CREST Practitioner Security Analyst (CPSA) — Questions and Answers

Question 1: In patch management, what is the difference between a hotfix and a service pack?

A hotfix is a cumulative update; a service pack targets a single bug
There is no meaningful difference between the two
A hotfix requires a reboot; a service pack does not
A hotfix addresses a specific urgent issue; a service pack is a collection of patches bundled together (Correct answer)

Correct answer: A hotfix addresses a specific urgent issue; a service pack is a collection of patches bundled together

Hotfixes are rapid, targeted fixes for specific critical issues, while service packs aggregate multiple previously released patches into a single installable update.

Question 2: Which log source on a Windows system specifically records successful and failed authentication events along with the source IP address?

Security event log (Correct answer)
Application event log
PowerShell operational log
System event log

Correct answer: Security event log

The Windows Security event log records logon events (Event IDs 4624, 4625) including source IP, logon type, and account name.

Question 3: Which professional standard requires CREST members to maintain and update their technical skills to keep pace with evolving threats?

Peer review publication requirements
Annual background checks
Bug bounty participation
Continuing Professional Development (CPD) (Correct answer)

Correct answer: Continuing Professional Development (CPD)

CREST's Continuing Professional Development requirement mandates that certified members regularly update their skills through training, research, and professional activities.

Question 4: Which CVSS v3.1 metric reflects whether an attacker needs privileges before exploiting a vulnerability?

User Interaction
Scope
Attack Vector
Privileges Required (Correct answer)

Correct answer: Privileges Required

Privileges Required (PR) captures the level of access an attacker must possess prior to successfully exploiting the vulnerability.

Question 5: Which cloud security principle recommends giving users and services only the minimum permissions needed to perform their function?

Security by obscurity
Principle of least privilege (Correct answer)
Zero trust networking
Defense in depth

Correct answer: Principle of least privilege

The principle of least privilege limits IAM roles, user permissions, and service accounts to only the specific permissions required for their function, reducing blast radius from compromise.

Question 6: A tester discovers an SSRF vulnerability in a web application. Which internal resource would be the highest-priority target for demonstrating critical impact?

Internal web server hosting static files
Cloud metadata service (e.g., 169.254.169.254) (Correct answer)
Internal DNS resolver
Internal SMTP relay

Correct answer: Cloud metadata service (e.g., 169.254.169.254)

Cloud metadata services expose IAM credentials, instance details, and configuration data, making them the highest-impact SSRF target for demonstrating privilege escalation.

Question 7: What does the OWASP ASVS (Application Security Verification Standard) provide?

A list of the top 10 most critical web application vulnerabilities
A certification program for web application developers
A framework of security requirements for designing, developing, and testing secure web applications (Correct answer)
A scoring system for rating web application penetration tests

Correct answer: A framework of security requirements for designing, developing, and testing secure web applications

OWASP ASVS defines three levels of security verification requirements that organizations can use as a baseline for application security testing and development standards.

Question 8: Which type of malware analysis technique executes a sample in a controlled environment to observe its behavior without examining the code directly?

Code disassembly
Dynamic analysis (Correct answer)
Static analysis
Signature-based scanning

Correct answer: Dynamic analysis

Dynamic analysis involves executing malware in a sandboxed environment (like Cuckoo Sandbox) to observe runtime behaviors such as network connections, file modifications, and registry changes.

Question 9: What does the NIST Cybersecurity Framework (CSF) organize its functions around?

Plan, Do, Check, Act
Identify, Protect, Detect, Respond, Recover (Correct answer)
Classify, Assess, Mitigate, Monitor
Prevent, Detect, Correct

Correct answer: Identify, Protect, Detect, Respond, Recover

The NIST CSF organizes cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover.

Question 10: Which key exchange protocol allows two parties to establish a shared secret over an insecure channel without transmitting the secret?

Diffie-Hellman (Correct answer)
Certificate pinning
AES key wrapping
RSA key exchange

Correct answer: Diffie-Hellman

Diffie-Hellman key exchange enables two parties to derive a shared secret using public values without ever transmitting the secret itself.

Question 11: An attacker used 'certutil.exe -decode encoded.txt malware.exe' on a compromised host. What technique does this represent?

Process hollowing
Pass-the-hash attack
DLL hijacking
Living off the Land (LotL) using a trusted Windows binary (Correct answer)

Correct answer: Living off the Land (LotL) using a trusted Windows binary

Using certutil.exe (a legitimate Windows certificate utility) to decode and drop malware is a classic Living off the Land technique that abuses trusted binaries to evade detection.

Question 12: Which technique is used to identify live hosts on a network segment without triggering IDS alerts by using ICMP echo requests sparingly?

