eJPTv2 Certification Exam — Questions and Answers

Question 1: What is the primary purpose of a PTR (pointer) DNS record?

Map domain to mail server
Map domain to IPv4
Map IP address to domain name (reverse DNS) (Correct answer)
Define authoritative name servers

Correct answer: Map IP address to domain name (reverse DNS)

PTR records perform reverse DNS lookups, mapping an IP address back to a hostname.

Question 2: What is the primary purpose of pivoting in a post-exploitation scenario?

Escalating privileges on the current host
Dumping credentials from memory
Establishing persistence via a backdoor
Using a compromised host to attack other internal network segments (Correct answer)

Correct answer: Using a compromised host to attack other internal network segments

Pivoting uses a compromised machine as a relay to reach and attack otherwise inaccessible internal network segments.

Question 3: Which Burp Suite feature is best suited for discovering hidden parameters and values through automated fuzzing?

Burp Intruder (Correct answer)
Burp Decoder
Burp Scanner
Burp Comparer

Correct answer: Burp Intruder

Burp Intruder automates customizable attack patterns against HTTP requests, making it ideal for fuzzing parameter values, discovering injection points, and brute-forcing inputs.

Question 4: When testing for Local File Inclusion (LFI), which file on a Linux system is most commonly targeted to verify the vulnerability?

/etc/passwd (Correct answer)
/proc/self/environ
/var/log/auth.log
/etc/shadow

Correct answer: /etc/passwd

/etc/passwd is world-readable on Linux and its distinctive format makes it an ideal proof-of-concept target when confirming LFI vulnerabilities.

Question 5: What is the purpose of the `-A` flag in Nmap?

Perform ARP scanning on local network
Scan all ports from 1-65535
Enable aggressive mode: OS detection, version detection, scripts, and traceroute (Correct answer)
Use ACK probes only

Correct answer: Enable aggressive mode: OS detection, version detection, scripts, and traceroute

Nmap's `-A` flag enables aggressive scanning including OS detection (`-O`), version detection (`-sV`), script scanning (`-sC`), and traceroute.

Question 6: Which type of firewall inspects packet headers only and makes filtering decisions based on source/destination IP and port?

Application-layer firewall (WAF)
Stateful inspection firewall
Packet filtering firewall (Correct answer)
Next-generation firewall (NGFW)

Correct answer: Packet filtering firewall

A packet filtering firewall operates at Layers 3 and 4, making allow/deny decisions based solely on IP addresses, ports, and protocol without tracking connection state.

Question 7: Which vulnerability class does SQL injection primarily exploit?

Weak cryptographic implementations
Improper memory management
Misconfigured file permissions
Insufficient input validation allowing manipulation of database queries (Correct answer)

Correct answer: Insufficient input validation allowing manipulation of database queries

SQL injection occurs when user-supplied input is not properly sanitized and gets interpreted as SQL code, allowing attackers to manipulate database queries.

Question 8: Which Meterpreter command allows you to search for files on the target system?

dir
ls
find
search (Correct answer)

Correct answer: search

The `search` command in Meterpreter lets you search for files by name or pattern across the target filesystem, useful for finding sensitive data.

Question 9: In a penetration test report, what does a 'proof of concept' (PoC) typically include?

A list of all tools installed on the tester's machine
The client's network diagram
A business case for why the client should hire more testers
Screenshots, commands, or code that demonstrates the vulnerability is exploitable (Correct answer)

Correct answer: Screenshots, commands, or code that demonstrates the vulnerability is exploitable

A PoC provides reproducible evidence — such as screenshots, tool output, or exploit code — proving that a vulnerability is real and exploitable.

Question 10: Which documentation is essential when working with social engineering techniques in eJPT?

Only verbal notes
Detailed technical specifications and as-built diagrams (Correct answer)
General descriptions without specifics
Marketing materials

Correct answer: Detailed technical specifications and as-built diagrams

Detailed technical specifications and as-built diagrams provide the accurate reference information needed for maintenance and troubleshooting.

Question 11: Which Nmap scan type sends only SYN packets and never completes the TCP handshake, making it stealthier?

-sT (TCP Connect)
-sU (UDP)
-sS (SYN Stealth) (Correct answer)
-sA (ACK)

Correct answer: -sS (SYN Stealth)

The SYN scan (`-sS`) sends a SYN packet and, upon receiving SYN-ACK, sends RST without completing the 3-way handshake, leaving fewer logs.

Question 12: Which of the following is a key indicator that a phone call may be a vishing attack?

The caller asks to be transferred to another department
The caller speaks in a professional tone
The caller provides their full name and employee ID upfront
The caller requests sensitive information (passwords, OTPs) over the phone, claiming urgent action is needed (Correct answer)

Correct answer: The caller requests sensitive information (passwords, OTPs) over the phone, claiming urgent action is needed

Legitimate organizations never ask for passwords or one-time codes over the phone; such requests combined with urgency are hallmarks of vishing.

Question 13: Which professional attribute is most valued in attacks and exploits within the eJPT field?

