Question 1: What is the purpose of a Threat Intelligence Report's 'executive summary' section?

• To provide step-by-step remediation scripts
• To provide raw IoC feeds for SIEM ingestion
• To list CVE numbers and CVSS scores
• To communicate key findings and business risk in non-technical terms for leadership (Correct answer)

Correct answer: To communicate key findings and business risk in non-technical terms for leadership

The executive summary translates technical threat findings into business risk language to help executives make informed resource allocation and security decisions.

Question 2: What is the primary goal of ethical hacking?

• To improve security by finding and fixing vulnerabilities (Correct answer)
• To install harmful software.
• To sell system weaknesses to hackers.
• To harm a system.

Correct answer: To improve security by finding and fixing vulnerabilities

The primary goal of ethical hacking is to enhance an organization's cybersecurity defenses. Ethical hackers, often called "white-hat" hackers, use their skills to legally and ethically penetrate systems, identify vulnerabilities, and report them to the organization. This allows the organization to patch weaknesses and strengthen its security posture before malicious "black-hat" hackers can exploit them.

Question 3: What is the first step in incident response?

• Informing the public.
• Identifying and confirming the incident (Correct answer)
• Shutting down the system immediately.
• Ignoring the incident and waiting.

Correct answer: Identifying and confirming the incident

The first and most critical step in incident response is to accurately identify and confirm that an actual security incident has occurred. This involves detecting anomalies, gathering initial evidence, and verifying the nature and scope of the potential breach. Without proper identification, an organization cannot effectively contain, eradicate, or recover from the incident, making this foundational for all subsequent response activities.

Question 4: Which principle of professional ethics requires a CREST assessor to disclose any conflicts of interest before accepting an engagement?

• Competence
• Confidentiality
• Due diligence
• Objectivity and independence (Correct answer)

Correct answer: Objectivity and independence

Objectivity and independence requires testers to disclose relationships or interests that could impair their impartial judgment before undertaking an assessment.

Question 5: What should a CREST tester do immediately upon discovering evidence of an active criminal intrusion during an authorized engagement?

• Stop testing and escalate to the client's incident response contact immediately (Correct answer)
• Post findings to a public disclosure platform
• Continue testing and document findings in the final report
• Attempt to remove the attacker from the system

Correct answer: Stop testing and escalate to the client's incident response contact immediately

Discovering an active third-party intrusion requires immediate escalation to the client's designated emergency contact to initiate incident response without destroying evidence.

Question 6: During a social engineering assessment, a tester sends a phishing email with a credential harvesting link. Under CREST guidelines, what must the tester obtain before conducting this activity?

• CREST examiner sign-off on the phishing template
• Approval from the target employees' HR department
• Written authorization explicitly including social engineering in the scope (Correct answer)
• Verbal approval from the security team lead

Correct answer: Written authorization explicitly including social engineering in the scope

Social engineering attacks require explicit written authorization in the rules of engagement, as targeting employees introduces legal and ethical considerations beyond standard technical testing.

Question 7: Which of the following best describes a key risk indicator (KRI)?

• A post-incident report describing root causes
• A list of known vulnerabilities in a system
• A compliance checklist for regulatory audits
• A metric that signals increasing risk exposure before an incident occurs (Correct answer)

Correct answer: A metric that signals increasing risk exposure before an incident occurs

KRIs are forward-looking metrics that provide early warning signals when risk levels are approaching or exceeding acceptable thresholds.

Question 8: What is Dynamic Application Security Testing (DAST)?

• Scanning container images for known CVEs
• Testing a running application from the outside by sending malicious inputs and analyzing responses (Correct answer)
• Monitoring production traffic for anomalies
• Reviewing source code manually for security flaws

Correct answer: Testing a running application from the outside by sending malicious inputs and analyzing responses

DAST tests a running application by simulating attacks from an external perspective, identifying runtime vulnerabilities like XSS, injection, and authentication flaws.

Question 9: Which attack technique involves exploiting overly permissive IAM roles or policies in AWS to escalate privileges?

• SQL injection
• Cross-Site Request Forgery
• ARP spoofing
• IAM privilege escalation via misconfigured roles or policies (Correct answer)

Correct answer: IAM privilege escalation via misconfigured roles or policies

Overly permissive IAM policies (e.g., iam:PassRole, sts:AssumeRole) can be exploited by attackers to escalate privileges or assume higher-privileged roles within AWS.

Question 10: Which tool is specifically designed to extract and analyze metadata from publicly available documents to profile organizations?

• OpenVAS
• FOCA (Fingerprinting Organizations with Collected Archives) (Correct answer)
• Nessus
• Hydra

Correct answer: FOCA (Fingerprinting Organizations with Collected Archives)

FOCA is a tool that extracts metadata from documents found on the internet to reveal information about the target organization's internal structure and technology.

Question 11: In a black-box test, you find an endpoint that returns different HTTP status codes (200 vs 302) depending on whether a username exists. What vulnerability does this illustrate?

• Session fixation
• Username enumeration via differential response (Correct answer)
• Insecure Direct Object Reference on user records
• Broken authentication due to missing rate limiting

Correct answer: Username enumeration via differential response

Differential responses (status codes, response times, or body content) based on whether a username exists allow attackers to enumerate valid accounts.

Question 12: Which component of a forensic report is specifically intended to convey findings to non-technical stakeholders such as legal counsel or senior management?

• Executive summary (Correct answer)
• Chain of custody documentation
• IOC indicator list
• Technical appendix with raw log extracts

Correct answer: Executive summary

The executive summary distills key findings, impact, and recommendations into accessible language for non-technical audiences, avoiding deep technical detail.

Question 13: When testing for LDAP injection, which characters should a tester attempt to inject to break out of filter expressions?

• Semicolons and URL-encoded null bytes: ; %00
• Single quotes and double dashes: ' --
• Angle brackets and ampersands: < > &
• Parentheses, asterisks, and backslashes: ( ) * \ (Correct answer)

Correct answer: Parentheses, asterisks, and backslashes: ( ) * \

LDAP filter syntax uses parentheses to delimit expressions, asterisks as wildcards, and backslashes for escaping, making these the primary injection characters.

Question 14: Which protocol uses asymmetric cryptography during its handshake to establish a symmetric session key?

• TLS (Correct answer)
• FTP
• Telnet
• HTTP

Correct answer: TLS

TLS uses asymmetric cryptography in its handshake phase to securely exchange or derive a symmetric session key for the rest of the session.

Question 15: What does the NIST Cybersecurity Framework (CSF) organize its functions around?

• Prevent, Detect, Correct
• Plan, Do, Check, Act
• Identify, Protect, Detect, Respond, Recover (Correct answer)
• Classify, Assess, Mitigate, Monitor

Correct answer: Identify, Protect, Detect, Respond, Recover

The NIST CSF organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 16: Why must penetration test reports be handled and transmitted securely using encryption?

