Page 1 of 141
eJPT — eLearnSecurity Junior Penetration Tester
Exam QUESTIONS AND VERIFIED ANSWERS WITH
RATIONALES JUST RELEASED
eJPT — eLearnSecurity Junior Penetration Tester Exam
10 MOST-TESTED EXAM COVERAGE AREAS
The current eJPT exam is a hands-on, entry-level penetration-testing certification. INE currently lists four
major domains: Host and Network Penetration Testing (35%), Assessment Methodologies (25%), Host
and Networking Auditing (25%), and Web Application Penetration Testing (15%). (INE)
1. Assessment Methodologies — Network discovery, endpoint identification, port and service
discovery, operating-system identification, public-source information gathering, email discovery,
technical reconnaissance, vulnerability identification, and evaluating vulnerability impact.
2. Host and Network Auditing — Collecting information from target files, network configuration,
system information, users and groups, credentials and hashes, and transferring files between
systems.
3. Network Fundamentals and Enumeration — IP addressing, subnetting, TCP/IP, common
protocols, ports, routing, network services, Nmap scanning concepts, and interpreting scan
results.
4. Host and Service Enumeration — Identifying SSH, FTP, SMB, HTTP and other services,
determining versions, finding useful information, and recognizing weak or misconfigured
services.
5. Host and Network Penetration Testing — Basic exploitation concepts, selecting appropriate
exploits, modifying exploits when needed, validating successful access, and understanding
attack results.
6. Metasploit Fundamentals — Understanding modules, exploits, payloads, sessions, targets,
options, and the general process of using Metasploit in an authorized lab.
7. Pivoting and Network Access — Understanding segmented networks, adding routes, port
forwarding, reaching internal systems through an accessible host, and recognizing when pivoting
is necessary.
8. Password Attacks and Credential Security — Brute-force concepts, password attacks against
authorized services, password hashes, hash cracking concepts, credential reuse, and recognizing
weak authentication.
9. Web Application Penetration Testing — Web reconnaissance, HTTP basics, cookies and
sessions, web-server enumeration, hidden files and directories, authentication testing, and
identifying common web vulnerabilities.
10. Penetration Testing Workflow and Reporting — Reconnaissance, enumeration, vulnerability
assessment, exploitation, validation, evidence collection, impact assessment, and
communicating findings clearly.
, Page 2 of 141
1.
During an authorized network assessment, which activity should normally be performed first before
attempting exploitation against discovered systems?
A. Delete system logs
B. Perform reconnaissance
C. Crack every password
D. Modify system files
Answer: B. Perform reconnaissance
Rationale: Reconnaissance provides basic information about targets, services, networks, and possible
attack paths before exploitation begins.
2.
A tester discovers several IP addresses but does not know which addresses belong to active machines.
What should happen next?
A. Perform host discovery
B. Change administrator passwords
, Page 3 of 141
C. Install a web server
D. Delete inactive addresses
Answer: A. Perform host discovery
Rationale: Host discovery helps determine which systems are reachable and active on the assessed
network.
3.
Which information does a port scan primarily help a penetration tester identify about a target system
during reconnaissance?
A. Employee salaries
B. Open network ports and services
C. Physical building size
D. Backup schedules
Answer: B. Open network ports and services
Rationale: Port scanning identifies accessible ports and can reveal services listening on those ports.
4.
, Page 4 of 141
A scan shows that a target has an open SSH service. Which additional information would be most useful
during enumeration?
A. Screen brightness
B. SSH version and configuration details
C. Monitor manufacturer
D. Keyboard language
Answer: B. SSH version and configuration details
Rationale: Service versions and configurations can reveal vulnerabilities or useful information for
authorized testing.
5.
Why should a penetration tester identify the operating system of a target before choosing an
appropriate testing approach?
