eJPT practice questions

Q: Is this eJPT practice test free?

Yes. All 15 eJPT practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real eJPT exam cost?

The official price is $249. Cyber VK sells the same official eJPT voucher for $229.99 — a saving of $19.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real eJPT exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

During the information gathering phase, which type of reconnaissance involves interacting directly with the target system, such as connecting to its services?

Accepted Answer

Active reconnaissance directly engages the target (e.g., port scanning or banner grabbing), whereas passive reconnaissance gathers data from third-party sources without touching the target.

Question 2

Which Google Dork would most effectively locate exposed login pages on a target domain during passive OSINT?

Accepted Answer

The `inurl:admin` operator combined with `site:` narrows results to URLs containing 'admin' within the target domain, commonly surfacing login and administrative pages.

Question 3

You perform a DNS zone transfer against a target and it succeeds. Which record type would reveal the mail servers for the domain?

Accepted Answer

MX (Mail Exchange) records specify the mail servers responsible for accepting email for a domain, which a successful zone transfer would disclose.

Question 4

Which Nmap flag performs a TCP SYN (half-open) scan?

Accepted Answer

The `-sS` flag initiates a SYN scan that never completes the TCP handshake, making it stealthier and faster than the full-connect `-sT` scan.

Question 5

An Nmap scan reports a port as 'filtered'. What does this most likely indicate?

Accepted Answer

A 'filtered' state means Nmap cannot determine if the port is open because packet filtering (typically a firewall) is preventing probes from reaching it.

Question 6

You need to scan a host that blocks ICMP echo requests, but you still want Nmap to treat it as up and proceed with port scanning. Which flag should you use?

Accepted Answer

The `-Pn` flag disables host discovery, telling Nmap to skip the ping check and scan the host as if it were online, which is essential when ICMP is blocked.

Question 7

Which tool is a widely used web application proxy for intercepting and modifying HTTP requests during testing?

Accepted Answer

Burp Suite functions as an intercepting proxy that lets testers capture, inspect, and modify HTTP/HTTPS traffic between the browser and the web server.

Question 8

Which payload would confirm a reflected Cross-Site Scripting (XSS) vulnerability in an input field?

Accepted Answer

A `` payload that executes in the browser confirms XSS, whereas the other payloads target SQL injection, path traversal, and command injection respectively.

Question 9

A login form is vulnerable to SQL injection. Which input in the username field would most reliably bypass authentication when the query concatenates input directly?

Accepted Answer

`admin' --` closes the string and comments out the remaining query (including the password check), so the query authenticates as admin without a valid password.

Question 10

In the Metasploit Framework, which command is used to configure a required option such as RHOSTS for a module?

Accepted Answer

The `set` command assigns a value to a module option (e.g., `set RHOSTS 10.0.0.5`), while `use` selects a module and `run`/`exploit` executes it.

Question 11

You have a Meterpreter session on a Windows host and want to attempt to elevate to SYSTEM privileges automatically. Which command should you try first?

Accepted Answer

The `getsystem` command in Meterpreter attempts several known privilege escalation techniques to obtain SYSTEM-level access on a Windows target.

Question 12

After dumping NTLM hashes from a Windows machine, you use one of them to authenticate to another host without cracking it. What is this technique called?

Accepted Answer

Pass-the-Hash reuses the captured NTLM hash directly for authentication, bypassing the need to recover the plaintext password.

Question 13

Which tool is commonly used to perform online brute-force attacks against network login services like SSH and FTP?

Accepted Answer

Hydra is designed for online (live-service) brute-force attacks across many protocols, while John and Hashcat perform offline cracking of captured hashes.

Question 14

You capture the file `/etc/shadow` from a Linux host. Which tool is best suited to crack the password hashes it contains offline?

Accepted Answer

John the Ripper is an offline password cracker that can process the hashes stored in `/etc/shadow`, whereas Hydra and Medusa target live online services.

Question 15

On an internal network, you run Responder to capture authentication attempts. Which protocol poisoning does Responder primarily abuse to intercept NetNTLM hashes?

Accepted Answer

Responder poisons LLMNR and NBT-NS name-resolution broadcasts, tricking hosts into sending their NetNTLM hashes to the attacker for capture and offline cracking.

eJPT — eJPT Junior Penetration Tester INE Exam Voucher | Buy Online Practice Test

Free Practice Test

eJPT practice test — common questions