eJPT Network Security & Vulnerability 5

Question 1

Which port and protocol does DNS primarily use for standard queries?

Accepted Answer

UDP 53

Answer

DNS uses UDP on port 53 for standard queries because it is faster; TCP 53 is used for zone transfers and responses exceeding 512 bytes.

Question 2

What is a 'zombie scan' (also called an idle scan) used for in Nmap?

Accepted Answer

Using a third-party idle host's IP ID sequence to perform a port scan while hiding the scanner's true IP

Answer

An idle scan (-sI) exploits a 'zombie' host with predictable IP ID increments to infer port states on the target, making the scan appear to originate from the zombie host.

Question 3

During a black-box engagement, a tester discovers port 161/UDP is open. Which service is most likely running?

Accepted Answer

SNMP

Answer

UDP port 161 is the standard port for SNMP (Simple Network Management Protocol), which can expose device configuration and network topology if community strings are weak.

Question 4

Which type of firewall inspects packet headers only and makes filtering decisions based on source/destination IP and port?

Accepted Answer

Packet filtering firewall

Answer

A packet filtering firewall operates at Layers 3 and 4, making allow/deny decisions based solely on IP addresses, ports, and protocol without tracking connection state.

Question 5

A penetration tester uses `hydra -l admin -P rockyou.txt ssh://192.168.1.5`. What is this command doing?

Accepted Answer

Brute-forcing SSH login for the 'admin' user using the rockyou.txt wordlist

Answer

This Hydra command attempts to authenticate to SSH on 192.168.1.5 as 'admin', cycling through every password in the rockyou.txt wordlist — a dictionary brute-force attack.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Network Security & Vulnerability 5