eJPT Vulnerability Scanning 3 — Questions and Answers
Question 1: In Nessus, what is a 'plugin' used for?
- Extending the Nessus web interface with new pages
- A script that checks for a specific vulnerability or configuration issue (Correct answer)
- A network packet capture module
- A credential storage mechanism
Correct answer: A script that checks for a specific vulnerability or configuration issue
Nessus plugins are individual test scripts, each targeting a specific vulnerability, misconfiguration, or information-gathering check.
Question 2: Which scanning technique sends packets and waits for responses to determine if a port is open, without completing the TCP handshake?
- TCP Connect Scan
- UDP Scan
- SYN Scan (Half-open) (Correct answer)
- FIN Scan
Correct answer: SYN Scan (Half-open)
A SYN scan (half-open scan) sends a SYN packet and analyzes the response without completing the three-way handshake, making it stealthier.
Question 3: What does CVSS stand for in vulnerability management?
- Common Vulnerability Scoring System (Correct answer)
- Cyber Vulnerability Severity Scale
- Common Vulnerability Scanning Standard
- Critical Vulnerability Security Score
Correct answer: Common Vulnerability Scoring System
CVSS stands for Common Vulnerability Scoring System, providing a standardized method to rate the severity of security vulnerabilities.
Question 4: Which of the following is a key risk of running an aggressive vulnerability scan against a production system?
- The scan may take too long to complete
- Scan traffic may be logged by IDS systems
- Scan probes may crash unstable services or cause denial of service (Correct answer)
- The scanner may consume all available disk space
Correct answer: Scan probes may crash unstable services or cause denial of service
Aggressive scans send many packets rapidly and some intrusive checks can destabilize vulnerable services, causing outages on production systems.
Question 5: What is the purpose of a vulnerability scan policy or template in tools like Nessus?
- To store scan results in a database format
- To define the scope, plugins, and settings used during a scan (Correct answer)
- To automatically patch discovered vulnerabilities
- To schedule report delivery to stakeholders
Correct answer: To define the scope, plugins, and settings used during a scan
Scan policies or templates configure which plugins run, scan speed, credentials, and port ranges, tailoring the scan to a specific use case.
Question 6: During a network vulnerability scan, which protocol is commonly used to scan for vulnerabilities in network devices like routers and switches?
- HTTP
- SNMP (Correct answer)
- FTP
- SMTP
Correct answer: SNMP
SNMP (Simple Network Management Protocol) is used to query and manage network devices, and misconfigurations in SNMP are commonly checked during vulnerability scans.
Question 7: What does the Nmap command 'nmap --script vuln <target>' do?
- Performs a stealthy port scan only
- Runs all scripts in the 'vuln' NSE category against the target (Correct answer)
- Scans only for web application vulnerabilities
- Disables version detection to avoid triggering IDS
Correct answer: Runs all scripts in the 'vuln' NSE category against the target
Using '--script vuln' tells Nmap to execute all NSE scripts tagged with the 'vuln' category, checking for known vulnerabilities on open ports.
eJPT Vulnerability Scanning 3
In Nessus, what is a 'plugin' used for?