CREST Network & Web Application Security 4

Question 1

Which attack targets the ARP cache of hosts on a local network segment to redirect traffic through an attacker-controlled machine?

Accepted Answer

ARP Cache Poisoning (ARP Spoofing)

Answer

ARP Cache Poisoning sends gratuitous ARP replies associating the attacker's MAC with a legitimate IP, causing victims to send traffic to the attacker instead.

Question 2

A web application accepts a filename parameter and returns file contents. Input of '../../../etc/passwd' returns the passwd file. What additional test should be performed?

Accepted Answer

Test URL encoding, double encoding, and null byte variants to check filter bypasses

Answer

Path traversal filters are commonly bypassed with URL encoding (%2F), double encoding (%252F), or null bytes (%00), so these variants must be tested to assess filter robustness.

Question 3

In OAuth 2.0, what vulnerability arises when the 'state' parameter is absent or not validated during the authorization flow?

Accepted Answer

Cross-Site Request Forgery (CSRF) allowing account linking hijacking

Answer

The state parameter is an anti-CSRF token in OAuth 2.0; without it, an attacker can initiate an authorization flow and trick a victim into linking their account to the attacker's identity.

Question 4

Which Nmap scan type sends only a TCP SYN packet and does not complete the three-way handshake, making it less likely to appear in application logs?

Accepted Answer

SYN scan (-sS)

Answer

A SYN scan (half-open scan) sends SYN and reads the response but sends RST instead of completing the handshake, so no full connection is established and application-layer logging is avoided.

Question 5

What is XML External Entity (XXE) injection and what is one primary impact?

Accepted Answer

Injecting malicious DTD entity references in XML input to read local files or perform SSRF

Answer

XXE exploits XML parsers that process external entity declarations, allowing file disclosure (e.g., /etc/passwd) or SSRF by pointing entities at internal resources.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Network & Web Application Security 4