I85PREP
⌘ K
CREST CPSA study materials
CREST CPSA study resources

CREST CPSA practice questions

One question at a time. Build your CREST CPSA understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Soft Skills and Assessment Management

During a penetration test, the client asks for a verbal update halfway through the engagement. What is the most appropriate action for the tester?

  1. Refuse to give any update until the final written report is delivered
  2. Provide the update through the agreed communication channel and document what was shared Correct answer.
  3. Post a general progress summary on a public social media account
  4. Share detailed exploit findings with any employee who asks

Explanation

Client communication should follow the channel and schedule agreed in the rules of engagement, and interim briefings should be recorded so the final report reflects what was disclosed. Ad hoc or public disclosure risks breaching confidentiality and scope agreements.

Question 2Soft Skills and Assessment Management

What is the primary purpose of a rules of engagement document in a penetration test?

  1. To define the authorized scope, timing, and constraints of testing Correct answer.
  2. To list the technical vulnerabilities discovered during testing
  3. To provide the client's marketing team with promotional material
  4. To record the tester's hourly billing and invoicing details

Explanation

Rules of engagement set out what is authorized, when testing may occur, what is out of scope, and any constraints such as denied techniques. They protect both parties by ensuring testing stays within agreed legal and operational boundaries.

Question 3Soft Skills and Assessment Management

A tester discovers a critical vulnerability that could cause immediate business harm if left unaddressed. What should the tester do first?

  1. Notify the agreed client contact promptly through the defined escalation path Correct answer.
  2. Discuss the finding openly on a public forum to seek peer input
  3. Attempt to exploit the vulnerability as far as possible to confirm impact
  4. Wait until the scheduled final report is due to include it

Explanation

Critical findings that pose immediate risk should be escalated promptly using the contact and escalation route agreed in the rules of engagement. Delaying disclosure or publicly discussing the issue increases risk to the client.

Question 4Soft Skills and Assessment Management

Which element is most important to include when scoping a penetration test with a client?

  1. The specific systems, networks, and boundaries to be tested Correct answer.
  2. The personal home addresses of the client's senior managers
  3. A guarantee that no vulnerabilities will be found
  4. The full source code of every application in the organization

Explanation

Scoping defines the targets and boundaries so testing is authorized, focused, and legally defensible. Without clear targets and limits, testers risk testing out-of-scope assets or missing key systems.

Question 5Soft Skills and Assessment Management

Why should a tester obtain written authorization before beginning active testing?

  1. It provides legal protection and evidence that testing was permitted Correct answer.
  2. It removes the need to follow the rules of engagement
  3. It guarantees that all vulnerabilities will be remediated
  4. It allows the tester to test any system belonging to the client's partners

Explanation

Written authorization demonstrates that the client consented to testing, protecting the tester from legal liability and confirming the engagement is legitimate. It does not expand scope beyond what is documented.

Question 6Soft Skills and Assessment Management

When writing a penetration test report, which approach best serves a mixed audience of technical and executive readers?

  1. Provide an executive summary in business terms followed by detailed technical findings Correct answer.
  2. Use unexplained jargon throughout to demonstrate expertise
  3. Write only technical detail so nothing is lost in translation
  4. Write only a high-level summary and omit technical evidence

Explanation

A layered report lets executives grasp business risk from a summary while technical staff use detailed findings to remediate. Serving both audiences improves the report's usefulness and decision value.

Question 7Soft Skills and Assessment Management

What is the main benefit of assigning a risk rating to each finding in a report?

  1. It guarantees the vulnerability will be fixed within a set time
  2. It transfers legal liability for the vulnerability to the tester
  3. It helps the client prioritize remediation effort based on impact and likelihood Correct answer.
  4. It removes the need to describe the vulnerability in detail

Explanation

Risk ratings combine impact and likelihood to help clients focus limited resources on the most significant issues first. They support prioritization but do not replace detailed descriptions or guarantees.

Question 8Soft Skills and Assessment Management

A client asks the tester to pause testing because a production outage has occurred. What is the most professional response?

  1. Continue testing quietly so the schedule is not disrupted
  2. Stop testing immediately and confirm resumption only when the client approves Correct answer.
  3. Escalate the request to the tester's manager and keep testing meanwhile
  4. Terminate the engagement permanently and leave the site

Explanation

The client controls the operational environment, and a pause request should be honored immediately to avoid compounding an outage. Testing resumes only with explicit client approval, consistent with the rules of engagement.

Question 9Soft Skills and Assessment Management

Which practice best protects sensitive client data collected during an assessment?

