eJPT Network Security & Vulnerability 2

Question 1

Which Nmap scan type sends TCP packets with the SYN flag set and does NOT complete the three-way handshake?

Accepted Answer

SYN scan (-sS)

Answer

SYN scan (-sS) sends a SYN packet and, upon receiving SYN/ACK, immediately sends RST, never completing the handshake — making it stealthier than a full connect scan.

Question 2

An attacker captures traffic and sees ARP replies associating the gateway IP with the attacker's MAC address. What attack is occurring?

Accepted Answer

ARP poisoning

Answer

ARP poisoning (ARP spoofing) involves sending unsolicited ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle interception.

Question 3

What does a CVE score of 9.8 indicate about a vulnerability?

Accepted Answer

Critical severity, likely remotely exploitable with no authentication required

Answer

A CVSS score of 9.8 is near-maximum and typically indicates a critical, network-exploitable vulnerability requiring no privileges or user interaction.

Question 4

Which protocol does Nmap use when performing host discovery with the -sn flag against a local subnet?

Accepted Answer

ICMP Echo Request and ARP

Answer

On a local subnet, Nmap's ping scan (-sn) uses ARP requests to discover live hosts; on remote networks it uses ICMP Echo, TCP SYN/ACK, and ICMP timestamp requests.

Question 5

A penetration tester runs: `nmap -sV -p 21 192.168.1.10` and sees 'vsftpd 2.3.4'. Why is this significant?

Accepted Answer

vsftpd 2.3.4 contains a backdoor that opens a shell on port 6200

Answer

vsftpd 2.3.4 was compromised in a supply-chain attack; it contains a backdoor triggered by a smiley-face username that opens a root shell on port 6200.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Network Security & Vulnerability 2