• It is required by copyright law
• CREST requires PDF format only
• Encryption speeds up email delivery
• Reports contain vulnerability details that could enable attacks if intercepted (Correct answer)

Correct answer: Reports contain vulnerability details that could enable attacks if intercepted

Penetration test reports contain detailed vulnerability information and exploitation techniques that could be weaponized if intercepted by unauthorized parties.

Question 17: During web application testing, a tester injects `' OR '1'='1` into a login form and gains access. Which primary vulnerability class does this represent?

• In-band SQL injection (Correct answer)
• Blind SQL injection
• Second-order SQL injection
• Error-based SQL injection

Correct answer: In-band SQL injection

Classic login bypass via OR condition is in-band SQL injection because the result of the injected query is returned directly in the application response.

Question 18: Which US government organization operates the National Vulnerability Database (NVD) that stores CVE data?

• NSA
• DHS
• CISA
• NIST (National Institute of Standards and Technology) (Correct answer)

Correct answer: NIST (National Institute of Standards and Technology)

NIST maintains the NVD, which enriches CVE entries with CVSS scores, affected software versions, and remediation guidance.

Question 19: Which technique involves querying historical DNS resolution data to find IP addresses previously associated with a domain?

• Reverse DNS scanning
• Active DNS brute-forcing
• Passive DNS analysis (Correct answer)
• Zone transfer enumeration

Correct answer: Passive DNS analysis

Passive DNS analysis queries databases of historical DNS records to find IP addresses a domain has resolved to over time, without sending queries to the target's DNS servers.

Question 20: What does the concept of 'due diligence' mean in an information security governance context?

• Performing daily vulnerability scans
• Completing annual security awareness training
• Proactively researching and understanding security risks before making decisions (Correct answer)
• Reacting quickly to security incidents as they occur

Correct answer: Proactively researching and understanding security risks before making decisions

Due diligence in information security means taking reasonable steps to understand risks and obligations before undertaking actions that could affect security posture.

Question 21: Why is penetration testing essential for organizations?

• It guarantees that no system failures will occur.
• It helps identify security weaknesses before they are exploited.
• It ensures compliance with privacy laws.
• It optimizes network performance.

Penetration testing is essential for organizations because it proactively uncovers security vulnerabilities and weaknesses within their systems, applications, and networks. By simulating real-world attacks, it allows organizations to understand their exposure to threats and address these issues before malicious actors can exploit them. This significantly reduces the risk of data breaches and cyberattacks.

Question 22: An attacker used 'certutil.exe -decode encoded.txt malware.exe' on a compromised host. What technique does this represent?

• Pass-the-hash attack
• Process hollowing
• DLL hijacking
• Living off the Land (LotL) using a trusted Windows binary (Correct answer)

Correct answer: Living off the Land (LotL) using a trusted Windows binary

Using certutil.exe (a legitimate Windows certificate utility) to decode and drop malware is a classic Living off the Land technique that abuses trusted binaries to evade detection.

Question 23: What does certificate pinning protect against?

• SSL stripping attacks
• Session fixation
• Fraudulent certificates issued by rogue or compromised CAs (Correct answer)
• Weak cipher suite negotiation

Correct answer: Fraudulent certificates issued by rogue or compromised CAs

Certificate pinning ties an application to a specific certificate or public key, preventing trust in valid-but-fraudulent certificates from other CAs.

Question 24: Which framework classifies adversary tactics and techniques and is widely used to map vulnerabilities to real-world attacker behavior?

• MITRE ATT&CK (Correct answer)
• OWASP Testing Guide
• NIST CSF
• CIS Controls

Correct answer: MITRE ATT&CK

MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques based on real-world observations, enabling threat-informed vulnerability prioritization.

Question 25: Which CIS Control focuses specifically on continuous vulnerability management?

• CIS Control 1: Inventory of Enterprise Assets
• CIS Control 13: Network Monitoring and Defense
• CIS Control 18: Penetration Testing
• CIS Control 7: Continuous Vulnerability Management (Correct answer)

Correct answer: CIS Control 7: Continuous Vulnerability Management

CIS Control 7 prescribes continuous processes for scanning, prioritizing, and remediating vulnerabilities to reduce attacker dwell time.

Question 26: What is the purpose of OCSP (Online Certificate Status Protocol)?

• To negotiate cipher suites
• To check the real-time revocation status of a certificate (Correct answer)
• To generate new SSL certificates
• To distribute root CA certificates

Correct answer: To check the real-time revocation status of a certificate

OCSP allows clients to query a responder in real time to determine whether a specific certificate has been revoked.

Question 27: Which threat intelligence category focuses on understanding adversary motivations, capabilities, and strategic intentions?

• Operational intelligence
• Technical intelligence
• Tactical intelligence
• Strategic intelligence (Correct answer)

Correct answer: Strategic intelligence

Strategic intelligence provides high-level insights about threat actor motivations, geopolitical factors, and long-term adversary campaigns intended for executive decision-making.

Question 28: What is the key difference between a vulnerability assessment and a penetration test in a professional engagement context?

• Vulnerability assessments require CREST certification
• Penetration tests are automated only
• Vulnerability assessments cost more
• Penetration tests actively exploit vulnerabilities to prove impact, while assessments only identify them (Correct answer)

Correct answer: Penetration tests actively exploit vulnerabilities to prove impact, while assessments only identify them

A vulnerability assessment identifies and classifies weaknesses without exploitation, while a penetration test actively exploits them to demonstrate real-world risk and business impact.

Question 29: A penetration tester is performing a wireless assessment and identifies a network using WPA2-Personal. What is the most effective offline attack against captured 4-way handshakes?

• PMKID attack
• Dictionary/brute-force against captured handshake (Correct answer)
• Evil twin AP
• Deauth flood

Correct answer: Dictionary/brute-force against captured handshake

Captured WPA2-Personal 4-way handshakes can be attacked offline using dictionary or brute-force tools like hashcat against the PBKDF2-derived PMK.

Question 30: What does a CREST assessment of containerized infrastructure (Docker/Kubernetes) typically examine?

• Only web application vulnerabilities within containers
• Container escape vulnerabilities, privileged container misconfigurations, exposed Docker sockets, and RBAC weaknesses in Kubernetes (Correct answer)
• Only network-level security between pods
• Licensing compliance of container images

Correct answer: Container escape vulnerabilities, privileged container misconfigurations, exposed Docker sockets, and RBAC weaknesses in Kubernetes

Container security assessments focus on privileged containers, exposed Docker sockets, image vulnerabilities, Kubernetes RBAC misconfigurations, and container escape techniques.

Question 31: Which concept in secure architecture design recommends exposing only necessary functionality through well-defined interfaces while hiding implementation details?

• Encapsulation and minimizing attack surface (Correct answer)
• Open design
• Full disclosure
• Security through obscurity

Correct answer: Encapsulation and minimizing attack surface

Encapsulation hides internal implementation and exposes only required functionality, reducing the number of exploitable interfaces and limiting the attack surface.

