CREST Ethical Hacking & Penetration Testing 2 — Questions and Answers
Question 1: During a CREST-accredited penetration test, a tester discovers an out-of-scope system is critically vulnerable. What is the correct immediate action?
- Exploit it to demonstrate impact
- Stop testing and notify the client immediately (Correct answer)
- Document it and continue with scoped targets
- Ignore it as it is out of scope
Correct answer: Stop testing and notify the client immediately
CREST rules of engagement require testers to immediately notify the client of critical out-of-scope findings rather than exploiting them.
Question 2: Which technique is used to identify live hosts on a network segment without triggering IDS alerts by using ICMP echo requests sparingly?
- TCP SYN sweep
- ARP ping sweep (Correct answer)
- UDP probe sweep
- Fragmented ICMP sweep
Correct answer: ARP ping sweep
ARP ping sweeps work at Layer 2 and are often less detectable by network-based IDS because ARP traffic is typically not filtered at the host level.
Question 3: A tester uses Responder to capture NTLMv2 hashes on an internal network. What attack category does this represent?
- Pass-the-hash
- Credential relaying
- LLMNR/NBT-NS poisoning (Correct answer)
- Kerberoasting
Correct answer: LLMNR/NBT-NS poisoning
Responder exploits LLMNR and NBT-NS broadcast protocols to poison name resolution and capture NTLMv2 challenge-response hashes.
Question 4: What does the CVSS temporal score metric 'Exploit Code Maturity' value 'Proof-of-Concept' indicate?
- Exploit is fully automated and reliable
- Functional exploit code is publicly available but unreliable (Correct answer)
- No exploit exists yet
- Exploit is available only through private channels
Correct answer: Functional exploit code is publicly available but unreliable
Proof-of-Concept maturity means working exploit code exists but may not be reliable enough for consistent exploitation in all scenarios.
Question 5: During web application testing, a tester injects `' OR '1'='1` into a login form and gains access. Which primary vulnerability class does this represent?
- Second-order SQL injection
- Blind SQL injection
- In-band SQL injection (Correct answer)
- Error-based SQL injection
Correct answer: In-band SQL injection
Classic login bypass via OR condition is in-band SQL injection because the result of the injected query is returned directly in the application response.
Question 6: A penetration tester is performing a wireless assessment and identifies a network using WPA2-Personal. What is the most effective offline attack against captured 4-way handshakes?
- PMKID attack
- Dictionary/brute-force against captured handshake (Correct answer)
- Deauth flood
- Evil twin AP
Correct answer: Dictionary/brute-force against captured handshake
Captured WPA2-Personal 4-way handshakes can be attacked offline using dictionary or brute-force tools like hashcat against the PBKDF2-derived PMK.
Question 7: Which framework specifically provides a structured knowledge base of adversary tactics and techniques used by CREST testers for threat-informed penetration testing?
- OWASP Testing Guide
- NIST SP 800-115
- MITRE ATT&CK (Correct answer)
- PTES Technical Guidelines
Correct answer: MITRE ATT&CK
MITRE ATT&CK is the industry-standard knowledge base mapping real-world adversary tactics and techniques used to simulate advanced threat actors.
CREST Ethical Hacking & Penetration Testing 2
During a CREST-accredited penetration test, a tester discovers an out-of-scope system is critically vulnerable.
What is the correct immediate action?