I85PREP
⌘ K
eJPT study materials
eJPT study resources

eJPT practice questions

One question at a time. Build your eJPT understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Host and Network Penetration Testing

Which Nmap scan type is used by default when Nmap is launched with root privileges against a TCP target?

  1. -sS (TCP SYN scan) Correct answer.
  2. -sA (TCP ACK scan)
  3. -sX (XMAS scan)
  4. -sT (TCP connect scan)

Explanation

With raw socket privileges Nmap performs a half-open SYN scan by default, sending a SYN and tearing the connection down before it completes. The full connect scan is only the default when the user lacks raw socket access.

Question 2Host and Network Penetration Testing

Which Nmap option performs host discovery only and skips port scanning entirely?

  1. -A
  2. -sn Correct answer.
  3. -O
  4. -Pn

Explanation

The -sn switch runs the discovery phase (ICMP echo, ARP, TCP/UDP probes) and stops before any port scan. It is the standard way to map live hosts on a subnet quickly.

Question 3Host and Network Penetration Testing

Which TCP port does Microsoft Remote Desktop Protocol listen on by default?

  1. 443
  2. 3389 Correct answer.
  3. 389
  4. 636

Explanation

RDP is registered to TCP 3389, with UDP 3389 used by some RemoteApp and UDP transport features. Exposed 3389 services are a frequent target for brute-force and BlueKeep-style attacks.

Question 4Host and Network Penetration Testing

Which netcat invocation starts a listener on TCP port 4444 and attaches a shell to it on a Linux target?

  1. nc -u 10.0.0.5 4444
  2. nc -lvp 4444 -e /bin/sh Correct answer.
  3. nc -zvn 10.0.0.5 4444
  4. nc -nv 10.0.0.5 4444 -w 5

Explanation

The -l flag places netcat in listen mode, -p sets the port and -e binds a program to the socket, here a shell. This produces a bind shell that waits for the attacker to connect.

Question 5Host and Network Penetration Testing

Which Nmap flag enables service and version detection against open ports?

  1. -Pn
  2. -sV Correct answer.
  3. -O
  4. -sC

Explanation

-sV sends probes to open ports and matches the responses against Nmap's service database to identify the product and version. This is the core flag for banner and version fingerprinting.

Question 6Host and Network Penetration Testing

An assessor needs to perform an online password guessing attack against an exposed SSH service. Which tool is built for that task?

  1. hydra Correct answer.
  2. responder
  3. john
  4. hashcat

Explanation

Hydra performs online credential guessing against live network services such as SSH, FTP and RDP by sending authentication attempts over the wire. Offline crackers work on captured hashes and never speak to the target service.

Question 7Host and Network Penetration Testing

What is the primary function of ARP on an IPv4 network?

  1. To discover the default gateway using ICMP
  2. To map IP addresses to MAC addresses Correct answer.
  3. To assign IP addresses dynamically to hosts
  4. To resolve hostnames into IP addresses

Explanation

ARP broadcasts a request asking which MAC address owns a given IPv4 address, and the owner replies with its hardware address. Because the replies are unauthenticated, ARP is the basis for spoofing and poisoning attacks on a LAN.

Question 8Host and Network Penetration Testing

Which Nmap option scans all 65535 TCP ports on a target?

  1. -p 1-1024
  2. -F
  3. --top-ports 1000
  4. -p- Correct answer.

Explanation

The shorthand -p- expands to the range 1-65535, giving a full TCP port sweep. By contrast -F and --top-ports restrict the scan to a curated subset.

Question 9Host and Network Penetration Testing

During a UDP scan, a target port that replies with an ICMP port unreachable message should be recorded as which state?

  1. filtered
  2. open|filtered
  3. open
  4. closed Correct answer.

Explanation

UDP has no handshake, so a host signals that nothing is listening by returning ICMP type 3 code 3 (port unreachable), which Nmap maps to closed. A UDP response means open, while silence usually yields open|filtered.

