eJPT Network Attacks 5 — Questions and Answers
Question 1: Which network attack exploits the way IP fragmentation reassembly works by sending overlapping fragments that confuse the target OS?
- Smurf attack
- Teardrop attack (Correct answer)
- Ping of Death
- Land attack
Correct answer: Teardrop attack
The Teardrop attack sends malformed IP fragments with overlapping offsets that crash or freeze vulnerable OS reassembly code.
Question 2: What is the purpose of using a 'decoy' in an Nmap scan (the -D flag)?
- Slow down the scan to evade IDS
- Make the scan appear to originate from multiple hosts (Correct answer)
- Encrypt the scan traffic
- Route traffic through a proxy
Correct answer: Make the scan appear to originate from multiple hosts
The -D flag causes Nmap to spoof packets from decoy IPs alongside the real source, making it harder for defenders to identify the true scanner.
Question 3: A penetration tester runs: arpspoof -i eth0 -t 192.168.1.5 192.168.1.1. What does this command do?
- Tells 192.168.1.5 that the attacker's MAC is 192.168.1.1's MAC (Correct answer)
- Floods 192.168.1.1 with ARP requests
- Poisons the gateway's ARP cache
- Performs a DHCP starvation against 192.168.1.5
Correct answer: Tells 192.168.1.5 that the attacker's MAC is 192.168.1.1's MAC
This arpspoof command sends fake ARP replies to 192.168.1.5 claiming the attacker's MAC is associated with the gateway IP 192.168.1.1.
Question 4: What is the key difference between a passive network reconnaissance technique and an active one?
- Passive uses automated tools; active is manual
- Passive does not send packets to the target; active does (Correct answer)
- Passive only works on wireless networks
- Active reconnaissance is always illegal
Correct answer: Passive does not send packets to the target; active does
Passive reconnaissance gathers information without touching the target (e.g., OSINT, packet sniffing), while active reconnaissance sends packets directly to target systems.
Question 5: Which Metasploit module category is used to gain an initial foothold by exploiting a vulnerability?
- Auxiliary
- Post
- Exploit (Correct answer)
- Encoder
Correct answer: Exploit
Exploit modules in Metasploit attack specific vulnerabilities in target services to deliver a payload and establish a session.
Question 6: When a TCP RST packet is received in response to a probe during a port scan, what is the port state?
- Open
- Filtered
- Closed (Correct answer)
- Unfiltered
Correct answer: Closed
A TCP RST response means the port is closed — the service is not listening, but the host is reachable and actively rejecting the connection.
Question 7: Which attack sends an ICMP echo request to a broadcast address with a spoofed source IP of the victim, causing many hosts to reply to the victim?
- Fraggle attack
- Smurf attack (Correct answer)
- Ping of Death
- Teardrop attack
Correct answer: Smurf attack
The Smurf attack amplifies traffic by spoofing the victim's IP as the source of ICMP broadcast pings, causing the entire subnet to flood the victim with replies.
eJPT Network Attacks 5
Which network attack exploits the way IP fragmentation reassembly works by sending overlapping fragments that confuse the target OS?