CREST Ethical Hacking & Penetration Testing 3 — Questions and Answers
Question 1: A tester performs a Kerberoasting attack against an Active Directory environment. What artifact is extracted and attacked offline?
- NTLM password hash of the target user
- Kerberos TGT encrypted with krbtgt hash
- TGS ticket encrypted with the service account's password hash (Correct answer)
- AS-REP encrypted with the user's password hash
Correct answer: TGS ticket encrypted with the service account's password hash
Kerberoasting requests TGS tickets for SPN-registered accounts, which are encrypted with RC4 using the service account's NTLM hash and can be cracked offline.
Question 2: During a network penetration test, a tester intercepts traffic between two hosts using ARP cache poisoning. What is the underlying protocol vulnerability being exploited?
- ARP lacks authentication and does not validate unsolicited replies (Correct answer)
- ARP uses weak RC4 encryption for cache entries
- ARP relies on DNS for IP-to-MAC resolution
- ARP caches expire too slowly to prevent poisoning
Correct answer: ARP lacks authentication and does not validate unsolicited replies
ARP has no authentication mechanism, so hosts accept ARP replies without verifying the sender, enabling poisoning of MAC address tables.
Question 3: What is the primary purpose of a CREST penetration testing report's executive summary section?
- List every vulnerability with CVSS scores
- Communicate risk and business impact to non-technical stakeholders (Correct answer)
- Provide raw tool output and technical logs
- Detail the exact methodology used for each test phase
Correct answer: Communicate risk and business impact to non-technical stakeholders
The executive summary translates technical findings into business risk language for senior management who require strategic context rather than technical detail.
Question 4: A tester discovers an SSRF vulnerability in a web application. Which internal resource would be the highest-priority target for demonstrating critical impact?
- Internal web server hosting static files
- Cloud metadata service (e.g., 169.254.169.254) (Correct answer)
- Internal DNS resolver
- Internal SMTP relay
Correct answer: Cloud metadata service (e.g., 169.254.169.254)
Cloud metadata services expose IAM credentials, instance details, and configuration data, making them the highest-impact SSRF target for demonstrating privilege escalation.
Question 5: During post-exploitation on a Linux host, a tester runs `find / -perm -4000 -type f 2>/dev/null`. What is the tester looking for?
- World-writable files owned by root
- Files with the SUID bit set (Correct answer)
- Cron jobs running as root
- Files with the sticky bit set
Correct answer: Files with the SUID bit set
The `-perm -4000` filter finds files with the SUID bit set, which run with the owner's privileges (often root), enabling privilege escalation.
Question 6: In the context of CREST examinations, what does 'scoping' a penetration test primarily define?
- The tools and exploits permitted during testing
- The boundaries, systems, and objectives the test will cover (Correct answer)
- The reporting format and remediation timeline
- The classification level of discovered vulnerabilities
Correct answer: The boundaries, systems, and objectives the test will cover
Scoping establishes legal and technical boundaries by identifying target systems, IP ranges, test types, and excluded systems to prevent unauthorized access.
Question 7: A tester captures a TLS session and attempts to decrypt traffic using a pre-master secret log. Which tool facilitates this analysis?
- John the Ripper
- Wireshark with SSLKEYLOGFILE (Correct answer)
- Burp Suite's intruder
- Metasploit's auxiliary/sniffer
Correct answer: Wireshark with SSLKEYLOGFILE
Wireshark supports decryption of TLS sessions when provided a pre-master secret log file via the SSLKEYLOGFILE environment variable exported by the browser or application.
CREST Ethical Hacking & Penetration Testing 3
A tester performs a Kerberoasting attack against an Active Directory environment.
What artifact is extracted and attacked offline?