eJPT Practice Test

eJPT practice test: what's covered

• Assessment Methodologies
• Footprinting & Scanning
• Enumeration
• Metasploit
• Pivoting
• Web App Pentesting
• Auditing

Free eJPT sample questions

1. A security tester is conducting an assessment. A security tester is conducting an assessment. A junior pentester is starting an engagement and must build a target list without sending any traffic to the client's hosts. Which phase of the penetration testing methodology does this describe?

   • A. Passive information gathering (OSINT)
   • B. Active scanning
   • C. Exploitation
   • D. Post-exploitation
   Show answer

   Correct: A. Passive information gathering collects data from third-party sources (WHOIS, DNS, search engines, social media) without directly touching the target. Active scanning, exploitation, and post-exploitation all generate traffic to the target hosts. Distractor options represent incorrect protocols or flags.

2. During scoping, the client authorizes testing only of the 10.10.50.0/24 network. The tester finds a host at 10.10.51.5 responding. What is the correct action?

   • A. Test it because it is in the same Class A block
   • B. Do not test it — it is outside the authorized scope
   • C. Test it but only with non-intrusive scans
   • D. Add it to scope automatically since it is reachable
   Show answer

   Correct: B. 10.10.51.5 is not within 10.10.50.0/24 (range 10.10.50.0–10.10.50.255), so it is out of scope. Testing out-of-scope hosts violates the rules of engagement regardless of reachability or scan intensity.

3. A penetration tester is preparing for an internal network security assessment. Which TWO activities are performed during the initial pre-engagement and scope definition phase? (Choose TWO)

   • A. Defining target IP ranges and excluded systems in writing
   • B. Establishing clear Rules of Engagement and emergency contact procedures
   • C. Running aggressive automated exploit modules against production servers
   • D. Exfiltrating sensitive databases to demonstrate system access
   Show answer

   Correct: A and B. Defining target scope and establishing Rules of Engagement (RoE) are critical pre-engagement tasks that establish legal authorization and boundaries. Running automated exploits and exfiltrating databases are post-authorization active testing and exploitation activities, not pre-engagement scoping tasks.

4. A security tester is conducting an assessment. A security tester is conducting an assessment. A pentester records that a discovered SQL injection allows full database read on an internet-facing app holding PII. When prioritizing findings in the report, which factor most increases the risk rating?

   • A. The vulnerability being easy to describe
   • B. The number of distractor parameters in the URL
   • C. The age of the web server software only
   • D. High likelihood of exploitation combined with high business impact
   Show answer

   Correct: D. Risk is a function of likelihood and impact. An easily exploitable flaw exposing PII on a public app scores high on both axes, driving a critical rating. The other factors do not meaningfully change measured risk.

5. A security tester is conducting an assessment. A security tester is conducting an assessment. A tester needs to resolve all DNS records and attempt a zone transfer for the domain corp.local against name server ns1.corp.local. Which tool/command is appropriate?

   • A. dig axfr @ns1.corp.local corp.local
   • B. nmap -sn corp.local
   • C. msfconsole -q
   • D. hydra -L users.txt corp.local
   Show answer

   Correct: A. dig axfr requests a full DNS zone transfer (AXFR) from the specified name server. nmap -sn only does host discovery, msfconsole launches Metasploit, and hydra is a credential brute-forcer — none perform a zone transfer. Distractor options represent incorrect protocols or flags.

Last updated: 2026-10-19

eJPT practice test FAQ