Question 10Host and Network Penetration Testing

Which Nmap command runs the http-enum NSE script against port 80 of 10.10.10.5?

  1. nmap -sU -p 80 --script banner 10.10.10.5
  2. nmap -O -p 80 10.10.10.5
  3. nmap --script http-enum -p 80 10.10.10.5 Correct answer.
  4. nmap -A -p 80 --version-all 10.10.10.5

Explanation

The --script option loads a named NSE script and runs it against the ports being scanned, so http-enum enumerates common web paths and files. Scripts can also be invoked by category such as default, safe or vuln.

Question 11Host and Network Penetration Testing

Which smbclient switch lists the shares exported by a remote SMB server?

  1. -T
  2. -M
  3. -L Correct answer.
  4. -c

Explanation

The -L switch asks the server for its share list, producing output of the form Sharename, Type and Comment. Combined with -N it attempts the listing without a password, which often succeeds against hosts allowing null sessions.

Question 12Host and Network Penetration Testing

A target host is behind a firewall that blocks all inbound connections but allows outbound TCP/443. Which shell technique is most likely to succeed?

  1. A bind shell listening on a random high port on the target
  2. A bind shell listening on TCP/443 on the target
  3. A chrooted interactive TTY shell started locally
  4. A reverse shell connecting out from the target to the attacker on TCP/443 Correct answer.

Explanation

Egress filtering is usually looser than ingress filtering, so a reverse shell that initiates the connection outbound traverses the firewall. Bind shells require the firewall to permit inbound connections to the listening port.

Question 13Host and Network Penetration Testing

Which tool is designed to capture NetNTLM hashes by answering LLMNR and NBT-NS queries on a local network?

  1. Wireshark
  2. Hydra
  3. Responder Correct answer.
  4. Nmap

Explanation

Responder listens for broadcast name-resolution requests and replies with the attacker's address, prompting victims to authenticate and revealing NetNTLM challenge responses. Those hashes can then be cracked offline or relayed.

Question 14Host and Network Penetration Testing

Kerberoasting obtains which material for offline cracking?

  1. NTLM challenge responses sent over SMB to a file server
  2. Domain user account lockout policies from the default domain policy
  3. Service account TGS tickets requested with a service principal name Correct answer.
  4. The krbtgt account password hash stored in the domain controller registry

Explanation

Any authenticated domain user can request a TGS for a service principal name, and that ticket is encrypted with the service account's password-derived key. Requesting tickets for accounts with SPNs therefore yields crackable material without touching the target host.

Question 15Host and Network Penetration Testing

A login form concatenates user input into a SQL query and is vulnerable to injection. Which payload is most likely to bypass the authentication check?

  1. admin' OR '1'='1' -- Correct answer.
  2. admin' AND '1'='2
  3. admin'; DROP TABLE users; --
  4. admin" AND sleep(5) --

Explanation

Appending a logical OR with a tautology makes the WHERE clause evaluate true for every row, so the query returns a record and the login succeeds. The comment sequence removes the remaining password check.

Question 16Host and Network Penetration Testing

Which ssh invocation forwards the attacker's local port 8080 to internal host 10.10.10.50 port 80 through a compromised jump host?

  1. ssh -D 8080 user@jump
  2. ssh -L 8080:jump:80 user@jump
  3. ssh -L 8080:10.10.10.50:80 user@jump Correct answer.
  4. ssh -R 8080:10.10.10.50:80 -N user@jump

Explanation

Local forwarding with -L binds a listener on the client and tunnels traffic to the target reachable from the SSH server, in the form localport:host:hostport. This is the standard way to reach an internal service through a pivot.

Question 17Host and Network Penetration Testing

Which hashcat mode number corresponds to raw NTLM hashes of the type stored in the Windows SAM database?

  1. 5600
  2. 1800
  3. 1000 Correct answer.
  4. 0

Explanation

Mode 1000 selects raw NTLM, which is the 32-character hexadecimal output extracted from SAM or NTDS.dit. Choosing the wrong mode wastes time because the candidate hashing algorithm will not match the stored format.