  1. Storing all evidence in a shared public cloud folder for easy access
  2. Keeping evidence indefinitely in case it is needed later
  3. Emailing raw evidence to all team members for transparency
  4. Encrypting stored evidence and restricting access to authorized personnel Correct answer.

Explanation

Evidence should be protected with encryption and need-to-know access controls, and retained only as long as necessary. This reduces the risk of data leakage and complies with data protection obligations.

Question 10Soft Skills and Assessment Management

What does the term 'scope creep' refer to in an assessment engagement?

  1. The technique of escalating privileges on a target system
  2. The gradual expansion of testing beyond the originally agreed boundaries Correct answer.
  3. The scheduled rotation of testers between projects
  4. The process of writing the final report after testing

Explanation

Scope creep is the uncontrolled expansion of work beyond agreed limits, which can lead to unauthorized testing and unbudgeted effort. It should be managed through formal change control with the client.

Question 11Soft Skills and Assessment Management

A tester finds that a colleague has been testing an out-of-scope system. What is the most appropriate action?

  1. Ignore it because the colleague is more experienced
  2. Delete the evidence to avoid any record of the activity
  3. Report the deviation to the engagement lead so it can be addressed and disclosed Correct answer.
  4. Join in the testing to make the deviation worthwhile

Explanation

Out-of-scope activity must be escalated to the engagement lead so the client can be informed and any impact assessed. Hiding or repeating the deviation compounds the problem and breaches professional ethics.

Question 12Soft Skills and Assessment Management

Which statement best describes the purpose of a debrief session at the end of a penetration test?

  1. To negotiate the final invoice amount with the client
  2. To publicly announce the vulnerabilities discovered
  3. To walk the client through key findings and answer questions before remediation Correct answer.
  4. To begin the next engagement without closing the current one

Explanation

A debrief gives the client an opportunity to understand the findings, ask questions, and plan remediation with the tester present. It is a communication activity, not a commercial or public disclosure event.

Question 13Soft Skills and Assessment Management

When a tester is unsure whether a technique is permitted during an engagement, what should they do?

  1. Ask a colleague to perform the technique instead
  2. Assume permission because the engagement is generally authorized
  3. Proceed and apologize later if it turns out to be disallowed
  4. Seek clarification from the client contact before proceeding Correct answer.

Explanation

Ambiguity about permitted techniques should be resolved with the client before action is taken, since general authorization does not cover every technique. Clarifying first protects the client and the tester.

Question 14Soft Skills and Assessment Management

Why is it important to document the methodology used during a penetration test?

  1. It guarantees the client will pass a compliance audit
  2. It replaces the need to record individual findings
  3. It ensures the tester cannot be questioned on results
  4. It allows the results to be understood, verified, and repeated by others Correct answer.

Explanation

Documenting methodology provides transparency and reproducibility, enabling others to understand how results were obtained. It supports the credibility of findings without replacing detailed results or guaranteeing compliance.

Question 15Soft Skills and Assessment Management

Which behavior best demonstrates professional integrity for a penetration tester?

  1. Hiding a missed vulnerability discovered after the report was issued
  2. Sharing client data with third parties for personal gain
  3. Exaggerating the severity of findings to justify a larger invoice
  4. Reporting findings accurately, including those that reflect poorly on the tester's own work Correct answer.

Explanation

Integrity requires honest, accurate reporting even when it is uncomfortable for the tester. Exaggerating, concealing, or misusing data all undermine trust and breach professional standards.

Question 16Soft Skills and Assessment Management

A client requests that the tester only report vulnerabilities that are easy to fix. How should the tester respond?

  1. Explain that all material findings should be reported and document the client's request Correct answer.
  2. Report only the hardest findings to prove a point
  3. Refuse to deliver any report at all
  4. Comply fully and omit the harder-to-fix findings from the report

Explanation

A tester has a duty to report all material findings accurately, regardless of remediation difficulty. The client's request should be noted, but suppressing findings undermines the report's integrity and the client's risk awareness.

Question 17Soft Skills and Assessment Management

What is the most appropriate way to handle a disagreement with a client over the severity rating of a finding?

  1. Remove the finding entirely to keep the client satisfied
  2. Discuss the rationale openly and document any agreed adjustment with justification Correct answer.
  3. Quietly change the rating without discussion to avoid conflict
  4. Refuse to discuss the matter and insist on the original rating

Explanation

Severity disagreements should be resolved through transparent discussion, with any change justified and recorded so the report remains accurate. Silent changes or removal of findings compromise integrity.

Question 18Soft Skills and Assessment Management

Which action best supports a tester's professional development between engagements?

