CREST Network & Web Application Security 5

Question 1

Which technique allows an attacker to inject malicious content into a web cache, causing it to be served to other users?

Accepted Answer

Web Cache Poisoning

Answer

Web Cache Poisoning crafts requests that cause a cache to store a malicious response (e.g., containing XSS payload) under a cache key that will be served to legitimate users.

Question 2

In a black-box test, you find an endpoint that returns different HTTP status codes (200 vs 302) depending on whether a username exists. What vulnerability does this illustrate?

Accepted Answer

Username enumeration via differential response

Answer

Differential responses (status codes, response times, or body content) based on whether a username exists allow attackers to enumerate valid accounts.

Question 3

What is the purpose of an Intrusion Detection System (IDS) operating in 'inline' mode, and what is it then called?

Accepted Answer

It actively blocks malicious traffic in real time and is called an Intrusion Prevention System (IPS)

Answer

When an IDS is placed inline so it can drop or block packets rather than just alerting, it becomes an Intrusion Prevention System (IPS).

Question 4

A tester finds that a GraphQL endpoint exposes all types and fields via introspection. What is the primary security risk of leaving introspection enabled in production?

Accepted Answer

Attackers can map the entire API schema, discovering hidden fields and mutation endpoints to attack

Answer

GraphQL introspection reveals the full API schema including all types, queries, and mutations, giving attackers a detailed map to identify sensitive or undocumented endpoints.

Question 5

Which attack involves sending specially crafted ICMP packets to exploit vulnerabilities in network stack implementations?

Accepted Answer

All of the above are ICMP-based network stack attacks

Answer

Ping of Death exploits fragmentation handling, Smurf attacks amplify traffic via broadcast, and ICMP redirects can manipulate routing — all are ICMP-based network stack attack vectors.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Network & Web Application Security 5