eJPT Network Security & Vulnerability 3 — Questions and Answers
Question 1: A tester wants to identify all open UDP ports on a target. Which Nmap flag is used?
- -sT
- -sU (Correct answer)
- -sS
- -sN
Correct answer: -sU
The `-sU` flag triggers a UDP scan; Nmap sends empty UDP packets and interprets ICMP Port Unreachable responses as closed ports and no response as open|filtered.
Question 2: Which of the following BEST describes a 'null session' vulnerability in older Windows systems?
- Unauthenticated RDP access via port 3389
- Anonymous connection to the IPC$ share allowing enumeration of users and shares (Correct answer)
- Exploitation of the LSASS process to dump credentials
- Bypassing UAC to gain SYSTEM privileges
Correct answer: Anonymous connection to the IPC$ share allowing enumeration of users and shares
A null session allows unauthenticated SMB connections to IPC$ in older Windows, enabling enumeration of usernames, shares, and domain information.
Question 3: What information does the 'Banner Grabbing' technique provide during reconnaissance?
- The list of open firewall rules
- Service name, version, and sometimes OS information from a network service (Correct answer)
- The encrypted hash of administrator credentials
- The physical MAC address of the target NIC
Correct answer: Service name, version, and sometimes OS information from a network service
Banner grabbing retrieves the service banner (text sent by a service on connection), which often reveals the service name, version number, and OS details useful for identifying vulnerabilities.
Question 4: During a network scan, Nmap reports a port as 'filtered'. What does this mean?
- The port is open and actively listening
- The port is closed and returned a RST packet
- A firewall or filter is blocking probe packets, preventing determination of state (Correct answer)
- The service on the port refused the connection
Correct answer: A firewall or filter is blocking probe packets, preventing determination of state
A filtered port status means Nmap's probes are being blocked by a packet filter or firewall, so Nmap cannot determine if the port is open or closed.
Question 5: Which vulnerability class involves sending more data than a buffer can hold, potentially overwriting adjacent memory?
- SQL Injection
- Cross-Site Scripting
- Buffer Overflow (Correct answer)
- Path Traversal
Correct answer: Buffer Overflow
A buffer overflow occurs when input exceeds the allocated buffer size, overwriting adjacent memory regions and potentially allowing arbitrary code execution.
Question 6: A pentester needs to check whether SMB signing is disabled on a target. Which tool is most appropriate?
- Hydra
- Nmap with smb-security-mode script (Correct answer)
- SQLmap
- Netcat
Correct answer: Nmap with smb-security-mode script
The Nmap NSE script `smb-security-mode` checks SMB message signing configuration, revealing whether signing is required, enabled-but-not-required, or disabled.
Question 7: What is the default port used by the Remote Desktop Protocol (RDP)?
- 22
- 443
- 3389 (Correct answer)
- 5900
Correct answer: 3389
RDP listens on TCP port 3389 by default; knowing this allows penetration testers to identify potential remote-access attack surfaces during port scans.
eJPT Network Security & Vulnerability 3
A tester wants to identify all open UDP ports on a target.
Which Nmap flag is used?