  1. Relying solely on tools without learning underlying concepts
  2. Avoiding feedback from peers to preserve confidence
  3. Repeating the same approach on every engagement without review
  4. Reviewing past reports and pursuing relevant training and certifications Correct answer.

Explanation

Reflecting on past work and pursuing structured learning keeps skills current and improves quality. Avoiding feedback or relying only on tools limits growth and effectiveness.

Question 19Soft Skills and Assessment Management

Why should a tester avoid discussing an active engagement on social media, even in vague terms?

  1. It always results in immediate legal prosecution
  2. Vague references can still leak confidential details and breach the agreement Correct answer.
  3. It has no effect on client confidentiality
  4. Social media is banned in all professional contexts

Explanation

Even indirect references can reveal confidential information or tip off attackers, breaching confidentiality obligations. Discretion protects the client and the integrity of the engagement.

Question 20Soft Skills and Assessment Management

A tester is asked to test a system hosted by a third-party provider. What must be confirmed before testing begins?

  1. That the tester's own equipment is fully insured
  2. That the third-party provider has authorized testing of the hosted system Correct answer.
  3. That the client's marketing team approves the testing schedule
  4. That the provider's staff will all be on holiday during testing

Explanation

Testing a third-party hosted system requires authorization from the provider as well as the client, since they are separate parties with their own rights and terms. Without this, testing may breach the provider's agreements.

Question 21Soft Skills and Assessment Management

What is the best approach to managing time when an engagement has a fixed deadline and many targets?

  1. Skip documentation to save time for testing
  2. Prioritize targets by risk and agree the prioritization with the client upfront Correct answer.
  3. Test targets in random order until time runs out
  4. Spend all available time on the first target encountered

Explanation

Risk-based prioritization agreed with the client ensures the most important targets are covered within the deadline. Random or unbalanced allocation wastes effort and skipping documentation undermines the deliverable.

Question 22Soft Skills and Assessment Management

Why is it important for a tester to establish the client's expectations for the final report format before testing begins?

  1. It removes the need to verify findings during testing
  2. It guarantees the report will contain no errors
  3. It allows the tester to omit findings that do not fit the format
  4. It ensures the deliverable meets the client's decision-making and compliance needs Correct answer.

Explanation

Agreeing the report format upfront aligns the deliverable with how the client will use it, such as for compliance or management decisions. It does not reduce the need for accurate findings or verification.

Question 23Soft Skills and Assessment Management

A tester realizes mid-engagement that a key assumption made during scoping was wrong. What is the most appropriate course of action?

  1. Continue silently with the original plan to avoid disruption
  2. Raise it with the client promptly and agree any adjustment to scope or approach Correct answer.
  3. Abandon the engagement without explanation
  4. Expand testing indefinitely to cover every possibility

Explanation

Changed circumstances should be communicated promptly so scope and approach can be adjusted transparently with the client. Silence or uncontrolled expansion both create risk and misalignment.

Question 24Core Technical Skills

Which TCP flag is set in the first packet of a standard connection handshake to request synchronisation of sequence numbers?

  1. SYN Correct answer.
  2. RST
  3. ACK
  4. FIN

Explanation

A TCP connection begins with a synchronise segment carrying the SYN flag so both hosts can agree initial sequence numbers before data flows. The receiving host replies with SYN-ACK, and the initiator completes the exchange with ACK.

Question 25Core Technical Skills

A host is configured with IP address 192.168.10.130 and subnet mask 255.255.255.192. Which address is the directed broadcast address of its subnet?

  1. 192.168.10.129
  2. 192.168.10.191 Correct answer.
  3. 192.168.10.255
  4. 192.168.10.127

Explanation

A /26 mask gives subnet blocks of 64 addresses; 130 falls in the block 128-191, whose broadcast address is the last address of the block, 191. The broadcast address is the subnet base plus block size minus one.

Question 26Core Technical Skills

Which protocol resolves an IPv4 address to a MAC address on a local network segment?

  1. ICMP
  2. DHCP
  3. DNS
  4. ARP Correct answer.

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address and caches the reply mapping to a MAC address. DNS maps names to addresses, DHCP assigns configuration, and ICMP carries diagnostic messages.

Question 27Core Technical Skills

Which HTTP response status code class indicates that the client must take further action, such as following a redirect?

  1. 4xx
  2. 5xx
  3. 3xx Correct answer.
  4. 2xx

Explanation

The 3xx class signals redirection or other client-side follow-up actions needed to complete the request. 2xx means success, 4xx means a client error, and 5xx means a server error.