Working in isolation
Avoiding challenging situations
Prioritizing personal convenience
Accountability and commitment to standards (Correct answer)

Correct answer: Accountability and commitment to standards

Accountability and commitment to professional standards build trust and ensure consistent, high-quality practice.

Question 14: What is the purpose of HTTP Secure (HTTPS) in web applications?

To improve the user interface.
To store sensitive data securely.
To increase the server's processing power.
To encrypt data transmitted between client and server. (Correct answer)

Correct answer: To encrypt data transmitted between client and server.

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, using SSL/TLS encryption to establish a secure connection between a web browser (client) and a web server. Its primary purpose is to encrypt all data exchanged, protecting it from eavesdropping, tampering, and forgery during transmission. This ensures the confidentiality and integrity of sensitive information like login credentials and financial data.

Question 15: What is 'scope creep' in a penetration testing engagement?

When the tester finds more vulnerabilities than initially expected
When the client requests additional reporting after the engagement
When automated tools scan faster than planned
When testing activities expand beyond the originally agreed-upon boundaries without formal authorization (Correct answer)

Correct answer: When testing activities expand beyond the originally agreed-upon boundaries without formal authorization

Scope creep occurs when the testing expands beyond agreed boundaries, which requires a formal change order or addendum to the contract.

Question 16: A tester uses `theHarvester` against a target domain. What type of information does this tool collect?

Email addresses, subdomains, and employee names from public sources (Correct answer)
Open ports and services
Password hashes from databases
Network packet captures

Correct answer: Email addresses, subdomains, and employee names from public sources

theHarvester gathers emails, subdomains, hosts, and employee names from search engines, LinkedIn, and other public sources.

Question 17: Which command in msfconsole sets a module option value?

options
set (Correct answer)
configure
define

Correct answer: set

The 'set' command assigns a value to a module option (e.g., 'set RHOSTS 192.168.1.1') within msfconsole.

Question 18: What is a common method used to test for SQL injection vulnerabilities in web applications?

Performing a system reboot.
Using brute force to break passwords.
Scanning for vulnerabilities in the source code.
Inserting SQL commands like single quote (') in input fields. (Correct answer)

Correct answer: Inserting SQL commands like single quote (') in input fields.

A common and basic method to test for SQL injection vulnerabilities is to insert special SQL characters, such as a single quote ('), into input fields. If the application is vulnerable, this character can break the intended SQL query, causing a database error or unexpected behavior. This indicates that user input is not being properly sanitized before being passed to the database.

Question 19: What is a scheduled task in Windows and how can it be abused for persistence?

An automated job that can be configured to run malicious executables at set times or events (Correct answer)
A Windows feature that caches credentials, abused via memory scraping
A firewall rule, abused by adding exceptions for reverse shells
A process that runs in real-time, abused by injecting DLLs

Correct answer: An automated job that can be configured to run malicious executables at set times or events

Windows scheduled tasks (via `schtasks`) can be created or modified by attackers to execute malware at boot, login, or regular intervals for persistence.

Question 20: An attacker captures traffic and sees ARP replies associating the gateway IP with the attacker's MAC address. What attack is occurring?

ARP poisoning (Correct answer)
ICMP redirect attack
BGP hijacking
DNS spoofing

Correct answer: ARP poisoning

ARP poisoning (ARP spoofing) involves sending unsolicited ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle interception.

Question 21: What is the NTDS.dit file and why is it targeted in post-exploitation?

A file storing browser saved passwords
The Windows event log database
The Active Directory database containing all domain user hashes (Correct answer)
A Windows firewall configuration file

Correct answer: The Active Directory database containing all domain user hashes

NTDS.dit is the Active Directory database on a Domain Controller that contains password hashes for all domain accounts, making it a high-value target.

Question 22: What is the PRIMARY purpose of obtaining eJPT certification in eLearnSecurity Junior Penetration Tester Certification?

To guarantee employment in the field
To bypass educational requirements
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 23: A web application is vulnerable to XML External Entity (XXE) injection. Which of the following is a direct consequence?

Attackers can inject JavaScript into XML responses
Attackers can read arbitrary files on the server or perform SSRF (Correct answer)
Attackers can overwrite the server's XML configuration files
Attackers can steal CSRF tokens from other users

Correct answer: Attackers can read arbitrary files on the server or perform SSRF

XXE allows attackers to define external entities in XML that reference local file paths or internal URLs, enabling file disclosure and server-side request forgery.

Question 24: What is the purpose of active listening in eJPT professional interactions?

To fully understand the speaker's message and respond appropriately (Correct answer)
To memorize every word
To wait for your turn to speak
To appear polite

Correct answer: To fully understand the speaker's message and respond appropriately

Active listening involves fully concentrating on the speaker's message to understand it completely before formulating an appropriate response.

Question 25: What is 'living off the land' in the context of post-exploitation?

Using built-in OS tools and features to avoid dropping new malware (Correct answer)
Staying persistent on a target for a long period
Exploiting agricultural sector targets
Exploiting local network services only

Correct answer: Using built-in OS tools and features to avoid dropping new malware

Living off the land means using legitimate, pre-installed OS utilities (like PowerShell, certutil, wmic) for malicious purposes to blend in and avoid detection.