Question 32: What is Static Application Security Testing (SAST)?

• Testing a running application for vulnerabilities via simulated attacks
• Scanning network infrastructure for exposed services
• Reviewing application logs for signs of exploitation
• Analyzing source code, bytecode, or binaries for security vulnerabilities without executing the application (Correct answer)

Correct answer: Analyzing source code, bytecode, or binaries for security vulnerabilities without executing the application

SAST examines application code at rest to identify security vulnerabilities like injection flaws, insecure functions, and hardcoded secrets before the application is deployed.

Question 33: During a CREST practical examination scenario, you must preserve evidence from a running virtual machine without powering it off. Which approach best achieves a forensically sound memory capture?

• Take a hypervisor-level snapshot and export the .vmem or .vmsn file (Correct answer)
• Copy all running process executables from /proc/PID/exe
• Run 'strings /dev/mem > mem.txt' to capture memory content
• Use WinPmem on the host OS to capture guest VM memory

Correct answer: Take a hypervisor-level snapshot and export the .vmem or .vmsn file

A hypervisor snapshot exports the guest's full memory state (vmem/vmsn files) without interrupting execution, providing a forensically sound, complete memory image of the running VM.

Question 34: What does the principle of 'security by default' mean in application development?

• All default passwords are set to 'admin'
• Applications ship with the most secure configuration enabled out of the box (Correct answer)
• Developers must manually enable security features before deployment
• Security features are optional add-ons for enterprise customers

Correct answer: Applications ship with the most secure configuration enabled out of the box

Security by default means that the default configuration of an application is the most secure one, requiring deliberate action to reduce security rather than to increase it.

Question 35: Which HTTP method should be used for operations that change server state, and why is GET inappropriate for such operations?

• POST/PUT/DELETE should be used; GET requests can be triggered unintentionally via links and CSRF attacks (Correct answer)
• OPTIONS should be used; it supports all content types
• HEAD should be used; it prevents data logging
• GET should be used; it is faster and requires no authentication

Correct answer: POST/PUT/DELETE should be used; GET requests can be triggered unintentionally via links and CSRF attacks

State-changing operations must use POST, PUT, or DELETE because GET requests can be triggered by embedded links, browser pre-fetching, or CSRF attacks without user intent.

Question 36: Which US compliance standard specifically governs the security of cardholder data for payment card processing?

• HIPAA
• FISMA
• PCI DSS (Correct answer)
• SOX

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for any organization that stores, processes, or transmits payment card data.

Question 37: What does a CREST-registered organization commit to in terms of professional standards?

• Using only CREST-approved software tools
• Submitting annual financial audits to CREST
• Employing certified professionals who have passed rigorous technical examinations and adhere to a code of conduct (Correct answer)
• Completing monthly vulnerability scans of client infrastructure

Correct answer: Employing certified professionals who have passed rigorous technical examinations and adhere to a code of conduct

CREST membership requires organizations to employ certified professionals, demonstrate technical competence, and operate under CREST's code of conduct and professional standards.

Question 38: In the SANS IR lifecycle, which phase immediately follows 'Identification' and focuses on limiting the spread of a compromise?

• Recovery
• Containment (Correct answer)
• Eradication
• Lessons Learned

Correct answer: Containment

Containment follows Identification and focuses on isolating affected systems to prevent further spread before eradication begins.

Question 39: What is the significance of the MITRE ATT&CK 'Initial Access' tactic category?

• It details how adversaries exfiltrate data
• It describes how attackers cover their tracks after an attack
• It describes how adversaries first gain a foothold in a target environment (Correct answer)
• It covers the tools attackers use for lateral movement

Correct answer: It describes how adversaries first gain a foothold in a target environment

The Initial Access tactic in ATT&CK covers techniques adversaries use to enter a target network, such as phishing, exploiting public-facing applications, or using valid accounts.

Question 40: Which regulation requires US federal agencies to implement information security programs and report on their effectiveness?

• GLBA
• HIPAA
• FERPA
• FISMA (Federal Information Security Modernization Act) (Correct answer)

Correct answer: FISMA (Federal Information Security Modernization Act)

FISMA requires federal agencies to develop, document, and implement information security programs and report annually to Congress on their security posture.

Question 41: What is a race condition vulnerability in application code?

• When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity (Correct answer)
• When an application consumes excessive CPU under load
• When a loop runs without a proper exit condition
• When two threads access the same database record simultaneously causing data corruption

Correct answer: When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity

A race condition occurs when security checks and the use of a resource are not atomic, allowing an attacker to change state between the check and the use (TOCTOU — time-of-check to time-of-use).

Question 42: What distinguishes a 'grey-box' penetration test from black-box and white-box approaches?

• The tester has full source code access but no network credentials
• The tester operates without any prior knowledge of the target
• The tester has complete access to all documentation, source code, and configurations
• The tester has partial knowledge such as credentials or architecture diagrams but not full system access (Correct answer)

Correct answer: The tester has partial knowledge such as credentials or architecture diagrams but not full system access

Grey-box testing simulates an insider threat or compromised credential scenario by providing limited information like user credentials or network diagrams.

Question 43: What is the difference between white-hat and black-hat hackers?

• Black-hat hackers work ethically.
• White-hat hackers hack for profit.
• White-hat hackers secure systems; black-hat hackers exploit them (Correct answer)
• There is no difference.

Correct answer: White-hat hackers secure systems; black-hat hackers exploit them

The key difference between white-hat and black-hat hackers lies in their intent and legality. White-hat hackers are ethical security professionals who use their skills to identify and fix vulnerabilities with permission, thereby securing systems. In contrast, black-hat hackers are malicious actors who exploit vulnerabilities for personal gain, disruption, or other illegal activities, often causing harm.

Question 44: In a vulnerability management program, what is the purpose of a 'vulnerability exception' process?

• To permanently remove a vulnerability from the scanner database
• To automatically escalate vulnerabilities to the CISO
• To formally document, approve, and track vulnerabilities that cannot be remediated within standard SLA timelines (Correct answer)
• To notify regulatory bodies of compliance gaps

Correct answer: To formally document, approve, and track vulnerabilities that cannot be remediated within standard SLA timelines

An exception process provides governance around accepted deviations, ensuring each unpatched vulnerability has documented justification, approvals, compensating controls, and a review date.

Question 45: What is 'living off the land' (LotL) in the context of post-exploitation during a penetration test?

• Maintaining persistence through legitimate scheduled tasks only
• Exfiltrating data through legitimate cloud storage services
• Using open-source offensive tools downloaded from GitHub
• Leveraging legitimate system binaries and built-in tools to avoid detection (Correct answer)

Correct answer: Leveraging legitimate system binaries and built-in tools to avoid detection

LotL techniques use trusted system tools like PowerShell, WMI, certutil, or mshta to perform malicious actions, reducing the attacker's footprint and evading signature-based detection.