A. Operating systems have different services and vulnerabilities
B. Operating systems determine monitor size
C. Operating systems control internet pricing
D. Operating systems determine employee names
eJPT — eLearnSecurity Junior Penetration Tester
Exam QUESTIONS AND VERIFIED ANSWERS WITH
RATIONALES JUST RELEASED
eJPT — eLearnSecurity Junior Penetration Tester Exam
10 MOST-TESTED EXAM COVERAGE AREAS
The current eJPT exam is a hands-on, entry-level penetration-testing certification. INE currently lists four
major domains: Host and Network Penetration Testing (35%), Assessment Methodologies (25%), Host
and Networking Auditing (25%), and Web Application Penetration Testing (15%). (INE)
1. Assessment Methodologies — Network discovery, endpoint identification, port and service
discovery, operating-system identification, public-source information gathering, email discovery,
technical reconnaissance, vulnerability identification, and evaluating vulnerability impact.
2. Host and Network Auditing — Collecting information from target files, network configuration,
system information, users and groups, credentials and hashes, and transferring files between
systems.
3. Network Fundamentals and Enumeration — IP addressing, subnetting, TCP/IP, common
protocols, ports, routing, network services, Nmap scanning concepts, and interpreting scan
results.
4. Host and Service Enumeration — Identifying SSH, FTP, SMB, HTTP and other services,
determining versions, finding useful information, and recognizing weak or misconfigured
services.
5. Host and Network Penetration Testing — Basic exploitation concepts, selecting appropriate
exploits, modifying exploits when needed, validating successful access, and understanding
attack results.
6. Metasploit Fundamentals — Understanding modules, exploits, payloads, sessions, targets,
options, and the general process of using Metasploit in an authorized lab.
7. Pivoting and Network Access — Understanding segmented networks, adding routes, port
forwarding, reaching internal systems through an accessible host, and recognizing when pivoting
is necessary.
8. Password Attacks and Credential Security — Brute-force concepts, password attacks against
authorized services, password hashes, hash cracking concepts, credential reuse, and recognizing
weak authentication.
9. Web Application Penetration Testing — Web reconnaissance, HTTP basics, cookies and
sessions, web-server enumeration, hidden files and directories, authentication testing, and
identifying common web vulnerabilities.
10. Penetration Testing Workflow and Reporting — Reconnaissance, enumeration, vulnerability
assessment, exploitation, validation, evidence collection, impact assessment, and
communicating findings clearly.
, Page 2 of 141
1.
During an authorized network assessment, which activity should normally be performed first before
attempting exploitation against discovered systems?
A. Delete system logs
B. Perform reconnaissance
C. Crack every password
D. Modify system files
Answer: B. Perform reconnaissance
Rationale: Reconnaissance provides basic information about targets, services, networks, and possible
attack paths before exploitation begins.
2.
A tester discovers several IP addresses but does not know which addresses belong to active machines.
What should happen next?
A. Perform host discovery
B. Change administrator passwords
, Page 3 of 141
C. Install a web server
D. Delete inactive addresses
Answer: A. Perform host discovery
Rationale: Host discovery helps determine which systems are reachable and active on the assessed
network.
3.
Which information does a port scan primarily help a penetration tester identify about a target system
during reconnaissance?
A. Employee salaries
B. Open network ports and services
C. Physical building size
D. Backup schedules
Answer: B. Open network ports and services
Rationale: Port scanning identifies accessible ports and can reveal services listening on those ports.
4.
, Page 4 of 141
A scan shows that a target has an open SSH service. Which additional information would be most useful
during enumeration?
A. Screen brightness
B. SSH version and configuration details
C. Monitor manufacturer
D. Keyboard language
Answer: B. SSH version and configuration details
Rationale: Service versions and configurations can reveal vulnerabilities or useful information for
authorized testing.
5.
Why should a penetration tester identify the operating system of a target before choosing an
appropriate testing approach?
A. Operating systems have different services and vulnerabilities
B. Operating systems determine monitor size
C. Operating systems control internet pricing
D. Operating systems determine employee names
