eJPT Network Security & Vulnerability 5 — Questions and Answers
Question 1: Which port and protocol does DNS primarily use for standard queries?
- TCP 53
- UDP 53 (Correct answer)
- UDP 443
- TCP 853
Correct answer: UDP 53
DNS uses UDP on port 53 for standard queries because it is faster; TCP 53 is used for zone transfers and responses exceeding 512 bytes.
Question 2: What is a 'zombie scan' (also called an idle scan) used for in Nmap?
- Scanning without generating any network traffic
- Using a third-party idle host's IP ID sequence to perform a port scan while hiding the scanner's true IP (Correct answer)
- Scanning with all TCP flags set simultaneously
- Performing a scan during off-peak hours to avoid detection
Correct answer: Using a third-party idle host's IP ID sequence to perform a port scan while hiding the scanner's true IP
An idle scan (-sI) exploits a 'zombie' host with predictable IP ID increments to infer port states on the target, making the scan appear to originate from the zombie host.
Question 3: During a black-box engagement, a tester discovers port 161/UDP is open. Which service is most likely running?
- NTP
- SNMP (Correct answer)
- SYSLOG
- DHCP
Correct answer: SNMP
UDP port 161 is the standard port for SNMP (Simple Network Management Protocol), which can expose device configuration and network topology if community strings are weak.
Question 4: Which type of firewall inspects packet headers only and makes filtering decisions based on source/destination IP and port?
- Application-layer firewall (WAF)
- Stateful inspection firewall
- Packet filtering firewall (Correct answer)
- Next-generation firewall (NGFW)
Correct answer: Packet filtering firewall
A packet filtering firewall operates at Layers 3 and 4, making allow/deny decisions based solely on IP addresses, ports, and protocol without tracking connection state.
Question 5: A penetration tester uses `hydra -l admin -P rockyou.txt ssh://192.168.1.5`. What is this command doing?
- Performing a port scan for SSH services
- Brute-forcing SSH login for the 'admin' user using the rockyou.txt wordlist (Correct answer)
- Generating SSH keys for the admin account
- Sniffing SSH session traffic on the network
Correct answer: Brute-forcing SSH login for the 'admin' user using the rockyou.txt wordlist
This Hydra command attempts to authenticate to SSH on 192.168.1.5 as 'admin', cycling through every password in the rockyou.txt wordlist — a dictionary brute-force attack.
Question 6: What does the term 'pivot' mean in penetration testing?
- Changing the scope of engagement mid-test
- Using a compromised host as a relay to attack systems on otherwise unreachable network segments (Correct answer)
- Pivoting from privilege escalation to lateral movement
- Rotating encryption keys during an attack
Correct answer: Using a compromised host as a relay to attack systems on otherwise unreachable network segments
Pivoting involves using a compromised machine as a proxy or tunnel to reach internal network segments that would otherwise be inaccessible from the attacker's position.
Question 7: Which vulnerability allows an attacker to read files outside the web root by manipulating file path parameters with sequences like '../../../etc/passwd'?
- Remote File Inclusion (RFI)
- Command Injection
- Directory Traversal (Path Traversal) (Correct answer)
- XML External Entity (XXE)
Correct answer: Directory Traversal (Path Traversal)
Directory traversal (path traversal) exploits insufficient input validation on file path parameters, allowing attackers to use `../` sequences to escape the web root and read arbitrary files.
eJPT Network Security & Vulnerability 5
Which port and protocol does DNS primarily use for standard queries?