eJPT Network Security & Vulnerability 2 — Questions and Answers
Question 1: Which Nmap scan type sends TCP packets with the SYN flag set and does NOT complete the three-way handshake?
- TCP Connect scan (-sT)
- SYN scan (-sS) (Correct answer)
- FIN scan (-sF)
- XMAS scan (-sX)
Correct answer: SYN scan (-sS)
SYN scan (-sS) sends a SYN packet and, upon receiving SYN/ACK, immediately sends RST, never completing the handshake — making it stealthier than a full connect scan.
Question 2: An attacker captures traffic and sees ARP replies associating the gateway IP with the attacker's MAC address. What attack is occurring?
- DNS spoofing
- ARP poisoning (Correct answer)
- ICMP redirect attack
- BGP hijacking
Correct answer: ARP poisoning
ARP poisoning (ARP spoofing) involves sending unsolicited ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle interception.
Question 3: What does a CVE score of 9.8 indicate about a vulnerability?
- Low severity, easily mitigated
- Medium severity requiring user interaction
- High severity with no known exploit
- Critical severity, likely remotely exploitable with no authentication required (Correct answer)
Correct answer: Critical severity, likely remotely exploitable with no authentication required
A CVSS score of 9.8 is near-maximum and typically indicates a critical, network-exploitable vulnerability requiring no privileges or user interaction.
Question 4: Which protocol does Nmap use when performing host discovery with the -sn flag against a local subnet?
- TCP SYN to port 80
- ICMP Echo Request and ARP (Correct answer)
- UDP to port 53
- SCTP INIT
Correct answer: ICMP Echo Request and ARP
On a local subnet, Nmap's ping scan (-sn) uses ARP requests to discover live hosts; on remote networks it uses ICMP Echo, TCP SYN/ACK, and ICMP timestamp requests.
Question 5: A penetration tester runs: `nmap -sV -p 21 192.168.1.10` and sees 'vsftpd 2.3.4'. Why is this significant?
- vsftpd 2.3.4 enforces strong TLS by default
- vsftpd 2.3.4 contains a backdoor that opens a shell on port 6200 (Correct answer)
- vsftpd 2.3.4 is the latest stable release
- vsftpd 2.3.4 blocks anonymous logins
Correct answer: vsftpd 2.3.4 contains a backdoor that opens a shell on port 6200
vsftpd 2.3.4 was compromised in a supply-chain attack; it contains a backdoor triggered by a smiley-face username that opens a root shell on port 6200.
Question 6: What is the purpose of the Nmap Scripting Engine (NSE)?
- To encrypt Nmap traffic to avoid detection
- To automatically exploit discovered vulnerabilities
- To extend Nmap with scripts for tasks such as vuln detection, brute-forcing, and service enumeration (Correct answer)
- To convert Nmap XML output into HTML reports
Correct answer: To extend Nmap with scripts for tasks such as vuln detection, brute-forcing, and service enumeration
NSE allows users to write and run Lua scripts that automate tasks like version detection, vulnerability checking, and authentication brute-forcing directly within Nmap.
Question 7: Which technique allows an attacker to map internal network topology by analyzing TTL values in ICMP Time Exceeded messages?
- Port scanning
- Traceroute (Correct answer)
- Packet fragmentation
- VLAN hopping
Correct answer: Traceroute
Traceroute exploits decreasing TTL values; each router decrements the TTL and, when it hits zero, sends back an ICMP Time Exceeded message revealing the router's IP.
eJPT Network Security & Vulnerability 2
Which Nmap scan type sends TCP packets with the SYN flag set and does NOT complete the three-way handshake?