eJPT Network Attacks 4

Question 1

Which command correctly performs OS detection and version scanning with Nmap against a single host?

Accepted Answer

Both A and C are correct

Answer

Both -sV -O and -A enable OS detection and service version scanning; -A additionally enables script scanning and traceroute.

Question 2

An attacker intercepts an NTLMv2 hash using Responder. What is the immediate next step to leverage this credential?

Accepted Answer

Crack it offline with Hashcat or attempt an NTLM relay

Answer

NTLMv2 hashes cannot be passed directly; they must either be cracked offline or relayed in real time using a tool like ntlmrelayx.

Question 3

What eJPT networking concept describes dividing a network into segments to limit lateral movement after a compromise?

Accepted Answer

VLANs and network segmentation

Answer

VLANs and network segmentation isolate hosts into separate broadcast domains, limiting an attacker's ability to pivot between systems.

Question 4

During a pentest, you discover a service on port 21. Which Nmap script would help enumerate anonymous FTP access?

Accepted Answer

ftp-anon

Answer

The ftp-anon NSE script checks whether an FTP server allows anonymous logins and lists accessible files.

Question 5

What is a 'man-in-the-browser' attack vector most closely related to on a local network?

Accepted Answer

ARP poisoning redirecting traffic through the attacker

Answer

On a LAN, ARP poisoning is the foundation for MITM attacks that can be extended to inspect or modify browser traffic passing through the attacker's machine.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Network Attacks 4