eJPT Network Security & Vulnerability 4 — Questions and Answers
Question 1: Which network protocol is exploited in a 'Smurf attack'?
- TCP SYN flooding
- ICMP with broadcast amplification (Correct answer)
- UDP fragmentation
- ARP gratuitous replies
Correct answer: ICMP with broadcast amplification
A Smurf attack sends ICMP Echo Requests spoofed with the victim's IP to a broadcast address, causing all hosts on the network to reply to the victim, overwhelming it.
Question 2: When using Wireshark to analyze a capture, a tester filters with 'tcp.flags.syn == 1 && tcp.flags.ack == 0'. What traffic is displayed?
- Completed TCP connections
- Only TCP RST packets
- Initial TCP SYN packets (connection initiation attempts) (Correct answer)
- All UDP traffic
Correct answer: Initial TCP SYN packets (connection initiation attempts)
This Wireshark filter isolates TCP packets that have the SYN flag set but not the ACK flag, which are the initial connection-request packets in the TCP handshake.
Question 3: What is the primary security risk of using TELNET for remote administration?
- It uses a non-standard port that is easily blocked
- It transmits all data including credentials in plaintext (Correct answer)
- It only supports IPv4, not IPv6
- It lacks multi-factor authentication support
Correct answer: It transmits all data including credentials in plaintext
Telnet transmits all data — including usernames and passwords — in cleartext, making it trivial for an attacker with network access to capture credentials via sniffing.
Question 4: A network segment uses the address 10.10.10.0/24. How many usable host IP addresses does this subnet provide?
- 254 (Correct answer)
- 256
- 255
- 128
Correct answer: 254
A /24 subnet has 256 total addresses; subtracting the network address (10.10.10.0) and broadcast address (10.10.10.255) leaves 254 usable host addresses.
Question 5: Which Metasploit command is used to search for modules related to a specific vulnerability or service?
- use
- show exploits
- search (Correct answer)
- info
Correct answer: search
The `search` command in msfconsole allows users to find modules by keyword, CVE number, platform, or module type across the entire Metasploit framework database.
Question 6: What does the acronym 'OSINT' stand for in the context of penetration testing?
- Operational System Intrusion Toolkit
- Open Source Intelligence (Correct answer)
- Offline Security Incident Notification Tool
- Outbound Scanning and Intrusion Technique
Correct answer: Open Source Intelligence
OSINT (Open Source Intelligence) refers to collecting information about a target from publicly available sources such as websites, social media, DNS records, and public databases.
Question 7: Which of the following correctly describes a 'man-in-the-middle' (MitM) attack?
- Flooding a target with traffic to cause denial of service
- Intercepting and potentially altering communication between two parties without their knowledge (Correct answer)
- Guessing authentication credentials through repeated attempts
- Injecting malicious code into a database query
Correct answer: Intercepting and potentially altering communication between two parties without their knowledge
In a MitM attack, an adversary positions themselves between two communicating parties, secretly intercepting and potentially modifying the traffic in transit.
eJPT Network Security & Vulnerability 4
Which network protocol is exploited in a 'Smurf attack'?