CPSA Crest 5

Question 1

What is the primary purpose of defining scope before a CREST penetration test engagement?

Accepted Answer

To legally and operationally bound the systems the tester is authorized to target

Answer

Scope definition establishes the legal authorization boundary, protecting both the tester and client by clearly specifying which systems, networks, and applications are in scope.

Question 2

In a CREST penetration test report, what is the primary audience and purpose of the Executive Summary?

Accepted Answer

Senior management who need a business-risk overview without technical detail

Answer

The Executive Summary communicates overall risk posture, business impact, and strategic recommendations in non-technical language suited for C-level and board-level readers.

Question 3

What is the difference between a vulnerability assessment and a penetration test?

Accepted Answer

A vulnerability assessment identifies weaknesses without exploiting them; a penetration test actively exploits findings to demonstrate impact

Answer

Vulnerability assessments enumerate potential weaknesses, while penetration tests go further by actively exploiting vulnerabilities to prove real-world impact and chain attack paths.

Question 4

What does PTES (Penetration Testing Execution Standard) define?

Accepted Answer

A technical standard framework covering the full lifecycle of penetration testing from pre-engagement to reporting

Answer

PTES provides a structured methodology covering seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.

Question 5

Which factor should be weighted most heavily when determining the severity rating of a finding in a penetration test report?

Accepted Answer

The combination of likelihood of exploitation and potential business impact

Answer

Severity ratings should reflect both exploitability and the real-world impact on the organization's confidentiality, integrity, and availability if exploited.

CPSA Exam Practice Test

CPSA Exam Practice Test

CPSA Crest 5