eJPT Network Protocols and Traffic Analysis 2

Question 1

Which port is used by default for the SMB protocol?

Accepted Answer

139/445

Answer

SMB (Server Message Block) uses ports 139 and 445 for file sharing and Windows network services.

Question 2

What tool is commonly used to capture network packets on a Linux system from the command line?

Accepted Answer

tcpdump

Answer

tcpdump is a command-line packet analyzer used on Linux to capture and display network traffic.

Question 3

Which protocol does DNS use by default for standard queries on port 53?

Accepted Answer

UDP

Answer

DNS uses UDP on port 53 for standard queries because it is faster and lower overhead for small request/response packets.

Question 4

In Wireshark, what does the 'follow TCP stream' feature allow an analyst to do?

Accepted Answer

Reassemble and view the full conversation between two hosts

Answer

Follow TCP stream reassembles all packets in a TCP session, displaying the full readable conversation between two endpoints.

Question 5

Which network layer is responsible for breaking data into frames and MAC addressing?

Accepted Answer

Data Link Layer (Layer 2)

Answer

The Data Link Layer (Layer 2) handles framing data for transmission and uses MAC addresses for local network delivery.

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test