Question 46: An attacker used Mimikatz's 'sekurlsa::logonpasswords' module on a target host. What Windows feature, when enabled, significantly reduces the effectiveness of this technique?

• BitLocker full-disk encryption
• Windows Firewall with Advanced Security
• Credential Guard using Virtualization-Based Security (VBS) (Correct answer)
• AppLocker application whitelisting

Correct answer: Credential Guard using Virtualization-Based Security (VBS)

Windows Credential Guard uses VBS to isolate LSASS credentials in a protected hypervisor environment, preventing tools like Mimikatz from extracting plaintext passwords or hashes.

Question 47: What does the term 'security debt' refer to in software development?

• Accumulated security flaws and unaddressed vulnerabilities resulting from prioritizing features over security (Correct answer)
• Outstanding security invoices from third-party vendors
• Unpaid bug bounty rewards
• The cost of purchasing security tools and licenses

Correct answer: Accumulated security flaws and unaddressed vulnerabilities resulting from prioritizing features over security

Security debt accumulates when teams defer fixing security issues to ship faster, creating a growing backlog of vulnerabilities that increases risk over time.

Question 48: What is SQL injection and how is it primarily prevented?

• It overflows a database buffer; prevented by input length limits
• It replays old database transactions; prevented by session tokens
• It inserts malicious SQL into queries; prevented by using parameterized queries or prepared statements (Correct answer)
• It encrypts database queries; prevented by disabling encryption

Correct answer: It inserts malicious SQL into queries; prevented by using parameterized queries or prepared statements

SQL injection manipulates database queries by inserting malicious SQL via unsanitized input; parameterized queries separate code from data, preventing the injection.

Question 49: Which AWS service provides centralized logging of all API calls made to AWS services for security auditing?

• AWS CloudTrail (Correct answer)
• AWS Config
• AWS Inspector
• AWS GuardDuty

Correct answer: AWS CloudTrail

AWS CloudTrail records all API calls across AWS services, providing an audit trail for security investigations, compliance, and detecting unauthorized activity.

Question 50: Which forensic artifact on Windows records a mapping between a shortcut file and its target, including volume serial number and timestamps, even if the target file is later deleted?

• LNK (Shell Link) files (Correct answer)
• VSS Shadow Copies
• Recycle Bin $I files
• Jump Lists

Correct answer: LNK (Shell Link) files

Windows LNK files embed metadata about the target including its MAC timestamps, volume serial number, and original path — even after the target is removed.

Question 51: What does the OWASP ASVS (Application Security Verification Standard) provide?

• A list of the top 10 most critical web application vulnerabilities
• A scoring system for rating web application penetration tests
• A framework of security requirements for designing, developing, and testing secure web applications (Correct answer)
• A certification program for web application developers

Correct answer: A framework of security requirements for designing, developing, and testing secure web applications

OWASP ASVS defines three levels of security verification requirements that organizations can use as a baseline for application security testing and development standards.

Question 52: What is the primary purpose of a Certificate Authority (CA) in PKI?

• To store private keys for users
• To hash passwords
• To issue and sign digital certificates (Correct answer)
• To encrypt network traffic

Correct answer: To issue and sign digital certificates

A Certificate Authority issues and digitally signs certificates, binding public keys to identities and establishing trust.

Question 53: An SSRF vulnerability is confirmed on an internal cloud-hosted application. Which internal resource is the attacker most likely to target first?

• The cloud metadata service (e.g., 169.254.169.254) (Correct answer)
• The corporate SMTP relay
• The application's own web server on localhost
• The external CDN endpoint

Correct answer: The cloud metadata service (e.g., 169.254.169.254)

Cloud metadata services at 169.254.169.254 expose IAM credentials and instance information, making them the highest-value SSRF target in cloud environments.

Question 54: What is a 'rootkit' and what makes it particularly challenging to detect?

• Malware that hides itself by modifying OS components, making it invisible to standard detection tools running on the infected system (Correct answer)
• A worm that spreads via root accounts; detectable only by reviewing user logs
• Malware that creates a botnet; challenging because it has many nodes
• Malware targeting router firmware; undetectable by host tools

Correct answer: Malware that hides itself by modifying OS components, making it invisible to standard detection tools running on the infected system

A rootkit intercepts and modifies OS APIs and kernel structures to hide processes, files, and network connections from tools running on the compromised system.

Question 55: Which threat modeling framework uses the acronym STRIDE to categorize threat types?

• OWASP SAMM
• Microsoft STRIDE model (Correct answer)
• FAIR model
• NIST RMF

Correct answer: Microsoft STRIDE model

Microsoft's STRIDE model categorizes threats as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Question 56: Which log source on a Windows system specifically records successful and failed authentication events along with the source IP address?

• System event log
• Application event log
• Security event log (Correct answer)
• PowerShell operational log

Correct answer: Security event log

The Windows Security event log records logon events (Event IDs 4624, 4625) including source IP, logon type, and account name.

Question 57: What is the purpose of analyzing the Import Address Table (IAT) of a Windows PE malware sample?

• To identify the compiler used to build the malware
• To extract network packet captures
• To understand which Windows API functions the malware calls, revealing its capabilities (Correct answer)
• To find hardcoded encryption keys

Correct answer: To understand which Windows API functions the malware calls, revealing its capabilities

The IAT lists Windows API functions a binary imports; analyzing it reveals capabilities like file system manipulation, registry access, network connectivity, and process injection.

Question 58: What does the CVSS temporal score metric 'Exploit Code Maturity' value 'Proof-of-Concept' indicate?

• Functional exploit code is publicly available but unreliable (Correct answer)
• No exploit exists yet
• Exploit is fully automated and reliable
• Exploit is available only through private channels

Correct answer: Functional exploit code is publicly available but unreliable

Proof-of-Concept maturity means working exploit code exists but may not be reliable enough for consistent exploitation in all scenarios.

Question 59: Which risk assessment methodology is commonly used in US government contexts and aligns with NIST SP 800-30?

• NIST Risk Management Framework (RMF) (Correct answer)
• FAIR
• CRAMM
• OCTAVE

Correct answer: NIST Risk Management Framework (RMF)

The NIST RMF and NIST SP 800-30 provide a structured risk assessment process used across US federal agencies to categorize, select, implement, and monitor security controls.

Question 60: Which OWASP Top 10 category covers security misconfigurations such as default credentials and open cloud storage buckets?

• A03: Injection
• A01: Broken Access Control
• A07: Identification and Authentication Failures
• A05: Security Misconfiguration (Correct answer)

Correct answer: A05: Security Misconfiguration

OWASP A05 Security Misconfiguration encompasses improperly configured security settings, default credentials, unnecessary features, and misconfigured cloud services.

Question 61: Which threat intelligence sharing standard uses a structured language to describe cyber threat information in a machine-readable format?

• CVSS
• OVAL
• SCAP
• STIX (Structured Threat Information eXpression) (Correct answer)

Correct answer: STIX (Structured Threat Information eXpression)

STIX is a standardized language for describing CTI content in a structured, machine-readable way that enables automated sharing and analysis of threat data.

