eJPT Network Protocols and Traffic Analysis 2

Question 1

Which port is used by default for the SMB protocol?

Accepted Answer

139/445

Answer

23

Answer

3389

Answer

22

Question 2

What tool is commonly used to capture network packets on a Linux system from the command line?

Accepted Answer

tcpdump

Answer

nmap

Answer

netstat

Answer

netcat

Question 3

Which protocol does DNS use by default for standard queries on port 53?

Accepted Answer

UDP

Answer

TCP

Answer

ICMP

Answer

SCTP

Question 4

In Wireshark, what does the 'follow TCP stream' feature allow an analyst to do?

Accepted Answer

Reassemble and view the full conversation between two hosts

Answer

Reset a TCP connection

Answer

Filter only SYN packets

Answer

Inject packets into the stream

Question 5

Which network layer is responsible for breaking data into frames and MAC addressing?

Accepted Answer

Data Link Layer (Layer 2)

Answer

Network Layer (Layer 3)

Answer

Transport Layer (Layer 4)

Answer

Physical Layer (Layer 1)

Question 6

What type of attack involves poisoning ARP tables to redirect traffic through an attacker's machine?

Accepted Answer

ARP Poisoning / Man-in-the-Middle

Answer

DNS Spoofing

Answer

SYN Flood

Answer

Replay Attack