eJPT Scanning and Enumeration 3 — Questions and Answers
Question 1: Which command performs a DNS zone transfer against the domain example.com using the dig utility?
- dig example.com ANY
- dig axfr example.com @ns1.example.com (Correct answer)
- dig example.com MX
- dig +trace example.com
Correct answer: dig axfr example.com @ns1.example.com
The 'axfr' query type requests a full zone transfer from the specified nameserver, replicating all DNS records.
Question 2: What is the default port for SNMP?
- TCP 161
- UDP 161 (Correct answer)
- UDP 162
- TCP 199
Correct answer: UDP 161
SNMP agents listen on UDP port 161 for queries; UDP 162 is used for SNMP trap messages.
Question 3: Which Nmap option outputs scan results in all formats simultaneously (normal, XML, and grepable)?
- -oA (Correct answer)
- -oX
- -oN
- -oG
Correct answer: -oA
'-oA <basename>' saves results in all three formats: .nmap (normal), .xml, and .gnmap (grepable).
Question 4: During enumeration you run 'netdiscover -r 192.168.1.0/24'. What is this tool primarily used for?
- Brute-force SSH logins
- ARP-based host discovery on a local network (Correct answer)
- Enumerate SMB shares
- Perform DNS lookups
Correct answer: ARP-based host discovery on a local network
netdiscover uses ARP requests to discover live hosts on a local subnet, making it effective for internal network reconnaissance.
Question 5: Which SNMP community string is typically configured by default on many network devices?
- admin
- public (Correct answer)
- private123
- snmpread
Correct answer: public
The default read-only SNMP community string on most devices is 'public', which should be changed during hardening.
Question 6: What does the acronym 'OS fingerprinting' refer to in the context of Nmap scanning?
- Extracting password hashes from the OS
- Identifying the operating system of a target host based on network responses (Correct answer)
- Scanning for OS-specific vulnerabilities
- Listing running processes on the remote host
Correct answer: Identifying the operating system of a target host based on network responses
OS fingerprinting analyzes TCP/IP stack behavior and packet characteristics to determine the target's operating system.
Question 7: Which tool is commonly used to enumerate NFS shares on a target host?
- showmount (Correct answer)
- smbclient
- rpcclient
- nbtscan
Correct answer: showmount
The 'showmount -e <host>' command queries the NFS server's mount daemon to list exported (shared) directories.
eJPT Scanning and Enumeration 3
Which command performs a DNS zone transfer against the domain example.com using the dig utility?