eJPT Network Protocols and Traffic Analysis 2 — Questions and Answers
Question 1: Which port is used by default for the SMB protocol?
- 23
- 139/445 (Correct answer)
- 3389
- 22
Correct answer: 139/445
SMB (Server Message Block) uses ports 139 and 445 for file sharing and Windows network services.
Question 2: What tool is commonly used to capture network packets on a Linux system from the command line?
- nmap
- netstat
- tcpdump (Correct answer)
- netcat
Correct answer: tcpdump
tcpdump is a command-line packet analyzer used on Linux to capture and display network traffic.
Question 3: Which protocol does DNS use by default for standard queries on port 53?
- TCP
- UDP (Correct answer)
- ICMP
- SCTP
Correct answer: UDP
DNS uses UDP on port 53 for standard queries because it is faster and lower overhead for small request/response packets.
Question 4: In Wireshark, what does the 'follow TCP stream' feature allow an analyst to do?
- Reset a TCP connection
- Reassemble and view the full conversation between two hosts (Correct answer)
- Filter only SYN packets
- Inject packets into the stream
Correct answer: Reassemble and view the full conversation between two hosts
Follow TCP stream reassembles all packets in a TCP session, displaying the full readable conversation between two endpoints.
Question 5: Which network layer is responsible for breaking data into frames and MAC addressing?
- Network Layer (Layer 3)
- Transport Layer (Layer 4)
- Data Link Layer (Layer 2) (Correct answer)
- Physical Layer (Layer 1)
Correct answer: Data Link Layer (Layer 2)
The Data Link Layer (Layer 2) handles framing data for transmission and uses MAC addresses for local network delivery.
Question 6: What type of attack involves poisoning ARP tables to redirect traffic through an attacker's machine?
- DNS Spoofing
- ARP Poisoning / Man-in-the-Middle (Correct answer)
- SYN Flood
- Replay Attack
Correct answer: ARP Poisoning / Man-in-the-Middle
ARP poisoning sends forged ARP replies to corrupt the ARP cache of hosts, enabling man-in-the-middle traffic interception.
eJPT Network Protocols and Traffic Analysis 2
Which port is used by default for the SMB protocol?