eJPT Vulnerability Assessment 3 — Questions and Answers
Question 1: When using OpenVAS (Greenbone), what is the first step before running a vulnerability scan?
- Configure an exploit module
- Create a target and select a scan configuration (Correct answer)
- Set up a reverse shell listener
- Enable port forwarding on the target
Correct answer: Create a target and select a scan configuration
In OpenVAS/Greenbone, you must first define a target (IP/host) and choose a scan configuration before initiating any vulnerability scan.
Question 2: Which vulnerability is associated with the CVE-2014-0160 identifier?
- EternalBlue
- Shellshock
- Heartbleed (Correct answer)
- Dirty COW
Correct answer: Heartbleed
CVE-2014-0160, known as Heartbleed, is a critical OpenSSL vulnerability that allows attackers to read memory from affected servers.
Question 3: A scan reveals a service banner showing 'Apache/2.2.8'. What is the most significant security concern?
- Apache is running on a non-standard port
- This is an outdated version with known vulnerabilities (Correct answer)
- The banner reveals the operating system type
- Apache 2.2.8 does not support HTTPS
Correct answer: This is an outdated version with known vulnerabilities
Apache 2.2.8 is a very old version with numerous known CVEs; the version disclosure allows attackers to identify and target specific vulnerabilities.
Question 4: During vulnerability assessment, which port is associated with the default Microsoft RDP service?
- 22
- 389
- 3389 (Correct answer)
- 5900
Correct answer: 3389
Remote Desktop Protocol (RDP) runs on TCP port 3389 by default, making it a common target for vulnerability assessment on Windows systems.
Question 5: What is the significance of identifying end-of-life (EOL) software during a vulnerability assessment?
- EOL software automatically patches itself
- EOL software no longer receives security updates, leaving vulnerabilities permanently unpatched (Correct answer)
- EOL software is immune to network-based attacks
- EOL software triggers automatic alerts in SIEM systems
Correct answer: EOL software no longer receives security updates, leaving vulnerabilities permanently unpatched
End-of-life software no longer receives vendor patches, meaning any discovered vulnerabilities will remain permanently exploitable.
Question 6: Which Nmap flag enables OS detection during a host scan?
- -sV
- -O (Correct answer)
- -A
- -p
Correct answer: -O
The -O flag enables Nmap's OS detection feature, which uses TCP/IP stack fingerprinting to identify the target's operating system.
Question 7: What is a vulnerability's 'attack vector' metric in CVSS v3?
- The specific exploit code used to trigger the vulnerability
- The context in which the vulnerability can be exploited (e.g., Network, Adjacent, Local, Physical) (Correct answer)
- The number of systems affected by the vulnerability
- The time required to develop a working exploit
Correct answer: The context in which the vulnerability can be exploited (e.g., Network, Adjacent, Local, Physical)
The Attack Vector (AV) metric in CVSS v3 describes the context required to exploit the vulnerability, ranging from Network (remotely exploitable) to Physical (requires physical access).
eJPT Vulnerability Assessment 3
When using OpenVAS (Greenbone), what is the first step before running a vulnerability scan?