CREST Ethical Hacking & Penetration Testing 3

Question 1

A tester performs a Kerberoasting attack against an Active Directory environment. What artifact is extracted and attacked offline?

Accepted Answer

TGS ticket encrypted with the service account's password hash

Answer

Kerberoasting requests TGS tickets for SPN-registered accounts, which are encrypted with RC4 using the service account's NTLM hash and can be cracked offline.

Question 2

During a network penetration test, a tester intercepts traffic between two hosts using ARP cache poisoning. What is the underlying protocol vulnerability being exploited?

Accepted Answer

ARP lacks authentication and does not validate unsolicited replies

Answer

ARP has no authentication mechanism, so hosts accept ARP replies without verifying the sender, enabling poisoning of MAC address tables.

Question 3

What is the primary purpose of a CREST penetration testing report's executive summary section?

Accepted Answer

Communicate risk and business impact to non-technical stakeholders

Answer

The executive summary translates technical findings into business risk language for senior management who require strategic context rather than technical detail.

Question 4

A tester discovers an SSRF vulnerability in a web application. Which internal resource would be the highest-priority target for demonstrating critical impact?

Accepted Answer

Cloud metadata service (e.g., 169.254.169.254)

Answer

Cloud metadata services expose IAM credentials, instance details, and configuration data, making them the highest-impact SSRF target for demonstrating privilege escalation.

Question 5

During post-exploitation on a Linux host, a tester runs `find / -perm -4000 -type f 2>/dev/null`. What is the tester looking for?

Accepted Answer

Files with the SUID bit set

Answer

The `-perm -4000` filter finds files with the SUID bit set, which run with the owner's privileges (often root), enabling privilege escalation.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Ethical Hacking & Penetration Testing 3