Question 62: Under PCI DSS, how often must external penetration testing be performed on cardholder data environments?

• Quarterly
• Every two years
• At least annually and after significant infrastructure changes (Correct answer)
• Monthly

Correct answer: At least annually and after significant infrastructure changes

PCI DSS Requirement 11.4 mandates external and internal penetration testing at least once per year and after any significant infrastructure or application upgrade.

Question 63: Which concept in threat intelligence describes the relative difficulty for defenders to detect and respond to different types of indicators?

• The Pyramid of Pain (Correct answer)
• The Diamond Model
• ATT&CK Navigator
• The Kill Chain

Correct answer: The Pyramid of Pain

The Pyramid of Pain ranks IoC types by how painful it is for attackers if defenders detect and block them, from easy-to-change IPs at the bottom to hard-to-change TTPs at the top.

Question 64: What does a 'cloud misconfiguration' vulnerability commonly involve, according to CREST cloud assessment findings?

• Outdated operating system versions on cloud instances
• Slow cloud network performance affecting security tools
• Use of unsupported cloud regions
• Overly permissive security groups, public storage buckets, disabled logging, or unrestricted IAM policies (Correct answer)

Correct answer: Overly permissive security groups, public storage buckets, disabled logging, or unrestricted IAM policies

Cloud misconfigurations—such as public S3 buckets, open security groups (0.0.0.0/0), disabled CloudTrail, and wildcard IAM permissions—are the leading cause of cloud breaches.

Question 65: Which CREST code of conduct principle requires members to report discovered vulnerabilities responsibly and not exploit them beyond what is authorized?

• Commercial competence
• Technical knowledge
• Financial accountability
• Ethical behavior and integrity (Correct answer)

Correct answer: Ethical behavior and integrity

CREST's ethical behavior and integrity principle prohibits members from exploiting vulnerabilities beyond authorized scope or for personal gain.

Question 66: What is the difference between encoding and encryption in the context of secure coding?

• Encoding transforms data for safe use without a key; encryption scrambles data and requires a key to reverse (Correct answer)
• They are identical processes with different names
• Encoding requires a secret key; encryption does not
• Encoding provides confidentiality; encryption only provides integrity

Correct answer: Encoding transforms data for safe use without a key; encryption scrambles data and requires a key to reverse

Encoding (e.g., Base64, URL encoding) transforms data for safe transmission and can be reversed by anyone; encryption requires a secret key to decrypt and provides confidentiality.

Question 67: When analyzing a Windows event log for Pass-the-Hash lateral movement, which Event ID combined with Logon Type 3 and NtLmSsp authentication package is most indicative?

• Event ID 4688 with process creation
• Event ID 4776 with Kerberos auth
• Event ID 7045 with service install
• Event ID 4624 with LogonType 3 and NTLM auth (Correct answer)

Correct answer: Event ID 4624 with LogonType 3 and NTLM auth

Event ID 4624 (Successful Logon) with Logon Type 3 (Network) and the NTLM authentication package is the classic signature of Pass-the-Hash lateral movement.

Question 68: What does perfect forward secrecy (PFS) ensure in TLS?

• All traffic is encrypted with a single master key
• Session keys are never rotated
• Past session keys remain secure even if the long-term private key is compromised (Correct answer)
• Certificates are always pinned

Correct answer: Past session keys remain secure even if the long-term private key is compromised

PFS uses ephemeral key exchange so that compromise of the server's long-term key cannot decrypt previously recorded sessions.

Question 69: In threat intelligence, what does 'attribution' refer to?

• Linking malware samples to specific code repositories
• Documenting which assets were affected in an incident
• Identifying the threat actor or group responsible for a cyberattack (Correct answer)
• Assigning CVSS severity scores to vulnerabilities

Correct answer: Identifying the threat actor or group responsible for a cyberattack

Attribution in CTI is the process of identifying who is behind an attack, using technical, behavioral, and geopolitical evidence to link activity to a specific actor or group.

Question 70: Which secure coding practice helps prevent sensitive data from appearing in application logs?

• Storing all logs in encrypted files
• Disabling all application logging
• Sanitizing and filtering log output to exclude passwords, tokens, and PII (Correct answer)
• Only logging events on production systems

Correct answer: Sanitizing and filtering log output to exclude passwords, tokens, and PII

Secure logging practices ensure sensitive fields like passwords, API keys, and personal data are redacted or masked before being written to log files.

Question 71: During a live incident, a responder notices that a Windows host has an unusual process injecting into lsass.exe. Which tool is best suited to capture a memory dump of that specific process without rebooting?

• ProcDump (Correct answer)
• Volatility
• WinPmem
• dd

Correct answer: ProcDump

ProcDump (Sysinternals) can target a specific process by PID and write a minidump or full dump without requiring a system reboot.

Question 72: An analyst uses 'strings' on a malware sample and finds references to 'cmd.exe /c whoami > C:\Windows\Temp\out.txt'. What tactic does this suggest?

• Discovery and staging of reconnaissance output (Correct answer)
• Command and Control via HTTP beaconing
• Lateral movement via PsExec
• Credential dumping via LSASS

Correct answer: Discovery and staging of reconnaissance output

Running whoami and redirecting output to a temp file indicates the attacker is performing host discovery/enumeration and staging results locally, consistent with the Discovery tactic in MITRE ATT&CK.

Question 73: Which professional standard requires CREST members to maintain and update their technical skills to keep pace with evolving threats?

• Continuing Professional Development (CPD) (Correct answer)
• Bug bounty participation
• Peer review publication requirements
• Annual background checks

Correct answer: Continuing Professional Development (CPD)

CREST's Continuing Professional Development requirement mandates that certified members regularly update their skills through training, research, and professional activities.

Question 74: According to CREST penetration testing methodology, during which phase should OSINT and reconnaissance be conducted?

• Reporting and documentation
• Vulnerability scanning and exploitation
• Pre-engagement and reconnaissance, before active testing begins (Correct answer)
• Post-exploitation and pivoting

Correct answer: Pre-engagement and reconnaissance, before active testing begins

OSINT is conducted during the pre-engagement and reconnaissance phase to build maximum intelligence about the target before any active probing or exploitation begins.

Question 75: Which assessment methodology specifically evaluates an organization's defenses against real-world threat actor TTPs rather than known vulnerability lists?

• Red team assessment / adversary simulation (Correct answer)
• Automated vulnerability scan
• Configuration review
• Compliance audit

Correct answer: Red team assessment / adversary simulation

Red team assessments simulate real-world threat actor TTPs to test an organization's detection, response, and resilience capabilities holistically.

Question 76: A forensic analyst is examining a Linux system and wants to identify files modified within the last 24 hours. Which command is most appropriate?

