Crest Flashcards

Which TCP flag combination is used in a SYN scan to identify open ports without completing the three-way handshake?

Answer: SYN-ACK then RST

A SYN scan sends a SYN packet; an open port replies with SYN-ACK, and the scanner immediately sends RST to avoid completing the connection.

What is the default port used by SNMP for receiving traps?

Answer: 162

SNMP agents listen on UDP port 161 for queries, while SNMP traps are sent to the manager on UDP port 162.

Which protocol does Kerberos primarily use for ticket exchange and on what port?

Answer: UDP/TCP port 88

Kerberos operates over UDP and TCP on port 88 for authentication ticket exchange in Active Directory environments.

During a network assessment, you observe gratuitous ARP packets flooding the network. What attack does this most likely indicate?

Answer: ARP spoofing / man-in-the-middle

Gratuitous ARP packets sent repeatedly are a hallmark of ARP spoofing, used to redirect traffic through an attacker's machine for a MITM attack.

What does the IP TTL value of 128 most likely indicate about the operating system of the target host?

Answer: Windows system

Windows systems default to a TTL of 128, while Linux/Unix systems typically start with TTL 64, aiding OS fingerprinting during reconnaissance.

Which Nmap scan type is most appropriate when ICMP is blocked by a firewall but you need to discover live hosts on a subnet?

Answer: TCP SYN ping scan (-PS)

TCP SYN ping (-PS) sends SYN packets to common ports to detect live hosts when ICMP is filtered by perimeter firewalls.

What is the purpose of the LDAP protocol in an Active Directory environment during a CREST assessment?

Answer: Querying and enumerating directory objects such as users and groups

LDAP (port 389) is used to query Active Directory for objects including user accounts, group memberships, and computer accounts, making it valuable for enumeration.