CPSA Crest 2

Question 1

Which TCP flag combination is used in a SYN scan to identify open ports without completing the three-way handshake?

Accepted Answer

SYN-ACK then RST

Answer

A SYN scan sends a SYN packet; an open port replies with SYN-ACK, and the scanner immediately sends RST to avoid completing the connection.

Question 2

What is the default port used by SNMP for receiving traps?

Accepted Answer

162

Answer

SNMP agents listen on UDP port 161 for queries, while SNMP traps are sent to the manager on UDP port 162.

Question 3

Which protocol does Kerberos primarily use for ticket exchange and on what port?

Accepted Answer

UDP/TCP port 88

Answer

Kerberos operates over UDP and TCP on port 88 for authentication ticket exchange in Active Directory environments.

Question 4

During a network assessment, you observe gratuitous ARP packets flooding the network. What attack does this most likely indicate?

Accepted Answer

ARP spoofing / man-in-the-middle

Answer

Gratuitous ARP packets sent repeatedly are a hallmark of ARP spoofing, used to redirect traffic through an attacker's machine for a MITM attack.

Question 5

What does the IP TTL value of 128 most likely indicate about the operating system of the target host?

Accepted Answer

Windows system

Answer

Windows systems default to a TTL of 128, while Linux/Unix systems typically start with TTL 64, aiding OS fingerprinting during reconnaissance.

CPSA Exam Practice Test