• lsof -i
• find / -mtime -1 (Correct answer)
• ls -la /
• stat /etc/passwd

Correct answer: find / -mtime -1

The 'find / -mtime -1' command recursively searches the filesystem for files with a modification time within the last 1 day.

Question 77: In threat modeling, what does 'attack surface' refer to?

• The physical size of a data center
• The sum of all points where an attacker can try to enter or extract data from an environment (Correct answer)
• The number of CVEs affecting a system
• The network bandwidth available for attacks

Correct answer: The sum of all points where an attacker can try to enter or extract data from an environment

The attack surface encompasses all exposed entry points—APIs, user inputs, open ports, protocols—that an attacker could potentially exploit.

Question 78: During a physical penetration test engagement, a tester tailgates an employee through a badge-controlled door. What security control is being tested and bypassed?

• Physical access control via mantrap or piggyback prevention (Correct answer)
• CCTV monitoring effectiveness
• Two-factor authentication
• Visitor management system

Correct answer: Physical access control via mantrap or piggyback prevention

Tailgating bypasses physical access controls by exploiting human courtesy, testing whether facilities use mantrap enclosures, security awareness training, or policy enforcement.

Question 79: In the context of CREST examinations, what does 'scoping' a penetration test primarily define?

• The reporting format and remediation timeline
• The classification level of discovered vulnerabilities
• The boundaries, systems, and objectives the test will cover (Correct answer)
• The tools and exploits permitted during testing

Correct answer: The boundaries, systems, and objectives the test will cover

Scoping establishes legal and technical boundaries by identifying target systems, IP ranges, test types, and excluded systems to prevent unauthorized access.

Question 80: What is the Wayback Machine (web.archive.org) primarily used for during OSINT investigations?

• Scanning websites for current security vulnerabilities
• Accessing historical archived snapshots of websites to find previously exposed information (Correct answer)
• Enumerating active directory users from web applications
• Monitoring real-time network traffic from target systems

Correct answer: Accessing historical archived snapshots of websites to find previously exposed information

The Wayback Machine archives historical website snapshots, allowing investigators to find information that was previously public but has since been removed, such as old directories or configuration pages.

Question 81: What is 'metadata harvesting' in the context of OSINT document analysis?

• Collecting database schemas from target systems
• Gathering network topology diagrams from public sources
• Extracting embedded information such as author names, software versions, and GPS coordinates from files (Correct answer)
• Enumerating email server configuration details

Correct answer: Extracting embedded information such as author names, software versions, and GPS coordinates from files

Metadata harvesting extracts hidden embedded information from documents and images, including author details, software used, timestamps, and sometimes GPS coordinates.

Question 82: Under the US Computer Fraud and Abuse Act (CFAA), what is the primary legal requirement before conducting a penetration test?

• Registering with a government agency
• Filing a report with the FBI
• Completing a CREST certification
• Obtaining written authorization from the system owner (Correct answer)

Correct answer: Obtaining written authorization from the system owner

The CFAA prohibits unauthorized access to computer systems, so written authorization from the system owner is legally required before any penetration testing.

Question 83: What is the primary purpose of an Information Security Management System (ISMS) as defined by ISO/IEC 27001?

• To automate vulnerability scanning across all systems
• To define software development lifecycle processes
• To manage employee security awareness training
• To establish, implement, maintain, and continually improve information security controls (Correct answer)

Correct answer: To establish, implement, maintain, and continually improve information security controls

ISO/IEC 27001 defines an ISMS as a systematic approach to managing sensitive information to keep it secure, covering people, processes, and IT systems.

Question 84: What is Cross-Site Scripting (XSS) and which type allows attackers to store malicious scripts on the server?

• XSS injects malicious scripts into web pages; stored XSS persists scripts on the server (Correct answer)
• XSS modifies HTTP headers; DOM XSS stores them in cookies
• XSS steals server-side session tokens; reflected XSS stores them
• XSS overwrites database records; blind XSS persists them

Correct answer: XSS injects malicious scripts into web pages; stored XSS persists scripts on the server

XSS injects client-side scripts into pages viewed by other users; stored (persistent) XSS saves the malicious script on the server so it executes for every visitor.

Question 85: An analyst is reviewing a PCAP and notices beaconing traffic on port 443 to an external IP with jitter of ±10%. What does the jitter most likely indicate?

• A misconfigured NTP client
• A DDoS amplification attack
• Normal HTTPS certificate renewal
• C2 framework using sleep with jitter to evade detection (Correct answer)

Correct answer: C2 framework using sleep with jitter to evade detection

Modern C2 frameworks deliberately introduce jitter (random variance in beacon intervals) to avoid pattern-based network detection.

Question 86: What does 'exploit maturity' refer to in CVSS Temporal metrics?

• The number of organizations affected by the vulnerability
• The time remaining before a vendor patch is released
• The availability and reliability of public exploit code for the vulnerability (Correct answer)
• How long a vulnerability has been known

Correct answer: The availability and reliability of public exploit code for the vulnerability

Exploit Code Maturity (E) in CVSS Temporal metrics reflects whether working exploit code exists publicly, which directly raises the likelihood of exploitation.

Question 87: In the context of IR triage, what is the primary purpose of running 'vol.py -f memory.dmp windows.pstree' during a Volatility analysis session?

• Display all open registry hives
• List all loaded kernel drivers
• Show the process hierarchy to identify suspicious parent-child relationships (Correct answer)
• Extract network packet captures from memory

Correct answer: Show the process hierarchy to identify suspicious parent-child relationships

The pstree plugin reveals parent-child process relationships, helping analysts spot anomalies like cmd.exe spawned by a browser or lsass.exe launching unexpected children.

Question 88: A vulnerability is discovered in a third-party library bundled with an internal application. What is the FIRST step in the remediation workflow?

• Disable the application until the vendor responds
• Identify all applications that include the affected library version (Correct answer)
• Notify the vendor and await an official patch
• Patch the library immediately in production

Correct answer: Identify all applications that include the affected library version

Before any remediation action, the scope of impact must be established by inventorying all systems that contain the vulnerable component.

Question 89: A penetration tester identifies a vulnerability rated CVSS 9.8 on a system that is not internet-facing and has network-level controls limiting access. Which factor most justifies lowering remediation priority?

• The CVSS base score is provisional
• The vendor has not issued a patch
• The system owner disagrees with the finding
• Environmental and network mitigating controls reduce practical exploitability (Correct answer)

Correct answer: Environmental and network mitigating controls reduce practical exploitability

CVSS Environmental metrics allow organizations to adjust scores based on real-world controls, reducing effective risk when compensating mitigations exist.

Question 90: A tester captures a TLS session and attempts to decrypt traffic using a pre-master secret log. Which tool facilitates this analysis?

• Metasploit's auxiliary/sniffer
• Burp Suite's intruder
• John the Ripper
• Wireshark with SSLKEYLOGFILE (Correct answer)

Correct answer: Wireshark with SSLKEYLOGFILE

Wireshark supports decryption of TLS sessions when provided a pre-master secret log file via the SSLKEYLOGFILE environment variable exported by the browser or application.