ARP ping sweep (Correct answer)
UDP probe sweep
TCP SYN sweep
Fragmented ICMP sweep

Correct answer: ARP ping sweep

ARP ping sweeps work at Layer 2 and are often less detectable by network-based IDS because ARP traffic is typically not filtered at the host level.

Question 13: During forensic triage, you find a file with a .jpg extension whose magic bytes are 50 4B 03 04. What does this indicate?

The file is a PDF document
The file is a ZIP archive masquerading as a JPEG (Correct answer)
The file is corrupted and unreadable
The file is a valid JPEG image

Correct answer: The file is a ZIP archive masquerading as a JPEG

Magic bytes 50 4B 03 04 are the signature for a ZIP archive; the .jpg extension has been changed to hide its true format.

Question 14: Which search engine is primarily used to discover internet-connected devices and their exposed service banners?

DuckDuckGo
Google
Bing
Shodan (Correct answer)

Correct answer: Shodan

Shodan indexes internet-connected devices and their banners, making it invaluable for finding exposed services, open ports, and vulnerable systems.

Question 15: A tester performs a Kerberoasting attack against an Active Directory environment. What artifact is extracted and attacked offline?

TGS ticket encrypted with the service account's password hash (Correct answer)
AS-REP encrypted with the user's password hash
NTLM password hash of the target user
Kerberos TGT encrypted with krbtgt hash

Correct answer: TGS ticket encrypted with the service account's password hash

Kerberoasting requests TGS tickets for SPN-registered accounts, which are encrypted with RC4 using the service account's NTLM hash and can be cracked offline.

Question 16: Which standard provides a common language for describing security vulnerabilities and exposures?

OWASP Top 10
CVE (Common Vulnerabilities and Exposures) (Correct answer)
ISO 27001
NIST SP 800-53

Correct answer: CVE (Common Vulnerabilities and Exposures)

CVE is a dictionary of publicly known cybersecurity vulnerabilities maintained by MITRE, providing unique identifiers for each entry.

Question 17: What is Cross-Site Scripting (XSS) and which type allows attackers to store malicious scripts on the server?

XSS modifies HTTP headers; DOM XSS stores them in cookies
XSS injects malicious scripts into web pages; stored XSS persists scripts on the server (Correct answer)
XSS overwrites database records; blind XSS persists them
XSS steals server-side session tokens; reflected XSS stores them

Correct answer: XSS injects malicious scripts into web pages; stored XSS persists scripts on the server

XSS injects client-side scripts into pages viewed by other users; stored (persistent) XSS saves the malicious script on the server so it executes for every visitor.

Question 18: What is a common vulnerability discovered during penetration testing?

Strong passwords.
Well-configured servers.
Up-to-date firewalls.
Outdated software and unpatched systems (Correct answer)

Correct answer: Outdated software and unpatched systems

A common vulnerability discovered during penetration testing is the presence of outdated software and unpatched systems. Software vendors regularly release security patches to fix newly discovered flaws, and failure to apply these updates leaves systems susceptible to known exploits. Attackers frequently target these unpatched vulnerabilities to gain unauthorized access.

Question 19: What is a race condition vulnerability in application code?

When two threads access the same database record simultaneously causing data corruption
When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity (Correct answer)
When an application consumes excessive CPU under load
When a loop runs without a proper exit condition

Correct answer: When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity

A race condition occurs when security checks and the use of a resource are not atomic, allowing an attacker to change state between the check and the use (TOCTOU — time-of-check to time-of-use).

Question 20: What is the key difference between a vulnerability assessment and a penetration test in a professional engagement context?

Penetration tests are automated only
Vulnerability assessments require CREST certification
Penetration tests actively exploit vulnerabilities to prove impact, while assessments only identify them (Correct answer)
Vulnerability assessments cost more

Correct answer: Penetration tests actively exploit vulnerabilities to prove impact, while assessments only identify them

A vulnerability assessment identifies and classifies weaknesses without exploitation, while a penetration test actively exploits them to demonstrate real-world risk and business impact.

Question 21: During a forensic investigation, you recover deleted files from an NTFS volume. Which NTFS metadata structure is the primary source for locating file remnants and timestamps after deletion?

$MFT (Master File Table) (Correct answer)
$Bitmap
$Boot
$LogFile

Correct answer: $MFT (Master File Table)

The $MFT retains file records including timestamps and attribute data even after deletion; the $DATA attribute may still reference disk clusters until overwritten.

Question 22: What is the purpose of input validation in secure coding?