Question 18Host and Network Penetration Testing

Inside a Meterpreter session on Windows running as a low-privileged user, which command attempts local privilege escalation through token impersonation techniques?

  1. hashdump
  2. screenshot
  3. getsystem Correct answer.
  4. migrate

Explanation

getsystem tries several named-pipe impersonation and token duplication techniques to obtain SYSTEM-level privileges. It only succeeds when the session holds, or can obtain, a suitable token.

Question 19Host and Network Penetration Testing

Which tcpdump filter expression captures only TCP packets with the SYN flag set that are destined for port 22?

  1. host port 22 and icmp
  2. tcp port 22 and tcp[tcpflags] == tcp-ack
  3. udp port 22
  4. tcp[13] & 2 != 0 and dst port 22 Correct answer.

Explanation

Byte 13 of the TCP header holds the flags, and the SYN bit has value 2, so tcp[13] & 2 != 0 matches packets with SYN set. Combining that with dst port 22 isolates connection attempts to SSH.

Question 20Host and Network Penetration Testing

Which Wireshark display filter shows only HTTP requests that used the POST method?

  1. http.request.method == "GET"
  2. http contains "POST"
  3. tcp.port == 80 && post
  4. http.request.method == "POST" Correct answer.

Explanation

Wireshark exposes parsed HTTP fields, so http.request.method compares the decoded method against a string value. Quoting the value is required for string comparisons in display filters.

Question 21Host and Network Penetration Testing

Which Nmap scan uses a third-party host with predictable IP ID values to map a target's open ports without sending packets from the attacker's own address?

  1. -b
  2. -sZ
  3. -sO
  4. -sI Correct answer.

Explanation

The idle scan (-sI) bounces probes off a silent zombie host and infers port state from changes in its IP ID counter. A good zombie is idle and uses a global counter, so the attacker's address never appears in the target's logs.

Question 22Host and Network Penetration Testing

For an SMB relay attack to authenticate successfully against a target server, which condition must hold on that target?

  1. The target must be a domain controller enforcing LDAP signing
  2. The attacker must possess the plaintext password of the victim
  3. The target must have LLMNR disabled on its network interfaces
  4. SMB signing must be disabled or not required on the target Correct answer.

Explanation

Relaying forwards a captured NTLM authentication exchange to another server, and the session signature that would otherwise bind the authentication to the original server is only enforced when SMB signing is required. With signing disabled, the relayed credentials are accepted.

Question 23Host and Network Penetration Testing

A Golden Ticket attack requires which key material to forge a valid Kerberos TGT?

  1. The krbtgt account NTLM hash together with the domain SID Correct answer.
  2. The plaintext password of any member of the Domain Admins group
  3. The NTLM hash of a domain service account used by a line-of-business application
  4. A valid TGS ticket for a single service principal name

Explanation

A TGT is encrypted and signed with the krbtgt account key, so forging one requires that hash plus the domain SID to build the PAC correctly. Possession of the krbtgt hash effectively grants unlimited domain-wide authentication until it is rotated twice.

Question 24Host and Network Penetration Testing

Which technique lets an attacker holding the required directory rights obtain account password hashes by impersonating a domain controller's replication requests?

  1. Pass-the-hash
  2. DCSync Correct answer.
  3. LSASS dumping
  4. Kerberoasting

Explanation

DCSync abuses the DRSUAPI replication interface, asking a real domain controller to send credential data as if the attacker were another DC. It requires rights such as Replicating Directory Changes and leaves no code running on the target controller.

Question 25Host and Network Penetration Testing

Which attack crosses VLAN boundaries by sending frames carrying two 802.1Q tags to a switch port configured incorrectly?

  1. ARP spoofing
  2. MAC flooding
  3. Double tagging Correct answer.
  4. DHCP starvation

Explanation

In double tagging the attacker stacks an outer tag for the native VLAN and an inner tag for the victim VLAN; the switch strips the outer tag and forwards the frame, which normally flows only one way. It works when the attacker's port sits on the native VLAN of a trunk.

