eJPT Network Attacks 2 — Questions and Answers
Question 1: Which tool is most commonly used to perform a SYN flood DoS attack during a penetration test?
- Wireshark
- hping3 (Correct answer)
- Netcat
- Nmap
Correct answer: hping3
hping3 can craft and send large volumes of SYN packets to a target, making it the standard tool for SYN flood testing.
Question 2: What is the primary goal of an ARP cache poisoning attack?
- Exhaust DHCP address pool
- Associate the attacker's MAC with a legitimate IP (Correct answer)
- Flood the switch CAM table
- Inject malicious DNS responses
Correct answer: Associate the attacker's MAC with a legitimate IP
ARP poisoning overwrites a victim's ARP cache so traffic destined for a legitimate IP is sent to the attacker's MAC address instead.
Question 3: During an MITM attack using Ettercap, what must be enabled on the attacker's Linux system for forwarded traffic to reach its destination?
- IP forwarding via /proc/sys/net/ipv4/ip_forward (Correct answer)
- MAC cloning
- Promiscuous mode on the NIC
- ICMP redirects
Correct answer: IP forwarding via /proc/sys/net/ipv4/ip_forward
Without enabling IP forwarding, packets intercepted by the attacker are dropped instead of relayed, breaking connectivity and alerting victims.
Question 4: Which eJPT-relevant attack exploits the trust relationship between a DHCP client and server to redirect traffic?
- DHCP starvation
- DHCP snooping
- DHCP spoofing (rogue DHCP) (Correct answer)
- DHCP relay attack
Correct answer: DHCP spoofing (rogue DHCP)
A rogue DHCP server responds to client requests first, assigning itself as the default gateway to redirect all client traffic through the attacker.
Question 5: What Nmap flag is used to perform a NULL scan?
- -sS
- -sN (Correct answer)
- -sX
- -sF
Correct answer: -sN
The -sN flag tells Nmap to send TCP packets with no flags set, which is the definition of a NULL scan.
Question 6: When performing password spraying against a network service, what distinguishes it from a traditional brute-force attack?
- It uses a single password against many usernames (Correct answer)
- It uses many passwords against a single username
- It requires plaintext password storage
- It only targets Windows accounts
Correct answer: It uses a single password against many usernames
Password spraying tries one common password across many accounts to avoid lockout policies that trigger on repeated failures to a single account.
Question 7: Which protocol does mDNS (Multicast DNS) use, making it susceptible to spoofing on local networks?
- TCP port 53
- UDP port 5353 (Correct answer)
- UDP port 137
- TCP port 445
Correct answer: UDP port 5353
mDNS operates over UDP port 5353 using multicast, and because it lacks authentication, attackers can send forged responses to redirect traffic.
eJPT Network Attacks 2
Which tool is most commonly used to perform a SYN flood DoS attack during a penetration test?