eJPT Host and Network Auditing 4 — Questions and Answers
Question 1: What does ARP scanning reveal during a network audit that ICMP ping sweeps may miss?
- Hosts that block ICMP but respond to ARP requests on the local subnet (Correct answer)
- Services running on remote hosts
- Open TCP ports on discovered hosts
- Encrypted traffic between hosts
Correct answer: Hosts that block ICMP but respond to ARP requests on the local subnet
ARP works at Layer 2 and always gets responses from live hosts on the same subnet, even if they block ICMP.
Question 2: Which tool is specifically designed for banner grabbing to identify service versions?
- Netcat (nc) (Correct answer)
- Nessus
- Aircrack-ng
- Burp Suite
Correct answer: Netcat (nc)
Netcat can connect to open ports and read the service banner, revealing version information without authentication.
Question 3: During a host audit, you find TCP port 25 open. Which service should you investigate?
- SMTP (Simple Mail Transfer Protocol) (Correct answer)
- POP3
- IMAP
- HTTP
Correct answer: SMTP (Simple Mail Transfer Protocol)
TCP port 25 is the default port for SMTP, used for sending email between mail servers.
Question 4: What is the difference between a vulnerability scan and a penetration test?
- A vulnerability scan identifies weaknesses without exploiting them; a pentest actively exploits vulnerabilities (Correct answer)
- A vulnerability scan is illegal; a pentest is not
- A pentest uses automated tools only; a vulnerability scan is manual
- There is no difference between the two
Correct answer: A vulnerability scan identifies weaknesses without exploiting them; a pentest actively exploits vulnerabilities
Vulnerability scanning identifies and reports potential weaknesses, while penetration testing goes further by attempting to exploit them.
Question 5: Which command would you use with Nmap to run all default NSE scripts against a target?
- nmap -sC <target> (Correct answer)
- nmap --scripts all <target>
- nmap -sS <target>
- nmap -p- -sV <target>
Correct answer: nmap -sC <target>
The -sC flag runs Nmap's default NSE (Nmap Scripting Engine) scripts against the target.
Question 6: What information does a reverse DNS lookup provide during host discovery?
- The hostname associated with a given IP address (Correct answer)
- The open ports on a remote host
- The MAC address of a remote host
- The geographic location of the IP
Correct answer: The hostname associated with a given IP address
Reverse DNS lookup (PTR query) resolves an IP address back to its associated hostname, revealing useful naming conventions.
Question 7: Which Nmap scan type is used to scan UDP ports on a target?
- -sU (Correct answer)
- -sT
- -sS
- -sN
Correct answer: -sU
The -sU flag performs a UDP scan, which is important since many services like DNS, SNMP, and DHCP run on UDP.
eJPT Host and Network Auditing 4
What does ARP scanning reveal during a network audit that ICMP ping sweeps may miss?