eJPT Vulnerability Assessment 5 — Questions and Answers
Question 1: Which of the following describes a 'zero-day' vulnerability?
- A vulnerability patched within 24 hours of discovery
- A vulnerability that has existed for zero days on the target system
- A vulnerability unknown to the vendor with no available patch (Correct answer)
- A vulnerability that can only be exploited at midnight
Correct answer: A vulnerability unknown to the vendor with no available patch
A zero-day vulnerability is one that is unknown to the software vendor or has no official patch available, making it especially dangerous.
Question 2: During a vulnerability assessment, you identify port 23 open on a network device. What is the primary security concern?
- Port 23 indicates an outdated web server
- Telnet transmits data including credentials in plaintext (Correct answer)
- Port 23 is used for unauthorized DNS queries
- Telnet uses weak encryption that can be easily broken
Correct answer: Telnet transmits data including credentials in plaintext
Telnet (port 23) sends all data, including usernames and passwords, in unencrypted plaintext, making it vulnerable to network sniffing attacks.
Question 3: What is the role of the National Vulnerability Database (NVD) in vulnerability assessment?
- It provides real-time exploit code for penetration testers
- It is the U.S. government repository of CVE vulnerability data with CVSS scores (Correct answer)
- It manages bug bounty programs for major software vendors
- It provides automated patch deployment for Windows systems
Correct answer: It is the U.S. government repository of CVE vulnerability data with CVSS scores
The NVD is maintained by NIST and provides a comprehensive database of CVE entries enriched with CVSS scores, CWE identifiers, and remediation guidance.
Question 4: Which technique involves sending specially crafted packets to determine if a host is filtering, closed, or open on specific ports?
- Vulnerability exploitation
- Port scanning (Correct answer)
- Password spraying
- ARP poisoning
Correct answer: Port scanning
Port scanning sends packets to target ports and analyzes responses to determine whether ports are open, closed, or filtered by a firewall.
Question 5: You discover SMB signing is disabled on a Windows host. Which attack does this enable?
- Pass-the-Hash directly to the domain controller
- NTLM relay attacks (Correct answer)
- Kerberoasting
- Golden Ticket attacks
Correct answer: NTLM relay attacks
When SMB signing is disabled, an attacker can capture and relay NTLM authentication to authenticate to other services as the victim (NTLM relay attack).
Question 6: What information does the 'searchsploit' tool help a penetration tester find?
- Active exploits running on the target network
- Local copies of public exploits and shellcodes from Exploit-DB (Correct answer)
- Real-time CVE data from the National Vulnerability Database
- Credentials stored in browser password managers
Correct answer: Local copies of public exploits and shellcodes from Exploit-DB
Searchsploit is a command-line tool that searches a local copy of the Exploit-DB archive for public exploits and shellcodes matching a given service or software.
Question 7: Which of the following is the correct order of steps in a typical vulnerability assessment workflow?
- Exploit → Scan → Report → Enumerate
- Scan → Enumerate → Identify vulnerabilities → Report findings (Correct answer)
- Report → Scan → Patch → Exploit
- Enumerate → Exploit → Scan → Remediate
Correct answer: Scan → Enumerate → Identify vulnerabilities → Report findings
A standard vulnerability assessment follows: scan for open services, enumerate service details, identify vulnerabilities against findings, then document and report results.
eJPT Vulnerability Assessment 5
Which of the following describes a 'zero-day' vulnerability?