sV)
- The Nmap Scripting Engine (NSE) (Correct answer)
- The Nmap OS Detection Engine (-O)
- The Nmap Timing Templates (-T)
Correct answer: The Nmap Scripting Engine (NSE)
The Nmap Scripting Engine (NSE) allows users to write and use scripts to automate a wide variety of networking tasks. A specific category of these scripts, often invoked with '--script vuln', is designed to check for known vulnerabilities on the target services.
Question 6: A security analyst is comparing vulnerability assessment tools. One tool, Nessus, is primarily known as a dedicated vulnerability scanner. Another tool, Nmap, is primarily a network discovery and port scanner. What is a key advantage of using a dedicated scanner like Nessus over Nmap for vulnerability assessment?
- Nessus is open-source, whereas Nmap is a commercial product.
- Nessus provides more comprehensive and detailed vulnerability reports with remediation suggestions. (Correct answer)
- Nmap is incapable of identifying service versions on open ports.
- Nessus scans are always passive and never impact network performance.
Correct answer: Nessus provides more comprehensive and detailed vulnerability reports with remediation suggestions.
While Nmap's NSE can find some vulnerabilities, dedicated scanners like Nessus are built specifically for this purpose. They have extensive, regularly updated vulnerability databases (plugins) and provide detailed reports that include risk scores, evidence of the vulnerability, and actionable remediation advice, which is a key differentiator from Nmap's primary function.
eJPT - eLearnSecurity Junior Penetration Tester Vulnerability Assessment Questions and Answers
A penetration tester is conducting a vulnerability assessment and wants to simulate the perspective of an external attacker with no prior knowledge of the internal network.
Which type of scan would be MOST appropriate for this objective?