eJPT Host and Network Auditing 5 — Questions and Answers
Question 1: What does 'passive reconnaissance' mean in the context of host and network auditing?
- Gathering information without directly interacting with the target systems (Correct answer)
- Scanning target systems with automated tools
- Exploiting vulnerabilities on target hosts
- Sending probes to identify open ports
Correct answer: Gathering information without directly interacting with the target systems
Passive reconnaissance collects information from public sources (OSINT) without sending packets to the target.
Question 2: Which file on a Linux system contains a list of hostname-to-IP mappings that are checked before DNS?
- /etc/hosts (Correct answer)
- /etc/resolv.conf
- /etc/hostname
- /etc/network/interfaces
Correct answer: /etc/hosts
/etc/hosts is a local file that maps hostnames to IP addresses and takes precedence over DNS resolution.
Question 3: During a network audit, what does the term 'pivot' refer to?
- Using a compromised host to gain access to other network segments not directly reachable (Correct answer)
- Scanning a subnet with multiple tools simultaneously
- Bypassing a firewall using port knocking
- Escalating privileges on a single host
Correct answer: Using a compromised host to gain access to other network segments not directly reachable
Pivoting uses a compromised host as a relay point to reach and attack systems in other network segments.
Question 4: What Nmap command combines OS detection, version scanning, script scanning, and traceroute?
- nmap -A <target> (Correct answer)
- nmap -sV <target>
- nmap -O <target>
- nmap -p- <target>
Correct answer: nmap -A <target>
The -A flag enables aggressive mode, combining -O, -sV, -sC, and --traceroute in a single scan.
Question 5: Which port is associated with the HTTPS service during a web server audit?
- 443 (Correct answer)
- 80
- 8080
- 8443
Correct answer: 443
TCP port 443 is the standard port for HTTPS (HTTP over TLS/SSL) encrypted web traffic.
Question 6: What is the primary goal of network segmentation from a security auditing perspective?
- To limit lateral movement by isolating network zones so a breach in one zone doesn't spread (Correct answer)
- To increase network speed by separating traffic types
- To reduce the number of IP addresses needed on a network
- To simplify network management by grouping devices
Correct answer: To limit lateral movement by isolating network zones so a breach in one zone doesn't spread
Network segmentation creates security boundaries that contain breaches, limiting an attacker's ability to move laterally.
Question 7: Which Nmap flag disables DNS resolution to speed up scanning?
- -n (Correct answer)
- -R
- --dns-servers
- -6
Correct answer: -n
The -n flag tells Nmap to skip DNS resolution, which significantly speeds up scans against large IP ranges.
eJPT Host and Network Auditing 5
What does 'passive reconnaissance' mean in the context of host and network auditing?