Question 26Host and Network Penetration Testing

Which Nmap option enables operating system detection against a reachable target?

  1. -sV
  2. -sn
  3. -Pn
  4. -O Correct answer.

Explanation

The -O option activates OS fingerprinting, which compares the target's TCP/IP stack behavior against Nmap's signature database. It works best when at least one open and one closed port are discovered.

Question 27Host and Network Penetration Testing

Which Netcat command starts a listener that hands a shell to the first client that connects on port 4444?

  1. nc -lvnp 4444 < payload.txt
  2. nc 10.10.10.9 4444 -e /bin/bash
  3. nc -lvnp 4444 -e /bin/bash Correct answer.
  4. ncat -zv 10.10.10.9 4444

Explanation

A bind shell requires the target to listen (-l), stay verbose (-v), and execute a shell when a client connects, which the -e flag achieves on Netcat builds that support it. The attacker then connects to port 4444 to receive the shell.

Question 28Host and Network Penetration Testing

Which Windows service broadcasts name resolution queries on UDP port 137?

  1. mDNS
  2. NBT-NS Correct answer.
  3. LLMNR
  4. DNS

Explanation

NetBIOS Name Service (NBT-NS) resolves NetBIOS names to IPv4 addresses and uses UDP port 137 for broadcast queries. Because these broadcasts are unauthenticated, a rogue responder can answer them to capture authentication traffic.

Question 29Host and Network Penetration Testing

Which Nmap NSE script category is executed when the -sC option is used?

  1. default Correct answer.
  2. intrusive
  3. discovery
  4. safe

Explanation

The -sC flag is an alias for --script=default, which runs the default script category. Default scripts are selected as broadly useful and low-risk for general scanning.

Question 30Host and Network Penetration Testing

Which Metasploit payload makes the compromised host initiate a connection back to the attacker?

  1. windows/meterpreter/bind_tcp
  2. windows/meterpreter/bind_named_pipe
  3. windows/meterpreter/reverse_tcp Correct answer.
  4. windows/adduser

Explanation

A reverse_tcp payload instructs the target to connect outbound to a listening handler on the attacker's machine, which is useful when inbound connections to the target are filtered. Bind payloads behave in the opposite direction.

Question 31Host and Network Penetration Testing

On a modern Linux distribution, which file holds the hashed passwords for local accounts?

  1. /etc/passwd
  2. /etc/shadow Correct answer.
  3. /etc/group
  4. /etc/sudoers

Explanation

Password hashes are stored in /etc/shadow, which is readable only by root, while /etc/passwd is world-readable and holds account metadata with an 'x' placeholder in the password field. Writing to /etc/passwd is therefore a common privilege escalation goal.

Question 32Host and Network Penetration Testing

Which command displays the cron jobs scheduled by the current user?

  1. systemctl list-timers
  2. crontab -l Correct answer.
  3. at -l
  4. crontab -e

Explanation

The -l flag lists the invoking user's crontab entries, which is useful during local enumeration to find scripts that run with higher privileges. Editing jobs with -e and listing systemd timers are different operations.

Question 33Host and Network Penetration Testing

How does the Nmap -sS scan determine whether a TCP port is open?

  1. It uses the IP ID field to infer port state
  2. It sends UDP probes to common ports
  3. It completes the full TCP handshake on every port
  4. It sends a SYN and resets on SYN/ACK Correct answer.

Explanation

A SYN scan sends a single SYN; an open port answers with SYN/ACK, prompting Nmap to send an RST so the connection is never established. This half-open behavior is faster and less likely to be logged by the application.

Question 34Host and Network Penetration Testing

A tester runs 'nmap -sn 10.10.10.0/24'. What does the command produce?

  1. Scans the 1000 most common TCP ports on every host
  2. Lists live hosts without port scans Correct answer.
  3. Sends UDP probes to every host
  4. Performs OS fingerprinting on each host

Explanation

The -sn option performs host discovery only, using probes such as ICMP echo, TCP SYN to 443, TCP ACK to 80, and ICMP timestamp. It reports which addresses are up and performs no port scanning.