To throttle requests and prevent denial of service
To ensure data conforms to expected formats before processing, preventing injection and logic flaws (Correct answer)
To encrypt all user-submitted data at rest
To log all user interactions for audit purposes

Correct answer: To ensure data conforms to expected formats before processing, preventing injection and logic flaws

Input validation checks that user-supplied data matches expected type, length, format, and range before the application processes it, blocking many injection and manipulation attacks.

Question 23: Which concept in threat intelligence describes the relative difficulty for defenders to detect and respond to different types of indicators?

The Pyramid of Pain (Correct answer)
The Kill Chain
The Diamond Model
ATT&CK Navigator

Correct answer: The Pyramid of Pain

The Pyramid of Pain ranks IoC types by how painful it is for attackers if defenders detect and block them, from easy-to-change IPs at the bottom to hard-to-change TTPs at the top.

Question 24: Which threat intelligence sharing standard uses a structured language to describe cyber threat information in a machine-readable format?

OVAL
STIX (Structured Threat Information eXpression) (Correct answer)
CVSS
SCAP

Correct answer: STIX (Structured Threat Information eXpression)

STIX is a standardized language for describing CTI content in a structured, machine-readable way that enables automated sharing and analysis of threat data.

Question 25: What is a buffer overflow vulnerability?

When a network buffer queue exceeds its maximum capacity
When a database query returns more rows than the application expects
When a log file grows too large and overwrites system disk space
When more data is written to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution (Correct answer)

Correct answer: When more data is written to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution

Buffer overflows occur when input exceeds the allocated memory buffer, overwriting adjacent data or return addresses, which can redirect execution to attacker-controlled code.

Question 26: What distinguishes a 'grey-box' penetration test from black-box and white-box approaches?

The tester operates without any prior knowledge of the target
The tester has complete access to all documentation, source code, and configurations
The tester has full source code access but no network credentials
The tester has partial knowledge such as credentials or architecture diagrams but not full system access (Correct answer)

Correct answer: The tester has partial knowledge such as credentials or architecture diagrams but not full system access

Grey-box testing simulates an insider threat or compromised credential scenario by providing limited information like user credentials or network diagrams.

Question 27: Which metric in CVSS v3.1 captures whether exploitation requires interaction from a user other than the attacker?

Scope
Privileges Required
User Interaction (Correct answer)
Attack Complexity

Correct answer: User Interaction

User Interaction (UI) indicates whether a victim must perform some action (e.g., click a link) for the vulnerability to be exploited.

Question 28: In penetration testing methodology, what term describes gathering information about a target exclusively from public sources before active testing begins?

Pivoting
Footprinting (Correct answer)
Exploitation
Lateral movement

Correct answer: Footprinting

Footprinting is the process of systematically gathering publicly available information about a target to build an intelligence profile prior to active engagement.

Question 29: What is the primary outcome of a gap analysis in a compliance program?

Defining encryption key management procedures
Creating a patch management schedule
Identifying the difference between the current security state and the required compliance standard (Correct answer)
Documenting all discovered vulnerabilities in priority order

Correct answer: Identifying the difference between the current security state and the required compliance standard

A gap analysis compares the current state of controls against the requirements of a compliance standard to identify what needs to be implemented or improved.

Question 30: Which of the following best describes a key risk indicator (KRI)?

A list of known vulnerabilities in a system
A metric that signals increasing risk exposure before an incident occurs (Correct answer)
A compliance checklist for regulatory audits
A post-incident report describing root causes

Correct answer: A metric that signals increasing risk exposure before an incident occurs

KRIs are forward-looking metrics that provide early warning signals when risk levels are approaching or exceeding acceptable thresholds.

Question 31: In risk assessment, what is the formula for calculating risk?

Risk = Vulnerability ÷ Control
Risk = Threat × Asset Value
Risk = Threat − Countermeasure
Risk = Likelihood × Impact (Correct answer)

Correct answer: Risk = Likelihood × Impact

Risk is calculated as the product of the likelihood that a threat exploits a vulnerability and the resulting impact on the organization.

Question 32: Which secure coding practice helps prevent sensitive data from appearing in application logs?

Sanitizing and filtering log output to exclude passwords, tokens, and PII (Correct answer)
Disabling all application logging
Only logging events on production systems
Storing all logs in encrypted files

Correct answer: Sanitizing and filtering log output to exclude passwords, tokens, and PII

Secure logging practices ensure sensitive fields like passwords, API keys, and personal data are redacted or masked before being written to log files.

CREST Practitioner Security Analyst (CPSA)

The CREST CPSA certification validates entry-level knowledge in penetration testing and ethical security assessment, covering network security, web application security, and information gathering techniques. It is administered by the Council for Registered Ethical Security Testers (CREST) and serves as a prerequisite for the advanced CRT qualification.

Questions

35 min

Time Limit

60%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds