eJPT Vulnerability Scanning 4 — Questions and Answers
Question 1: What information does the '-sV' flag in Nmap provide during a vulnerability assessment?
- Operating system version only
- Service name and version running on open ports (Correct answer)
- All open and closed ports on the target
- VLAN and network topology information
Correct answer: Service name and version running on open ports
The -sV flag enables version detection, causing Nmap to probe open ports to identify the software name and version running on each service.
Question 2: Which vulnerability database is most commonly referenced by tools like Nessus and OpenVAS when reporting findings?
- OWASP Top 10
- CVE (Common Vulnerabilities and Exposures) (Correct answer)
- NIST SP 800-53
- CIS Benchmarks
Correct answer: CVE (Common Vulnerabilities and Exposures)
CVE is the industry-standard dictionary of publicly known vulnerabilities, and scanners use CVE identifiers to reference specific vulnerabilities in their reports.
Question 3: In the context of vulnerability scanning, what is 'network enumeration' typically performed before?
- Report generation
- Patch management
- Vulnerability scanning itself (Correct answer)
- Social engineering attacks
Correct answer: Vulnerability scanning itself
Network enumeration discovers live hosts, open ports, and services before the vulnerability scan, so the scanner knows exactly what targets to assess.
Question 4: Which eJPT-relevant tool is used to perform automated web application vulnerability scanning and can detect issues like SQL injection and XSS?
- Hydra
- Nikto (Correct answer)
- Netcat
- Masscan
Correct answer: Nikto
Nikto scans web servers for dangerous files, outdated software versions, and common vulnerabilities including some injection and XSS vectors.
Question 5: What does a vulnerability scan report typically include that helps prioritize remediation efforts?
- Source code of the vulnerable application
- Severity ratings and CVSS scores for each finding (Correct answer)
- Network topology diagrams of the target
- Employee usernames and passwords
Correct answer: Severity ratings and CVSS scores for each finding
Vulnerability scan reports assign severity ratings and CVSS scores to each finding, enabling security teams to prioritize patching the highest-risk issues first.
Question 6: When running Nmap with the '-A' flag, which combination of features is enabled?
- Only port scanning and OS detection
- OS detection, version detection, script scanning, and traceroute (Correct answer)
- Anonymous scanning and firewall evasion only
- Only UDP and TCP scanning simultaneously
Correct answer: OS detection, version detection, script scanning, and traceroute
The -A flag enables aggressive mode, combining OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute in one command.
Question 7: What is the significance of the NVT (Network Vulnerability Test) database in OpenVAS?
- It stores scan credentials for authenticated scans
- It contains the collection of vulnerability test scripts used to check targets (Correct answer)
- It logs all raw network packets captured during scanning
- It manages user accounts for the OpenVAS web interface
Correct answer: It contains the collection of vulnerability test scripts used to check targets
The NVT database is OpenVAS's library of vulnerability test scripts, equivalent to Nessus plugins, and must be kept updated for accurate scanning.
eJPT Vulnerability Scanning 4
What information does the '-sV' flag in Nmap provide during a vulnerability assessment?