Question 35Host and Network Penetration Testing

For ARP cache poisoning to succeed on a switched network, which precondition must the attacker meet?

  1. Control the gateway's routing table
  2. Disable spanning tree on the switch
  3. Be in the same VLAN as the victim Correct answer.
  4. Obtain Domain Admin credentials

Explanation

ARP is a link-layer broadcast protocol that does not cross routers, so the attacker must share the victim's broadcast domain to send forged replies that the victim will accept. Once positioned, the attacker can forward traffic to preserve connectivity.

Question 36Host and Network Penetration Testing

An assessor captures a local administrator's NTLM hash. Which action is possible without cracking that hash?

  1. Decrypt the SAM database
  2. Recover the plaintext password
  3. Forge a Kerberos TGT
  4. Authenticate via pass-the-hash Correct answer.

Explanation

NTLM authentication proves knowledge of the hash rather than the plaintext, so a captured hash can be replayed directly to remote services that accept NTLM. This is why disabling NTLM and enforcing signing are key mitigations.

Question 37Host and Network Penetration Testing

Which account configuration makes a user vulnerable to AS-REP roasting?

  1. The account holds an SPN
  2. Pre-authentication is disabled Correct answer.
  3. The password never expires
  4. The account is in Domain Admins

Explanation

When Kerberos pre-authentication is disabled, a domain controller returns an AS-REP encrypted with the user's key to any requester, allowing offline password cracking. The captured material is crackable without any prior authentication.

Question 38Host and Network Penetration Testing

Which sqlmap option tells the tool which parameter of a request to test for injection?

  1. -p Correct answer.
  2. --batch
  3. --dbs
  4. -u

Explanation

The -p switch names the parameter to target, which helps avoid testing parameters that are irrelevant or could break application state. It is commonly combined with -u, which supplies the target URL.

Question 39Host and Network Penetration Testing

Once enabled, which MSSQL procedure allows an authenticated user to run operating system commands?

  1. xp_cmdshell Correct answer.
  2. OPENROWSET
  3. sp_configure
  4. xp_dirtree

Explanation

xp_cmdshell spawns a Windows command shell and passes a string to it, giving command execution in the context of the SQL Server service account. It is disabled by default and must be turned on through sp_configure with show advanced options enabled.

Question 40Host and Network Penetration Testing

Which tool automates enumeration of Windows privilege escalation vectors such as weak service permissions and unquoted paths?

  1. BloodHound
  2. LinEnum
  3. PowerView
  4. WinPEAS Correct answer.

Explanation

WinPEAS checks a broad set of local Windows misconfigurations, including service permissions, scheduled tasks, and credential files, and highlights likely escalation paths. It is the Windows counterpart to the Linux enumeration scripts.

Question 41Host and Network Penetration Testing

Which command locates files with the SUID bit set on a Linux host?

  1. find / -perm -4000 -type f 2>/dev/null Correct answer.
  2. find / -user root -type f 2>/dev/null
  3. grep -r 4000 /etc 2>/dev/null
  4. find / -perm -2000 -type f 2>/dev/null

Explanation

The 4000 permission bit denotes SUID, and -perm -4000 matches files where that bit is set, while the type filter and error redirection keep the output to regular files. SUID binaries execute with the owner's privileges, frequently root.

Question 42Host and Network Penetration Testing

Which ports does Windows Remote Management listen on by default?

  1. 3389/tcp and 3390/tcp
  2. 445/tcp and 139/tcp
  3. 5985/tcp and 5986/tcp Correct answer.
  4. 135/tcp and 137/udp

Explanation

WinRM uses TCP 5985 for HTTP and TCP 5986 for HTTPS, with the latter becoming the default in newer configurations. Valid credentials plus WinRM access allow remote command execution through tools such as evil-winrm.

Question 43Host and Network Penetration Testing

Which technique carries command-and-control traffic inside a protocol that firewalls rarely block, such as name resolution?

