CREST Study Guide 2026
Everything you need to pass the CREST exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 CREST Exam Format at a Glance
📚 CREST Topics to Study (52)
✍️ Sample CREST Questions & Answers
1. When prioritizing vulnerabilities, which combination of factors from CVSS and business context is MOST appropriate?
Effective prioritization combines the CVSS base score with environmental factors such as asset business value and evidence of active exploitation to focus remediation effort.
2. What is a key element of effective vulnerability management?
A key element of effective vulnerability management is continuous monitoring and patching. Security threats and vulnerabilities constantly evolve, so ongoing surveillance of systems and networks is necessary to detect new weaknesses. Regularly applying security patches and updates ensures that known flaws are addressed promptly, significantly reducing the attack surface.
3. An analyst is reviewing a PCAP and notices beaconing traffic on port 443 to an external IP with jitter of ±10%. What does the jitter most likely indicate?
Modern C2 frameworks deliberately introduce jitter (random variance in beacon intervals) to avoid pattern-based network detection.
4. What does the OWASP ASVS (Application Security Verification Standard) provide?
OWASP ASVS defines three levels of security verification requirements that organizations can use as a baseline for application security testing and development standards.
5. What is a security baseline in the context of architecture design?
A security baseline specifies the minimum security configuration standards required for systems, ensuring consistent protection across an environment.
6. What does a DMZ (Demilitarized Zone) in network architecture provide?
A DMZ places externally facing services between two firewalls, limiting the damage if a public-facing server is compromised.