Question 91: What type of malware encrypts victim files and demands payment for decryption keys?

• Worm
• Rootkit
• Ransomware (Correct answer)
• Spyware

Correct answer: Ransomware

Ransomware encrypts victim files using strong cryptography and demands ransom payment, typically in cryptocurrency, in exchange for the decryption key.

Question 92: What is a buffer overflow vulnerability?

• When a log file grows too large and overwrites system disk space
• When more data is written to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution (Correct answer)
• When a database query returns more rows than the application expects
• When a network buffer queue exceeds its maximum capacity

Correct answer: When more data is written to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution

Buffer overflows occur when input exceeds the allocated memory buffer, overwriting adjacent data or return addresses, which can redirect execution to attacker-controlled code.

Question 93: Which MITRE ATT&CK technique involves an adversary injecting code into a legitimate running process to evade process-based defenses and execute under a trusted context?

• T1053 – Scheduled Task/Job
• T1021 – Remote Services
• T1055 – Process Injection (Correct answer)
• T1078 – Valid Accounts

Correct answer: T1055 – Process Injection

T1055 (Process Injection) covers techniques like DLL injection, process hollowing, and reflective loading that execute attacker code within the memory space of a legitimate process.

Question 94: What is defense in depth?

• Using a single highly secure firewall
• Conducting regular penetration tests
• Layering multiple security controls so that failure of one does not compromise the whole system (Correct answer)
• Encrypting all data at rest and in transit

Correct answer: Layering multiple security controls so that failure of one does not compromise the whole system

Defense in depth applies multiple overlapping security controls at different layers so an attacker must bypass several independent defenses.

Question 95: What is the purpose of salting a password before hashing it?

• To encrypt the hash with a key
• To prevent rainbow table and dictionary attacks (Correct answer)
• To ensure the hash length is longer
• To speed up password verification

Correct answer: To prevent rainbow table and dictionary attacks

A unique random salt added before hashing ensures identical passwords produce different hashes, defeating precomputed rainbow tables.

Question 96: In cloud security, what is a 'security group' in AWS and how can it represent a vulnerability?

• A virtual firewall controlling inbound/outbound traffic to AWS resources; misconfigured with 0.0.0.0/0 allows unrestricted access from the internet (Correct answer)
• An IAM group for security team members
• An AWS service for managing secrets
• A Kubernetes network policy equivalent

Correct answer: A virtual firewall controlling inbound/outbound traffic to AWS resources; misconfigured with 0.0.0.0/0 allows unrestricted access from the internet

AWS security groups act as virtual firewalls; rules permitting 0.0.0.0/0 on sensitive ports (22, 3389, 3306) expose services to the entire internet.

Question 97: What is a key difference between a policy and a procedure in an information security governance framework?

• A policy is technical; a procedure is managerial
• A policy states what must be done; a procedure describes how to do it (Correct answer)
• A policy is optional; a procedure is mandatory
• They are the same document with different names

Correct answer: A policy states what must be done; a procedure describes how to do it

Policies define high-level security requirements and goals, while procedures provide step-by-step instructions for implementing and complying with those policies.

Question 98: What is a security baseline in the context of architecture design?

• The starting point before any security controls are applied
• The lowest-security tier in a network zone model
• The first scan result in a vulnerability assessment
• A defined minimum set of security configurations that all systems must meet (Correct answer)

Correct answer: A defined minimum set of security configurations that all systems must meet

A security baseline specifies the minimum security configuration standards required for systems, ensuring consistent protection across an environment.

Question 99: In OAuth 2.0, what vulnerability arises when the 'state' parameter is absent or not validated during the authorization flow?

• Token leakage via the Referer header
• Insecure Direct Object Reference on the authorization code
• Open redirect via the redirect_uri parameter
• Cross-Site Request Forgery (CSRF) allowing account linking hijacking (Correct answer)

Correct answer: Cross-Site Request Forgery (CSRF) allowing account linking hijacking

The state parameter is an anti-CSRF token in OAuth 2.0; without it, an attacker can initiate an authorization flow and trick a victim into linking their account to the attacker's identity.

Question 100: What is XML External Entity (XXE) injection and what is one primary impact?

• Injecting malicious DTD entity references in XML input to read local files or perform SSRF (Correct answer)
• Injecting SQL via XML CDATA sections
• Overflowing XML parser buffers to cause denial of service only
• Embedding JavaScript in XML attributes to trigger XSS

Correct answer: Injecting malicious DTD entity references in XML input to read local files or perform SSRF

XXE exploits XML parsers that process external entity declarations, allowing file disclosure (e.g., /etc/passwd) or SSRF by pointing entities at internal resources.

Question 101: Which STRIDE threat category relates to an attacker pretending to be a legitimate user or system?

• Repudiation
• Information disclosure
• Spoofing (Correct answer)
• Tampering

Correct answer: Spoofing

Spoofing in STRIDE refers to falsely claiming an identity, such as impersonating a legitimate user, service, or IP address.

Question 102: In the US, which regulation specifically governs the privacy and security of protected health information (PHI) in electronic form?

• FERPA
• SOX
• GLBA
• HIPAA/HITECH (Correct answer)

Correct answer: HIPAA/HITECH

HIPAA (Health Insurance Portability and Accountability Act) and the HITECH Act govern security and privacy requirements for electronic protected health information (ePHI).

Question 103: In a Kubernetes environment, what is the risk of running pods with the 'hostNetwork: true' setting?

• It exposes the Kubernetes API server to external traffic
• It gives the pod access to the host's network namespace, bypassing network policy controls (Correct answer)
• It prevents pods from accessing the internet
• It disables Kubernetes DNS resolution

Correct answer: It gives the pod access to the host's network namespace, bypassing network policy controls

hostNetwork:true allows a container to share the host's network namespace, potentially exposing host-level services and bypassing Kubernetes network policies.

Question 104: What is the MITRE ATT&CK framework primarily used for in threat intelligence?

• Automating patch management
• Cataloging adversary tactics, techniques, and procedures (TTPs) (Correct answer)
• Generating CVSS scores
• Scanning networks for open ports

Correct answer: Cataloging adversary tactics, techniques, and procedures (TTPs)

MITRE ATT&CK is a knowledge base of adversary TTPs observed in real-world attacks, used to improve detection, threat modeling, and red team planning.

Question 105: Which risk quantification model converts cybersecurity risk into financial terms using probabilistic analysis?

• DREAD
• FAIR (Factor Analysis of Information Risk) (Correct answer)
• STRIDE
• CVSS

Correct answer: FAIR (Factor Analysis of Information Risk)

The FAIR model quantifies cybersecurity risk in monetary terms by analyzing threat event frequency, vulnerability, and loss magnitude using probabilistic ranges.

Question 106: Which Windows Registry hive is most useful for identifying recently accessed files, last-used applications, and typed URLs during a forensic investigation?

• HKLM\SAM
• NTUSER.DAT (HKCU) (Correct answer)
• HKLM\SECURITY
• HKLM\SYSTEM

Correct answer: NTUSER.DAT (HKCU)

NTUSER.DAT (loaded as HKCU) contains per-user artifacts like RecentDocs, RunMRU, TypedURLs, and UserAssist that reveal user activity history.

Question 107: What valuable reconnaissance data can be extracted from Certificate Transparency (CT) logs?

• Source code of web applications
• Employee usernames and email addresses
• Open port listings and running services
• Subdomains and SANs listed in issued SSL/TLS certificates (Correct answer)

Correct answer: Subdomains and SANs listed in issued SSL/TLS certificates

Certificate Transparency logs record all publicly issued SSL/TLS certificates, revealing subdomains listed in Subject Alternative Names (SANs).

Question 108: During a CREST Infrastructure penetration test, a tester identifies that SMBv1 is enabled on Windows hosts. Which notorious malware family specifically exploited this protocol using the EternalBlue exploit?

• WannaCry (Correct answer)
• Emotet
• Mirai
• Zeus

Correct answer: WannaCry

WannaCry ransomware used the NSA-developed EternalBlue exploit targeting SMBv1's MS17-010 vulnerability to spread laterally across networks without user interaction.

Question 109: What does the Cyber Kill Chain model describe?

• The chain of custody for digital evidence
• The lifecycle of a vulnerability from discovery to patch
• The stages of a cyberattack from reconnaissance through to the attacker achieving their objectives (Correct answer)
• The sequence of controls in a defense-in-depth model

Correct answer: The stages of a cyberattack from reconnaissance through to the attacker achieving their objectives

The Cyber Kill Chain, developed by Lockheed Martin, describes seven stages of a targeted attack: reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives.

Question 110: During a forensic investigation, you recover deleted files from an NTFS volume. Which NTFS metadata structure is the primary source for locating file remnants and timestamps after deletion?

• $Boot
• $MFT (Master File Table) (Correct answer)
• $LogFile
• $Bitmap

Correct answer: $MFT (Master File Table)

The $MFT retains file records including timestamps and attribute data even after deletion; the $DATA attribute may still reference disk clusters until overwritten.

Question 111: Which attack involves sending specially crafted ICMP packets to exploit vulnerabilities in network stack implementations?

• Ping of Death / ICMP fragmentation attacks
• All of the above are ICMP-based network stack attacks (Correct answer)
• ICMP redirect-based man-in-the-middle
• Smurf attack using ICMP broadcast amplification

Correct answer: All of the above are ICMP-based network stack attacks

Ping of Death exploits fragmentation handling, Smurf attacks amplify traffic via broadcast, and ICMP redirects can manipulate routing — all are ICMP-based network stack attack vectors.

Question 112: What is the difference between a 'white box' and 'black box' penetration test in terms of threat intelligence provided?

• White box provides full architecture and credentials; black box simulates an external attacker with no prior knowledge (Correct answer)
• White box uses automated tools; black box uses manual techniques
• White box costs less; black box costs more
• White box is for web apps; black box is for networks

Correct answer: White box provides full architecture and credentials; black box simulates an external attacker with no prior knowledge

White box tests provide the tester with full system knowledge (architecture, source code, credentials), while black box tests simulate an external attacker starting with no insider knowledge.

Question 113: What does CSRF (Cross-Site Request Forgery) exploit?

• A weak session token generation algorithm
• A victim's authenticated session to make unauthorized requests on their behalf (Correct answer)
• A server-side code execution vulnerability
• An unvalidated redirect in web applications

Correct answer: A victim's authenticated session to make unauthorized requests on their behalf

CSRF tricks an authenticated user's browser into sending forged requests to a web application, leveraging the user's existing session cookies without their knowledge.

Question 114: Which of the following describes a collision attack against a hash function?

• Brute-forcing a hash to find the plaintext
• Reversing a hash back to its original input
• Finding two different inputs that produce the same hash output (Correct answer)
• Injecting data into a hashed message

Correct answer: Finding two different inputs that produce the same hash output

A collision attack finds two distinct inputs that yield the same hash digest, undermining data integrity guarantees.

Question 115: During forensic triage, you find a file with a .jpg extension whose magic bytes are 50 4B 03 04. What does this indicate?

• The file is corrupted and unreadable
• The file is a ZIP archive masquerading as a JPEG (Correct answer)
• The file is a valid JPEG image
• The file is a PDF document

Correct answer: The file is a ZIP archive masquerading as a JPEG

Magic bytes 50 4B 03 04 are the signature for a ZIP archive; the .jpg extension has been changed to hide its true format.

Question 116: What is the purpose of input validation in secure coding?

• To ensure data conforms to expected formats before processing, preventing injection and logic flaws (Correct answer)
• To throttle requests and prevent denial of service
• To encrypt all user-submitted data at rest
• To log all user interactions for audit purposes

Correct answer: To ensure data conforms to expected formats before processing, preventing injection and logic flaws

Input validation checks that user-supplied data matches expected type, length, format, and range before the application processes it, blocking many injection and manipulation attacks.

Question 117: Which HTTP security header helps mitigate XSS attacks by restricting which sources of scripts are trusted?

• X-Frame-Options
• Content-Security-Policy (CSP) (Correct answer)
• X-Content-Type-Options
• Strict-Transport-Security

Correct answer: Content-Security-Policy (CSP)

The Content-Security-Policy header defines which origins are permitted to load scripts, styles, and other resources, blocking execution of injected inline scripts.

Question 118: Which threat actor category is typically characterized by nation-state backing and long-term persistent access to targeted networks?

• Script kiddie
• Insider threat
• Advanced Persistent Threat (APT) (Correct answer)
• Hacktivist

Correct answer: Advanced Persistent Threat (APT)

APT groups are sophisticated, well-funded actors typically linked to nation-states who conduct long-term espionage or sabotage campaigns against high-value targets.

Question 119: What is an Insecure Direct Object Reference (IDOR) vulnerability?

• When an application exposes internal object references without access control checks, allowing unauthorized data access (Correct answer)
• When session tokens are predictable and can be guessed
• When an application redirects users to untrusted external URLs
• When user input directly controls database queries

Correct answer: When an application exposes internal object references without access control checks, allowing unauthorized data access

IDOR occurs when a user can directly reference internal objects (like user IDs in URLs) and access data they are not authorized to see because access control checks are absent.

Question 120: What is the purpose of a secure code review in the SDLC?

• To verify that code meets performance benchmarks
• To identify security vulnerabilities in code through manual or automated review before deployment (Correct answer)
• To ensure all functions are properly documented
• To check that code follows the team's style guidelines

Correct answer: To identify security vulnerabilities in code through manual or automated review before deployment

Secure code review examines source code specifically for security weaknesses such as injection flaws, insecure deserialization, and improper access controls before the code goes live.