  1. 802.1Q double tagging
  2. ARP cache poisoning
  3. Encapsulating traffic in DNS queries Correct answer.
  4. SSH remote port forwarding

Explanation

DNS tunneling encodes data in query and response records for a domain the attacker controls, allowing bidirectional communication when only DNS egress is permitted. It abuses the fact that internal resolvers are usually allowed to reach external DNS servers.

Question 44Host and Network Penetration Testing

In a cross-site scripting payload, which JavaScript expression exposes the victim's session cookie for exfiltration?

  1. window.location.href
  2. localStorage.getItem('session')
  3. document.cookie Correct answer.
  4. navigator.userAgent

Explanation

document.cookie returns the cookies accessible to the current page, which can be sent to an attacker-controlled host. Marking cookies HttpOnly removes them from this property and is the standard mitigation for session theft.

Question 45Host and Network Penetration Testing

A Windows service is registered with an unquoted path containing spaces. Which condition allows an attacker to escalate privileges?

  1. The binary is digitally signed
  2. An unquoted path folder is writable Correct answer.
  3. The attacker holds SeDebugPrivilege
  4. The service runs as LocalSystem

Explanation

Windows tries candidate executables ending at each space in the path, so if an attacker can write to one of those directories, the service starts the planted binary with its own privileges. Full paths quoted in the registry eliminate the ambiguity.

Question 46Host and Network Penetration Testing

Which material is required to forge a Silver Ticket in an Active Directory environment?

  1. The service account's NTLM hash Correct answer.
  2. The domain's DNS zone file
  3. A Domain Admin's plaintext password
  4. The krbtgt account hash

Explanation

A Silver Ticket is a service ticket encrypted with the target service account's key, so the service account hash is sufficient to create one. It grants access only to that specific service, unlike a Golden Ticket that forges a TGT with the krbtgt key.

Question 47Host and Network Penetration Testing

Which Active Directory Certificate Services misconfiguration lets a low-privileged user obtain a certificate that authenticates as a domain administrator?

  1. Disabling NTLM authentication domain-wide
  2. A domain password policy of eight characters
  3. An ESC1 template with a client auth EKU Correct answer.
  4. Running the Print Spooler on a DC

Explanation

ESC1 exists when a certificate template allows the requester to supply the subject and includes an authentication EKU, so any enrolled user can request a certificate naming a privileged account. The resulting certificate is used for PKINIT to obtain a TGT as that account.

Question 48Host and Network Penetration Testing

Which tool is built to spoof DHCPv6 and DNS to become a man in the middle for Windows hosts that prefer IPv6?

  1. mitm6 Correct answer.
  2. CrackMapExec
  3. Ettercap
  4. Responder

Explanation

mitm6 answers DHCPv6 solicitations and supplies a rogue DNS server, exploiting the default preference for IPv6 over IPv4 on Windows. The resulting DNS resolution of WPAD or other names routes authentication traffic through the attacker.

Question 49Host and Network Penetration Testing

Which control prevents a captured NTLM authentication from being relayed to an LDAP server?

  1. LAPS deployment
  2. LDAP signing and channel binding Correct answer.
  3. Kerberos pre-authentication
  4. SMB signing

Explanation

LDAP signing integrity-checks the authentication exchange and channel binding ties it to the original TLS session, so a relayed NTLM exchange cannot be reused against the directory. Both controls are needed because they address different relay variants.

Question 50Host and Network Penetration Testing

An attacker lands on a Windows host as a service account holding SeImpersonatePrivilege. Which escalation path does this enable?

  1. Bypassing UAC silently
  2. Reading the SAM without privileges
  3. Impersonating a SYSTEM token Correct answer.
  4. Extracting cached GPP passwords

Explanation

SeImpersonatePrivilege allows a process to adopt a token it can obtain, and tools such as Juicy Potato or RoguePotato coerce a privileged account into authenticating so its token can be captured. The result is code execution as SYSTEM.