eJPT Trivia 2 — Questions and Answers
Question 1: Which TCP port does the SMB protocol typically use on modern Windows systems?
- 139
- 445 (Correct answer)
- 137
- 138
Correct answer: 445
SMB over TCP/IP (Direct Hosting) uses port 445, which is the modern standard on Windows.
Question 2: What does the acronym 'CVE' stand for in cybersecurity?
- Common Vulnerability Exploits
- Common Vulnerabilities and Exposures (Correct answer)
- Critical Vulnerability Enumeration
- Cyber Vulnerability Exchange
Correct answer: Common Vulnerabilities and Exposures
CVE stands for Common Vulnerabilities and Exposures, a public dictionary of known cybersecurity vulnerabilities.
Question 3: Which Metasploit command is used to search for modules related to a specific vulnerability?
- find
- lookup
- search (Correct answer)
- query
Correct answer: search
The 'search' command in msfconsole searches the module database by keyword, CVE, or platform.
Question 4: What is the primary purpose of the '/etc/shadow' file on Linux systems?
- Store user home directories
- Store encrypted user passwords (Correct answer)
- Log failed login attempts
- Define user group memberships
Correct answer: Store encrypted user passwords
The /etc/shadow file stores hashed passwords for Linux user accounts and is readable only by root.
Question 5: In network scanning, what does a 'RST' (reset) packet response to a SYN probe typically indicate?
- The port is open
- The port is filtered by a firewall
- The port is closed (Correct answer)
- The host is offline
Correct answer: The port is closed
A RST/ACK response to a SYN packet indicates the port is closed but the host is reachable.
Question 6: Which protocol does Nmap use by default when performing a ping sweep?
- TCP SYN
- UDP
- ICMP Echo (Correct answer)
- ARP
Correct answer: ICMP Echo
Nmap uses ICMP Echo requests (ping) by default for host discovery in a ping sweep.
Question 7: What type of attack involves sending a large number of SYN packets without completing the TCP handshake?
- UDP Flood
- SYN Flood (Correct answer)
- Ping of Death
- ARP Spoofing
Correct answer: SYN Flood
A SYN Flood is a DoS attack that exhausts server resources by leaving half-open TCP connections.
eJPT Trivia 2
Which TCP port does the SMB protocol typically use on modern Windows systems?