eJPT Vulnerability Scanning 5 — Questions and Answers
Question 1: Which of the following best describes a 'zero-day' vulnerability in the context of vulnerability scanning?
- A vulnerability that takes zero seconds to exploit
- A vulnerability that has been public for exactly one day
- A vulnerability unknown to the vendor with no available patch (Correct answer)
- A vulnerability with a CVSS score of 0
Correct answer: A vulnerability unknown to the vendor with no available patch
A zero-day vulnerability is one that is unknown to the software vendor or has no patch available, making it particularly dangerous.
Question 2: What is the main advantage of using Masscan over Nmap for initial reconnaissance in a large network assessment?
- Masscan produces more detailed vulnerability reports
- Masscan can perform OS fingerprinting more accurately
- Masscan is capable of scanning the entire internet in minutes due to its asynchronous design (Correct answer)
- Masscan automatically exploits discovered vulnerabilities
Correct answer: Masscan is capable of scanning the entire internet in minutes due to its asynchronous design
Masscan uses an asynchronous, stateless design that allows it to send millions of packets per second, making it significantly faster than Nmap for large-scale port scanning.
Question 3: During a vulnerability scan, you discover an SMB service running on port 445. Which well-known vulnerability should you specifically check for on unpatched Windows systems?
- Heartbleed (CVE-2014-0160)
- EternalBlue (MS17-010) (Correct answer)
- Shellshock (CVE-2014-6271)
- Log4Shell (CVE-2021-44228)
Correct answer: EternalBlue (MS17-010)
EternalBlue (MS17-010) is a critical SMB vulnerability exploited by WannaCry and NotPetya, and is a standard check when SMB is discovered on unpatched Windows hosts.
Question 4: What does the term 'attack surface' mean in the context of vulnerability scanning?
- The physical area where an attacker is located
- The total number of vulnerabilities found in a scan report
- All the possible points where an attacker could try to enter or extract data from a system (Correct answer)
- The network bandwidth consumed during a scan
Correct answer: All the possible points where an attacker could try to enter or extract data from a system
The attack surface encompasses all entry points and exposed interfaces — open ports, services, APIs, and user inputs — that an attacker could potentially exploit.
Question 5: Which scan type in Nmap is used specifically to scan UDP ports?
- -sT
- -sS
- -sU (Correct answer)
- -sN
Correct answer: -sU
The -sU flag tells Nmap to perform a UDP scan, which is important for discovering services like DNS, SNMP, and DHCP that run over UDP.
Question 6: What is the purpose of performing a vulnerability scan after applying patches to a system?
- To generate a new baseline scan for the patching team
- To verify that the patches successfully remediated the identified vulnerabilities
- To discover new vulnerabilities introduced by the patches
- Both B and C are correct reasons (Correct answer)
Correct answer: Both B and C are correct reasons
Post-patch scanning both verifies that target vulnerabilities are remediated and checks whether patches introduced new issues or changed the system's security posture.
Question 7: In Nessus scan results, what does a 'High' severity finding typically indicate?
- An informational note about the target system configuration
- A vulnerability that is easily exploitable and could lead to significant compromise (Correct answer)
- A theoretical vulnerability with no known exploit
- A low-risk misconfiguration requiring minor hardening
Correct answer: A vulnerability that is easily exploitable and could lead to significant compromise
High severity findings represent vulnerabilities with significant exploitability or impact, often with known exploits, requiring prompt remediation.
eJPT Vulnerability Scanning 5
Which of the following best describes a 'zero-day' vulnerability in the context of vulnerability scanning?