CREST Ethical Hacking & Penetration Testing 2

Question 1

During a CREST-accredited penetration test, a tester discovers an out-of-scope system is critically vulnerable. What is the correct immediate action?

Accepted Answer

Stop testing and notify the client immediately

Answer

CREST rules of engagement require testers to immediately notify the client of critical out-of-scope findings rather than exploiting them.

Question 2

Which technique is used to identify live hosts on a network segment without triggering IDS alerts by using ICMP echo requests sparingly?

Accepted Answer

ARP ping sweep

Answer

ARP ping sweeps work at Layer 2 and are often less detectable by network-based IDS because ARP traffic is typically not filtered at the host level.

Question 3

A tester uses Responder to capture NTLMv2 hashes on an internal network. What attack category does this represent?

Accepted Answer

LLMNR/NBT-NS poisoning

Answer

Responder exploits LLMNR and NBT-NS broadcast protocols to poison name resolution and capture NTLMv2 challenge-response hashes.

Question 4

What does the CVSS temporal score metric 'Exploit Code Maturity' value 'Proof-of-Concept' indicate?

Accepted Answer

Functional exploit code is publicly available but unreliable

Answer

Proof-of-Concept maturity means working exploit code exists but may not be reliable enough for consistent exploitation in all scenarios.

Question 5

During web application testing, a tester injects `' OR '1'='1` into a login form and gains access. Which primary vulnerability class does this represent?

Accepted Answer

In-band SQL injection

Answer

Classic login bypass via OR condition is in-band SQL injection because the result of the injected query is returned directly in the application response.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Ethical Hacking & Penetration Testing 2