Practice Test GeekseLearnSecurity Junior Penetration Tester eJPT Practice Practice Test
← All EJPT Flashcard Decks

Scanning and Enumeration Flashcards

6 cards from real EJPT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Scanning and Enumeration flashcards as text

  1. A penetration tester runs an Nmap scan with the command `nmap -sS 192.168.1.10`. What is the primary characteristic of this type of scan?

    Answer: It is a stealth scan that does not complete the TCP three-way handshake.

    The `-sS` flag in Nmap specifies a TCP SYN scan, also known as a 'stealth' or 'half-open' scan. It initiates a TCP connection by sending a SYN packet but does not complete the three-way handshake, making it less likely to be logged by the target system.

  2. During an engagement, you suspect a misconfigured DNS server might leak information about the internal network structure. Which technique would be most effective for attempting to retrieve all DNS records from the server?

    Answer: Attempting a DNS Zone Transfer (AXFR).

    A DNS Zone Transfer (AXFR) is a mechanism for replicating DNS databases across a set of DNS servers. If a server is misconfigured to allow zone transfers to any client, an attacker can use this to request and receive a copy of all DNS records for a zone, revealing the internal network structure.

  3. A penetration tester needs to gather as much information as possible from a Windows host over SMB, including users, shares, and password policies. Which of the following tools is specifically designed for this purpose?

    Answer: Enum4linux

    Enum4linux is a tool specifically created to enumerate information from Windows and Samba systems over the SMB protocol. It can gather data such as user lists, group memberships, shares, and password policies.

  4. While scanning a target, you want to identify the specific version of the software running on an open port to search for known vulnerabilities. Which Nmap command-line option would you use to achieve this?

    Answer: -sV

    The `-sV` option in Nmap enables version detection. It probes open ports to determine service and version information, which is crucial for identifying potentially vulnerable software.

  5. A junior penetration tester is tasked with enumerating SNMP on a network device at 10.10.5.25. They discover that the default read community string is set to 'public'. What kind of information can they likely obtain?

    Answer: System information such as routing tables, hostnames, and user accounts.

    With a default read-only community string like 'public', an attacker can use SNMP enumeration tools (like snmpwalk or nmap's snmp scripts) to query the device's Management Information Base (MIB). This can reveal a wealth of information, including system uptime, network interfaces, user accounts, running processes, and routing tables.

  6. Which of the following describes the purpose of 'banner grabbing' during the enumeration phase?

    Answer: To connect to an open port to receive the introductory text or 'banner' sent by the service, often revealing its type and version.

    Banner grabbing is a technique used to connect to a service on an open port and read the initial text-based 'banner' it sends. This banner often contains details about the service name and version, which is valuable information for a penetration tester looking for potential vulnerabilities.