eJPT Network Protocols and Traffic Analysis 3

Question 1

Which command displays active network connections and listening ports on a Windows or Linux system?

Accepted Answer

netstat -an

Answer

ipconfig

Answer

arp -a

Answer

route print

Question 2

What is the purpose of a subnet mask in networking?

Accepted Answer

Identify the network and host portions of an IP address

Answer

Encrypt data in transit

Answer

Assign MAC addresses

Answer

Route packets between networks

Question 3

During traffic analysis, what does a large number of SYN packets without corresponding SYN-ACK responses typically indicate?

Accepted Answer

A SYN flood denial-of-service attack

Answer

Normal web browsing

Answer

FTP file transfers

Answer

Successful SSL handshakes

Question 4

Which protocol is responsible for translating domain names to IP addresses?

Accepted Answer

DNS

Answer

FTP

Answer

DHCP

Answer

NTP

Question 5

What is the default port for the HTTPS protocol?

Accepted Answer

443

Answer

80

Answer

8080

Answer

8443

Question 6

When capturing traffic on an eJPT lab, which interface would typically be used to monitor traffic between the attacker and a target on the same subnet?

Accepted Answer

eth0 or the LAN-facing interface

Answer

lo (loopback)

Answer

tun0 (VPN tunnel only)

Answer

docker0