eJPT Vulnerability Assessment 5

Question 1

Which of the following describes a 'zero-day' vulnerability?

Accepted Answer

A vulnerability unknown to the vendor with no available patch

Answer

A zero-day vulnerability is one that is unknown to the software vendor or has no official patch available, making it especially dangerous.

Question 2

During a vulnerability assessment, you identify port 23 open on a network device. What is the primary security concern?

Accepted Answer

Telnet transmits data including credentials in plaintext

Answer

Telnet (port 23) sends all data, including usernames and passwords, in unencrypted plaintext, making it vulnerable to network sniffing attacks.

Question 3

What is the role of the National Vulnerability Database (NVD) in vulnerability assessment?

Accepted Answer

It is the U.S. government repository of CVE vulnerability data with CVSS scores

Answer

The NVD is maintained by NIST and provides a comprehensive database of CVE entries enriched with CVSS scores, CWE identifiers, and remediation guidance.

Question 4

Which technique involves sending specially crafted packets to determine if a host is filtering, closed, or open on specific ports?

Accepted Answer

Port scanning

Answer

Port scanning sends packets to target ports and analyzes responses to determine whether ports are open, closed, or filtered by a firewall.

Question 5

You discover SMB signing is disabled on a Windows host. Which attack does this enable?

Accepted Answer

NTLM relay attacks

Answer

When SMB signing is disabled, an attacker can capture and relay NTLM authentication to authenticate to other services as the victim (NTLM relay attack).

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eJPT Vulnerability Assessment 5