CREST Network & Web Application Security 2 — Questions and Answers
Question 1: An attacker sends a crafted HTTP request with a 'Transfer-Encoding: chunked' header alongside a 'Content-Length' header to a server behind a reverse proxy. What attack is being attempted?
- HTTP Request Smuggling (Correct answer)
- HTTP Response Splitting
- CRLF Injection
- Host Header Injection
Correct answer: HTTP Request Smuggling
HTTP Request Smuggling exploits ambiguity between front-end and back-end servers in how they parse conflicting Transfer-Encoding and Content-Length headers.
Question 2: During a CREST assessment, you discover an endpoint reflects user input in a JSON response with Content-Type: application/json. Which vulnerability is LEAST likely to be exploitable via this reflection?
- Stored XSS via JSON injection (Correct answer)
- Reflected XSS if the response is later consumed by innerHTML
- SQL injection if the value is used in a query
- JSON hijacking on older browsers
Correct answer: Stored XSS via JSON injection
Stored XSS requires persistence on the server; a reflection in a JSON response alone without unsafe DOM consumption is not stored and thus not stored XSS.
Question 3: A TCP port scan with Nmap returns a port state of 'filtered'. What does this indicate?
- A firewall is dropping packets without sending a response (Correct answer)
- The port is open but the service is not responding
- An RST packet was received from the target
- The host is offline
Correct answer: A firewall is dropping packets without sending a response
A 'filtered' state means Nmap received no response (packets silently dropped by a firewall or filter), unlike 'closed' which returns an RST.
Question 4: Which OWASP Top 10 category covers insecure use of cryptographic functions such as using MD5 to hash passwords?
- Cryptographic Failures (Correct answer)
- Security Misconfiguration
- Identification and Authentication Failures
- Vulnerable and Outdated Components
Correct answer: Cryptographic Failures
OWASP Cryptographic Failures (formerly Sensitive Data Exposure) covers weak or misused cryptography including broken hash algorithms like MD5 for passwords.
Question 5: During a web application test, you find that the application uses JWT tokens. The decoded header shows 'alg: none'. What is the security implication?
- The server may accept unsigned tokens, allowing arbitrary claim forgery (Correct answer)
- The token is encrypted and cannot be tampered with
- The token will always be rejected by a secure implementation
- It indicates the use of a symmetric HMAC algorithm
Correct answer: The server may accept unsigned tokens, allowing arbitrary claim forgery
The 'none' algorithm in JWT means no signature is applied; vulnerable servers that accept this skip verification, allowing attackers to forge any claims.
Question 6: What is the primary purpose of a Network Access Control (NAC) system in an enterprise environment?
- To enforce security policy compliance before granting network access to endpoints (Correct answer)
- To encrypt all traffic traversing the internal network
- To detect and block SQL injection at the network level
- To provide VPN connectivity for remote users
Correct answer: To enforce security policy compliance before granting network access to endpoints
NAC systems authenticate devices and check their compliance posture (patching, AV status, etc.) before permitting them onto the network.
Question 7: An SSRF vulnerability is confirmed on an internal cloud-hosted application. Which internal resource is the attacker most likely to target first?
- The cloud metadata service (e.g., 169.254.169.254) (Correct answer)
- The application's own web server on localhost
- The corporate SMTP relay
- The external CDN endpoint
Correct answer: The cloud metadata service (e.g., 169.254.169.254)
Cloud metadata services at 169.254.169.254 expose IAM credentials and instance information, making them the highest-value SSRF target in cloud environments.
CREST Network & Web Application Security 2
An attacker sends a crafted HTTP request with a 'Transfer-Encoding: chunked' header alongside a 'Content-Length' header to a server behind a reverse proxy.
What attack is being attempted?