eJPT Network Attacks 4 — Questions and Answers
Question 1: Which command correctly performs OS detection and version scanning with Nmap against a single host?
- nmap -sV -O 192.168.1.1
- nmap -sS -p- 192.168.1.1
- nmap -A --open 192.168.1.1
- Both A and C are correct (Correct answer)
Correct answer: Both A and C are correct
Both -sV -O and -A enable OS detection and service version scanning; -A additionally enables script scanning and traceroute.
Question 2: An attacker intercepts an NTLMv2 hash using Responder. What is the immediate next step to leverage this credential?
- Pass the hash directly to SMB
- Crack it offline with Hashcat or attempt an NTLM relay (Correct answer)
- Use it to forge a Kerberos ticket
- Inject it into an LDAP query
Correct answer: Crack it offline with Hashcat or attempt an NTLM relay
NTLMv2 hashes cannot be passed directly; they must either be cracked offline or relayed in real time using a tool like ntlmrelayx.
Question 3: What eJPT networking concept describes dividing a network into segments to limit lateral movement after a compromise?
- VLANs and network segmentation (Correct answer)
- Network address translation
- Port mirroring
- QoS traffic shaping
Correct answer: VLANs and network segmentation
VLANs and network segmentation isolate hosts into separate broadcast domains, limiting an attacker's ability to pivot between systems.
Question 4: During a pentest, you discover a service on port 21. Which Nmap script would help enumerate anonymous FTP access?
- ftp-brute
- ftp-anon (Correct answer)
- ftp-syst
- ftp-bounce
Correct answer: ftp-anon
The ftp-anon NSE script checks whether an FTP server allows anonymous logins and lists accessible files.
Question 5: What is a 'man-in-the-browser' attack vector most closely related to on a local network?
- SSL stripping to downgrade HTTPS to HTTP
- DNS hijacking via rogue resolver
- ARP poisoning redirecting traffic through the attacker (Correct answer)
- BGP hijacking of upstream routes
Correct answer: ARP poisoning redirecting traffic through the attacker
On a LAN, ARP poisoning is the foundation for MITM attacks that can be extended to inspect or modify browser traffic passing through the attacker's machine.
Question 6: Which tool is used on Linux to relay intercepted NTLM authentication to another service in real time?
- Impacket's ntlmrelayx.py (Correct answer)
- Responder with --relay flag
- CrackMapExec
- Hydra
Correct answer: Impacket's ntlmrelayx.py
ntlmrelayx.py from the Impacket suite intercepts NTLM authentication and forwards it to target services like SMB or LDAP to gain access.
Question 7: In Wireshark, which display filter shows only TCP SYN packets (connection initiations)?
- tcp.flags == 0x002
- tcp.flags.syn == 1 && tcp.flags.ack == 0 (Correct answer)
- tcp.flags.reset == 0
- tcp.handshake == syn
Correct answer: tcp.flags.syn == 1 && tcp.flags.ack == 0
Filtering for SYN=1 and ACK=0 isolates the first packet of the TCP handshake, excluding SYN-ACK responses.
eJPT Network Attacks 4
Which command correctly performs OS detection and version scanning with Nmap against a single host?