eJPT Scanning and Enumeration 2 — Questions and Answers
Question 1: Which Nmap scan type sends a SYN packet and waits for a SYN-ACK without completing the three-way handshake?
- TCP Connect scan (-sT)
- SYN stealth scan (-sS) (Correct answer)
- UDP scan (-sU)
- FIN scan (-sF)
Correct answer: SYN stealth scan (-sS)
SYN stealth scan (-sS) sends a SYN and tears down the connection after receiving SYN-ACK, never completing the handshake.
Question 2: What does the Nmap option '-p-' specify?
- Scan only privileged ports (1-1023)
- Scan all 65535 TCP ports (Correct answer)
- Scan the top 100 ports
- Scan only UDP ports
Correct answer: Scan all 65535 TCP ports
The '-p-' flag tells Nmap to scan all 65535 TCP ports instead of just the default top 1000.
Question 3: Which SMB enumeration tool can list shares, users, and OS information on a target Windows host?
- Hydra
- enum4linux (Correct answer)
- Nikto
- Gobuster
Correct answer: enum4linux
enum4linux is a Linux tool that wraps Samba utilities to enumerate SMB shares, users, groups, and OS details.
Question 4: What is the purpose of the Nmap '-sV' flag?
- Enable verbose output
- Detect service versions on open ports (Correct answer)
- Perform a vulnerability scan
- Scan using a virtual interface
Correct answer: Detect service versions on open ports
'-sV' probes open ports to determine the service name and version number running on each.
Question 5: During an Nmap scan, a port returns the state 'filtered'. What does this most likely indicate?
- The port is open and accepting connections
- A firewall or ACL is blocking probe packets (Correct answer)
- The service crashed during scanning
- The port is closed but reachable
Correct answer: A firewall or ACL is blocking probe packets
A 'filtered' state means Nmap cannot determine if the port is open because a packet filter is dropping or blocking probes.
Question 6: Which protocol does DNS primarily use for standard queries, and on which port?
- TCP port 53
- UDP port 53 (Correct answer)
- UDP port 67
- TCP port 443
Correct answer: UDP port 53
DNS uses UDP port 53 for standard queries, switching to TCP port 53 only for zone transfers or responses exceeding 512 bytes.
Question 7: What Nmap scripting engine (NSE) category is most useful for enumerating additional details from discovered services during a pentest?
- exploit
- discovery (Correct answer)
- brute
- malware
Correct answer: discovery
The 'discovery' NSE category contains scripts that actively enumerate services, retrieve banners, and gather additional host information.
eJPT Scanning and Enumeration 2
Which Nmap scan type sends a SYN packet and waits for a SYN-ACK without completing the three-way handshake?