Question 26: Which of the following is an example of an Insecure Direct Object Reference (IDOR) vulnerability?

Uploading a PHP shell disguised as an image
Accessing another user's invoice by changing the ID in the URL from 101 to 102 (Correct answer)
A login page that doesn't lock out after failed attempts
Injecting SQL into a search field to dump the database

Correct answer: Accessing another user's invoice by changing the ID in the URL from 101 to 102

IDOR occurs when an application exposes internal object references (like database IDs) in URLs without verifying that the requesting user is authorized to access the referenced object.

Question 27: Which port and protocol does DNS primarily use for standard queries?

TCP 53
UDP 53 (Correct answer)
UDP 443
TCP 853

Correct answer: UDP 53

DNS uses UDP on port 53 for standard queries because it is faster; TCP 53 is used for zone transfers and responses exceeding 512 bytes.

Question 28: What is a vulnerability scanner's primary function?

To block network traffic.
To identify and assess security weaknesses. (Correct answer)
To test system performance.
To monitor web traffic.

Correct answer: To identify and assess security weaknesses.

A vulnerability scanner's core function is to systematically scan systems, networks, and applications to detect known security flaws and misconfigurations. It provides an automated way to identify potential entry points for attackers by comparing system characteristics against a database of known vulnerabilities. This assessment helps organizations understand their security posture and prioritize remediation efforts.

Question 29: When using msfvenom, what flag specifies the output format of the generated payload?

-p
-o
-f (Correct answer)
-e

Correct answer: -f

The `-f` flag in msfvenom specifies the output format (e.g., exe, elf, raw, python, powershell) for the generated payload.

Question 30: Which statement BEST describes the relationship between eLearnSecurity Junior Penetration Tester Certification certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Certification requirements never change once established
Changes only occur when government mandates new requirements
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 31: What is the key difference between reflected XSS and stored XSS from an impact perspective?

Reflected XSS is server-side; stored XSS is client-side
Stored XSS only works on authenticated users
Stored XSS can attack multiple users automatically; reflected XSS requires tricking individual users into clicking a link (Correct answer)
Reflected XSS persists in the database; stored XSS does not

Correct answer: Stored XSS can attack multiple users automatically; reflected XSS requires tricking individual users into clicking a link

Stored XSS is more dangerous at scale because every user who visits the infected page is attacked automatically, whereas reflected XSS requires delivering a crafted link to each victim.

Question 32: Which of the following best describes a 'reverse social engineering' attack?

The attacker uses automated tools to reverse-engineer the victim's password
The target hacks back at the attacker using their own techniques
The attacker creates a problem, then poses as the solution provider to gain the target's trust (Correct answer)
The attacker pretends to be a victim to gain sympathy

Correct answer: The attacker creates a problem, then poses as the solution provider to gain the target's trust

In reverse social engineering, the attacker creates or exploits a problem and then presents themselves as the expert who can solve it, gaining trust and access.

Question 33: What is the purpose of including a 'remediation' or 'recommendation' section in a penetration test report?

To increase the page count and justify the project cost
To list alternative testing tools the client should purchase
To document the tester's methodology for future reference
To provide actionable steps the client can take to fix identified vulnerabilities (Correct answer)

Correct answer: To provide actionable steps the client can take to fix identified vulnerabilities

Remediation recommendations give the client a clear path to fixing vulnerabilities, turning the report from a problem list into an actionable security improvement plan.

Question 34: Which of the following best describes 'remediation verification' in the context of penetration testing?

The process of verifying the tester's credentials before the engagement begins
Running automated scans immediately after the initial report is written
A follow-up assessment to confirm that reported vulnerabilities have been successfully fixed (Correct answer)
Checking that the client paid the invoice before delivering the report

Correct answer: A follow-up assessment to confirm that reported vulnerabilities have been successfully fixed

Remediation verification (also called retesting) confirms that the client's fixes actually close the vulnerabilities identified in the original penetration test.

Question 35: Which scan type in Nmap is used specifically to scan UDP ports?

-sS
-sT
-sN
-sU (Correct answer)

Correct answer: -sU

The -sU flag tells Nmap to perform a UDP scan, which is important for discovering services like DNS, SNMP, and DHCP that run over UDP.

Question 36: What is 'elicitation' in social engineering?

Using software to extract password hashes from memory
Extracting sensitive information through seemingly casual conversation without the target realizing they're being manipulated (Correct answer)
Intercepting VoIP calls to capture credentials
Sending forged documents to trigger an automated response

Correct answer: Extracting sensitive information through seemingly casual conversation without the target realizing they're being manipulated

Elicitation uses natural conversation techniques (flattery, false statements, volunteering information) to make targets reveal sensitive data without suspicion.

eJPTv2 Certification Exam

The eJPTv2 certification validates foundational penetration testing skills, including reconnaissance, vulnerability assessment, exploitation, and post-exploitation techniques.

Questions

48 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds