CREST Cheat Sheet 2026

The 30 highest-yield CREST facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which technique does an attacker use to bypass WAF signature-based XSS detection by encoding the payload as HTML entities within a JavaScript event handler? → Obfuscation through entity encoding
2. What does the term 'attack surface' refer to in security architecture? → The sum of all exploitable entry points and vulnerabilities in a system
3. What document formally defines the scope, objectives, timeline, and legal permissions for a penetration test engagement? → Statement of Work (SoW) / Rules of Engagement
4. During web application testing, a tester injects `' OR '1'='1` into a login form and gains access. Which primary vulnerability class does this represent? → In-band SQL injection
5. Which US government organization operates the National Vulnerability Database (NVD) that stores CVE data? → NIST (National Institute of Standards and Technology)
6. What is the Wayback Machine (web.archive.org) primarily used for during OSINT investigations? → Accessing historical archived snapshots of websites to find previously exposed information
7. What is the difference between white-hat and black-hat hackers? → White-hat hackers secure systems; black-hat hackers exploit them
8. In malware analysis, what is a 'sandbox'? → An isolated virtualized environment for safely executing and observing malware behavior
9. What does 'exploit maturity' refer to in CVSS Temporal metrics? → The availability and reliability of public exploit code for the vulnerability
10. A tester uses Responder to capture NTLMv2 hashes on an internal network. What attack category does this represent? → LLMNR/NBT-NS poisoning
11. What is a key difference between a policy and a procedure in an information security governance framework? → A policy states what must be done; a procedure describes how to do it
12. A CREST tester runs `BloodHound` during an Active Directory assessment. What specific attack path does this tool help identify? → Shortest paths to Domain Admin via ACL relationships and group memberships
13. An SSRF vulnerability is confirmed on an internal cloud-hosted application. Which internal resource is the attacker most likely to target first? → The cloud metadata service (e.g., 169.254.169.254)
14. Which CREST code of conduct principle requires members to report discovered vulnerabilities responsibly and not exploit them beyond what is authorized? → Ethical behavior and integrity
15. When imaging a suspect disk for forensic analysis, which action ensures the integrity of the evidence and allows verification later? → Creating a forensic image and generating MD5/SHA-256 hashes of both source and image
16. What is the function of a firewall in network security? → It filters network traffic based on security rules
17. What is the primary goal of the 'lateral movement' phase in a penetration test? → Moving from the compromised host to other systems within the network
18. What is penetration testing? → Simulating attacks on a system to identify vulnerabilities
19. What is the primary goal of threat hunting in a security operations context? → Proactively searching for hidden threats that evade automated detection
20. During a cloud penetration test, what technique involves querying the AWS metadata service from a compromised EC2 instance to obtain temporary credentials? → Instance Metadata Service (IMDS) credential harvesting
21. How can organizations prioritize vulnerabilities? → By assessing impact and exploitability
22. Which vulnerability scanning technique involves providing valid credentials to the scanner to enumerate installed software versions? → Credentialed (authenticated) scanning
23. What legal doctrine allows security researchers to bypass technical protection measures for good-faith security research under the DMCA? → Section 1201 exemption for good-faith security research
24. What is the main goal of web application security? → To protect against malicious attacks targeting web applications
25. What is the purpose of encryption in web application security? → It protects data confidentiality by converting it into unreadable format
26. In penetration testing methodology, what term describes gathering information about a target exclusively from public sources before active testing begins? → Footprinting
27. What is the significance of risk assessments in vulnerability management? → Risk assessments help prioritize vulnerabilities
28. A tester performs a Kerberoasting attack against an Active Directory environment. What artifact is extracted and attacked offline? → TGS ticket encrypted with the service account's password hash
29. What is the primary purpose of a CREST penetration testing report's executive summary section? → Communicate risk and business impact to non-technical stakeholders
30. Which tool is specifically designed to extract and analyze metadata from publicly available documents to profile organizations? → FOCA (Fingerprinting Organizations with Collected Archives)