eJPT Vulnerability Assessment 2 — Questions and Answers
Question 1: Which Nmap script category is most useful for detecting known vulnerabilities during a vulnerability assessment?
- auth
- vuln (Correct answer)
- discovery
- brute
Correct answer: vuln
The 'vuln' script category contains NSE scripts specifically designed to check for known vulnerabilities in services.
Question 2: What does a CVSS score of 9.8 indicate about a vulnerability?
- Low severity, easy to remediate
- Medium severity with network vector
- Critical severity requiring immediate attention (Correct answer)
- High severity but only exploitable locally
Correct answer: Critical severity requiring immediate attention
A CVSS score of 9.8 falls in the Critical range (9.0–10.0), indicating the vulnerability poses an extreme risk and requires immediate remediation.
Question 3: During a vulnerability scan, you find an open port 445 on a Windows host. Which vulnerability should you prioritize checking for?
- Shellshock
- EternalBlue (MS17-010) (Correct answer)
- Heartbleed
- Log4Shell
Correct answer: EternalBlue (MS17-010)
Port 445 is used by SMB, and EternalBlue (MS17-010) is a critical SMB vulnerability that enables remote code execution on unpatched Windows systems.
Question 4: What is the primary purpose of credentialed scanning versus uncredentialed scanning?
- Credentialed scans are faster and use fewer network resources
- Credentialed scans provide deeper visibility into installed software and local configurations (Correct answer)
- Uncredentialed scans always find more vulnerabilities
- Credentialed scans only work on Windows targets
Correct answer: Credentialed scans provide deeper visibility into installed software and local configurations
Credentialed scans authenticate to the target, allowing inspection of installed patches, software versions, and local settings that are invisible from the network.
Question 5: Which tool is commonly used for web application vulnerability scanning during an eJPT-level assessment?
- Masscan
- Nikto (Correct answer)
- Responder
- Hydra
Correct answer: Nikto
Nikto is a web server scanner that checks for dangerous files, outdated software, and common misconfigurations in web applications.
Question 6: What does the term 'false positive' mean in the context of vulnerability scanning?
- A vulnerability that exists but cannot be exploited
- A vulnerability reported by the scanner that does not actually exist (Correct answer)
- A critical vulnerability missed by the scanner
- A vulnerability that has been patched
Correct answer: A vulnerability reported by the scanner that does not actually exist
A false positive is when a vulnerability scanner reports a vulnerability that does not actually exist on the target system.
Question 7: Which of the following best describes passive vulnerability assessment?
- Sending exploit payloads to confirm vulnerabilities
- Analyzing network traffic and banners without actively probing the target (Correct answer)
- Running authenticated scans using admin credentials
- Brute-forcing service logins to identify weak passwords
Correct answer: Analyzing network traffic and banners without actively probing the target
Passive vulnerability assessment involves observing and analyzing existing traffic, banners, and data without sending additional probes to the target.
eJPT Vulnerability Assessment 2
Which Nmap script category is most useful for detecting known vulnerabilities during a vulnerability assessment?