eJPT Vulnerability Scanning 2 — Questions and Answers
Question 1: Which Nmap script category is most useful for identifying known vulnerabilities during a scan?
- safe
- vuln (Correct answer)
- discovery
- intrusive
Correct answer: vuln
The 'vuln' script category in Nmap runs scripts specifically designed to check for known vulnerabilities on target services.
Question 2: What does the term 'false positive' mean in the context of vulnerability scanning?
- A vulnerability that was missed by the scanner
- A correctly identified critical vulnerability
- A reported vulnerability that does not actually exist (Correct answer)
- A scan that crashes the target service
Correct answer: A reported vulnerability that does not actually exist
A false positive occurs when a scanner reports a vulnerability that is not actually present on the target system.
Question 3: Which OpenVAS component is responsible for executing the actual vulnerability tests against targets?
- Greenbone Security Assistant (GSA)
- OpenVAS Scanner (Correct answer)
- Greenbone Vulnerability Manager (GVM)
- OpenVAS CLI
Correct answer: OpenVAS Scanner
The OpenVAS Scanner daemon (ospd-openvas) executes the Network Vulnerability Tests (NVTs) against target hosts.
Question 4: When scanning for vulnerabilities on a web application, which tool is specifically designed for this purpose?
- Nessus
- Nikto (Correct answer)
- Masscan
- Netcat
Correct answer: Nikto
Nikto is a web server scanner that checks for dangerous files, outdated software, and common web vulnerabilities.
Question 5: What is the primary difference between a credentialed and a non-credentialed vulnerability scan?
- Credentialed scans run faster than non-credentialed scans
- Credentialed scans use valid login credentials to access the system internally, finding more vulnerabilities (Correct answer)
- Non-credentialed scans always produce more accurate results
- Credentialed scans only work on Windows systems
Correct answer: Credentialed scans use valid login credentials to access the system internally, finding more vulnerabilities
Credentialed scans authenticate to the target system, enabling deeper inspection of installed software, configurations, and patches that external scans cannot see.
Question 6: Which CVSSv3 score range is classified as 'Critical' severity?
- 7.0 – 8.9
- 6.0 – 7.9
- 9.0 – 10.0 (Correct answer)
- 8.0 – 9.9
Correct answer: 9.0 – 10.0
CVSSv3 defines Critical severity as scores from 9.0 to 10.0, representing the highest risk vulnerabilities.
Question 7: What Nmap flag enables OS detection during a vulnerability assessment scan?
- -sV
- -O (Correct answer)
- -A
- -p-
Correct answer: -O
The -O flag instructs Nmap to attempt OS fingerprinting by analyzing TCP/IP stack responses from the target.
eJPT Vulnerability Scanning 2
Which Nmap script category is most useful for identifying known vulnerabilities during a scan?