eJPT Network Attacks 5

Question 1

Which network attack exploits the way IP fragmentation reassembly works by sending overlapping fragments that confuse the target OS?

Accepted Answer

Teardrop attack

Answer

The Teardrop attack sends malformed IP fragments with overlapping offsets that crash or freeze vulnerable OS reassembly code.

Question 2

What is the purpose of using a 'decoy' in an Nmap scan (the -D flag)?

Accepted Answer

Make the scan appear to originate from multiple hosts

Answer

The -D flag causes Nmap to spoof packets from decoy IPs alongside the real source, making it harder for defenders to identify the true scanner.

Question 3

A penetration tester runs: arpspoof -i eth0 -t 192.168.1.5 192.168.1.1. What does this command do?

Accepted Answer

Tells 192.168.1.5 that the attacker's MAC is 192.168.1.1's MAC

Answer

This arpspoof command sends fake ARP replies to 192.168.1.5 claiming the attacker's MAC is associated with the gateway IP 192.168.1.1.

Question 4

What is the key difference between a passive network reconnaissance technique and an active one?

Accepted Answer

Passive does not send packets to the target; active does

Answer

Passive reconnaissance gathers information without touching the target (e.g., OSINT, packet sniffing), while active reconnaissance sends packets directly to target systems.

Question 5

Which Metasploit module category is used to gain an initial foothold by exploiting a vulnerability?

Accepted Answer

Exploit

Answer

Exploit modules in Metasploit attack specific vulnerabilities in target services to deliver a payload and establish a session.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Network Attacks 5