CPSA Crest 4 — Questions and Answers
Question 1: What does CVSS Base Score measure in the context of vulnerability assessment?
- The business impact of a vulnerability on a specific organization
- The intrinsic severity of a vulnerability independent of time and environment (Correct answer)
- The likelihood that a vulnerability will be exploited in the next 30 days
- The cost to remediate a vulnerability in a given system
Correct answer: The intrinsic severity of a vulnerability independent of time and environment
The CVSS Base Score reflects the intrinsic qualities of a vulnerability (attack vector, complexity, privileges required, impact) without considering time or environmental factors.
Question 2: What is a pass-the-hash attack and which protocol does it primarily target?
- Cracking NTLM hashes offline; targets Kerberos
- Authenticating using a stolen password hash without cracking it; targets NTLM (Correct answer)
- Replaying Kerberos tickets; targets SMBv2
- Injecting hashes into memory; targets LDAP
Correct answer: Authenticating using a stolen password hash without cracking it; targets NTLM
Pass-the-hash exploits NTLM authentication by using a captured hash directly as a credential, bypassing the need to know the plaintext password.
Question 3: Which Windows privilege escalation technique exploits services running with unquoted paths containing spaces?
- DLL hijacking
- Token impersonation
- Unquoted service path exploitation (Correct answer)
- Registry key abuse
Correct answer: Unquoted service path exploitation
When a service executable path with spaces is unquoted, Windows searches each space-delimited path component, allowing an attacker to place a malicious binary in an intermediate directory.
Question 4: What does the term 'lateral movement' mean in the context of a penetration test?
- Escalating privileges on the initially compromised host
- Moving from one compromised system to other systems in the network (Correct answer)
- Pivoting from an internal network to the internet
- Extracting data from a database server
Correct answer: Moving from one compromised system to other systems in the network
Lateral movement refers to techniques used to progressively move through a network after initial compromise, accessing additional hosts and resources.
Question 5: Which tool is most commonly associated with Active Directory enumeration and attack path visualization during internal penetration tests?
- Metasploit
- BloodHound (Correct answer)
- Burp Suite
- OpenVAS
Correct answer: BloodHound
BloodHound collects AD data via SharpHound and visualizes attack paths, identifying the shortest path to Domain Admin through ACL abuse, group memberships, and trust relationships.
Question 6: What distinguishes a credentialed vulnerability scan from an uncredentialed scan?
- Credentialed scans are performed from outside the network perimeter
- Credentialed scans authenticate to target systems and report installed software and patch levels (Correct answer)
- Credentialed scans only test web applications
- Credentialed scans require physical access to the target
Correct answer: Credentialed scans authenticate to target systems and report installed software and patch levels
Credentialed scans log into target systems using provided credentials, allowing them to enumerate installed packages, missing patches, and configuration issues that unauthenticated scans cannot detect.
Question 7: What is the primary purpose of Mimikatz during a Windows penetration test?
- Scanning for open network ports
- Extracting plaintext passwords and hashes from Windows memory (LSASS) (Correct answer)
- Exploiting unpatched kernel vulnerabilities
- Enumerating Active Directory group memberships
Correct answer: Extracting plaintext passwords and hashes from Windows memory (LSASS)
Mimikatz reads credentials including NTLM hashes and, where WDigest is enabled, plaintext passwords from the LSASS process memory on Windows systems.
CPSA Crest 4
What does CVSS Base Score measure in the context of vulnerability assessment?