CREST Security & Vulnerability Management 3 — Questions and Answers
Question 1: Which vulnerability scanning technique involves providing valid credentials to the scanner to enumerate installed software versions?
- Unauthenticated scanning
- Credentialed (authenticated) scanning (Correct answer)
- Passive network monitoring
- Fuzzing
Correct answer: Credentialed (authenticated) scanning
Credentialed scanning allows the scanner to log in and inspect installed packages, registry entries, and configurations, producing far more accurate results than unauthenticated scans.
Question 2: A CREST-certified tester receives a finding about an open redirect vulnerability. Under OWASP categorization, which category best fits this issue?
- A01: Broken Access Control
- A03: Injection
- A10: Server-Side Request Forgery (SSRF)
- Unvalidated Redirects and Forwards (Correct answer)
Correct answer: Unvalidated Redirects and Forwards
Unvalidated Redirects and Forwards is the OWASP category that covers open redirect vulnerabilities, where an application can redirect users to untrusted URLs.
Question 3: In patch management, what is the difference between a hotfix and a service pack?
- A hotfix is a cumulative update; a service pack targets a single bug
- A hotfix addresses a specific urgent issue; a service pack is a collection of patches bundled together (Correct answer)
- A hotfix requires a reboot; a service pack does not
- There is no meaningful difference between the two
Correct answer: A hotfix addresses a specific urgent issue; a service pack is a collection of patches bundled together
Hotfixes are rapid, targeted fixes for specific critical issues, while service packs aggregate multiple previously released patches into a single installable update.
Question 4: When prioritizing vulnerabilities, which combination of factors from CVSS and business context is MOST appropriate?
- CVSS base score alone
- CVSS base score plus asset criticality and exploitability in the wild (Correct answer)
- Vendor severity rating only
- Time since the vulnerability was disclosed
Correct answer: CVSS base score plus asset criticality and exploitability in the wild
Effective prioritization combines the CVSS base score with environmental factors such as asset business value and evidence of active exploitation to focus remediation effort.
Question 5: Which framework classifies adversary tactics and techniques and is widely used to map vulnerabilities to real-world attacker behavior?
- OWASP Testing Guide
- MITRE ATT&CK (Correct answer)
- CIS Controls
- NIST CSF
Correct answer: MITRE ATT&CK
MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques based on real-world observations, enabling threat-informed vulnerability prioritization.
Question 6: A web application scan reveals numerous false positives. What is the BEST approach to improve scan accuracy?
- Increase scan frequency
- Tune scanner plug-ins and validate findings manually (Correct answer)
- Switch to a different vendor's scanner
- Ignore all low-severity findings
Correct answer: Tune scanner plug-ins and validate findings manually
Tuning scanner configurations to the specific application environment and manually validating flagged findings reduces false positives and improves the signal-to-noise ratio.
Question 7: What is 'vulnerability chaining' in the context of penetration testing?
- Running multiple scans simultaneously
- Combining several low-severity vulnerabilities to achieve a higher-impact compromise (Correct answer)
- Linking vulnerability databases for cross-reference
- Scheduling patches in dependency order
Correct answer: Combining several low-severity vulnerabilities to achieve a higher-impact compromise
Vulnerability chaining exploits a sequence of individually low-risk weaknesses in combination to achieve an outcome (e.g., remote code execution) that none would allow alone.
CREST Security & Vulnerability Management 3
Which vulnerability scanning technique involves providing valid credentials to the scanner to enumerate installed software versions?