Question 28Core Technical Skills

Which TLS record type carries the handshake messages that negotiate cipher suites and exchange key material?

  1. Handshake Correct answer.
  2. Alert
  3. Change Cipher Spec
  4. Application Data

Explanation

The handshake record type encapsulates messages such as ClientHello, ServerHello, and key exchange that establish session parameters. Application Data carries protected payload, Alert carries errors, and Change Cipher Spec signals a switch to negotiated protection.

Question 29Core Technical Skills

An analyst sees repeated DNS responses containing many A records for a single hostname, each with a very low TTL, from a domain registered days earlier. Which technique does this most suggest?

  1. Zone transfer abuse
  2. Fast-flux networking Correct answer.
  3. DNS tunnelling
  4. Domain fronting

Explanation

Fast flux rapidly rotates many A records with short TTLs so the resolving address changes constantly, frustrating takedown and blocking. DNS tunnelling instead encodes data in queries, domain fronting hides the true destination behind a CDN, and zone transfers copy a whole zone.

Question 30Core Technical Skills

What is the primary purpose of a DMZ in a network architecture?

  1. To encrypt all traffic between internal hosts
  2. To provide redundancy for core routers
  3. To isolate internet-facing services from the internal network Correct answer.
  4. To store backups of internal file servers

Explanation

A DMZ is a segmented zone hosting externally reachable services so that compromise of those services does not grant direct access to the internal network. Firewall rules restrict traffic between the DMZ, the internet, and the internal LAN.

Question 31Core Technical Skills

Which Nmap scan type completes the TCP three-way handshake before closing the connection?

  1. FIN scan (-sF)
  2. TCP connect scan (-sT) Correct answer.
  3. SYN scan (-sS)
  4. NULL scan (-sN)

Explanation

A TCP connect scan uses the operating system's connect call, so a full handshake is completed for each probed port. SYN scanning stops after the SYN-ACK, and FIN and NULL scans send non-standard flag combinations that never complete a handshake.

Question 32Core Technical Skills

An IPv6 host needs to discover the link-layer address of a neighbour on the same link. Which mechanism does IPv6 use?

  1. BOOTP
  2. ARP
  3. NDP neighbour solicitation Correct answer.
  4. RARP

Explanation

IPv6 replaces ARP with Neighbor Discovery Protocol, where a neighbour solicitation is sent to a solicited-node multicast address and answered with a neighbour advertisement. ARP, RARP, and BOOTP are IPv4-era mechanisms.

Question 33Core Technical Skills

Which element of the CIA triad is most directly affected when an attacker alters the amount on a bank transfer record in transit?

  1. Confidentiality
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity concerns the accuracy and completeness of data, so unauthorised modification of a transfer amount is an integrity violation. Confidentiality concerns disclosure, availability concerns timely access, and non-repudiation concerns proving an action occurred.

Question 34Core Technical Skills

Which hashing property prevents an attacker from finding any two different inputs that produce the same digest?

  1. Pre-image resistance
  2. Avalanche effect
  3. Salting
  4. Collision resistance Correct answer.

Explanation

Collision resistance means it is computationally infeasible to find any two distinct inputs with the same hash output. Pre-image resistance concerns reversing a given digest, the avalanche effect describes output sensitivity, and salting changes input before hashing.

Question 35Core Technical Skills

A web application stores user passwords as unsalted MD5 digests. Which attack is most directly enabled against the stored values?

  1. Rainbow table lookup Correct answer.
  2. SQL injection
  3. Cross-site scripting
  4. Session fixation

Explanation

Unsalted fast hashes allow precomputed rainbow tables to map digests back to common passwords instantly. Salting and slow key-derivation functions such as bcrypt or Argon2 defeat this approach.

Question 36Core Technical Skills

Which access control model assigns permissions based on a user's job function rather than on individual identity?

  1. Mandatory access control
  2. Role-based access control Correct answer.
  3. Discretionary access control
  4. Rule-based access control

Explanation

Role-based access control grants rights to roles and assigns users to roles matching their responsibilities, simplifying administration. DAC lets owners set permissions, MAC enforces labels, and rule-based control applies global conditional rules.

Question 37Core Technical Skills

An attacker injects the payload ' OR '1'='1 into a login form and is authenticated without valid credentials. Which weakness does this exploit?

  1. Missing input validation leading to SQL injection Correct answer.
  2. Broken session management
  3. Improper output encoding
  4. Insecure direct object reference

Explanation

The payload alters the SQL query's WHERE clause so it always evaluates true, which is SQL injection caused by concatenating untrusted input into queries. Parameterised queries and strict validation prevent it.

Question 38Core Technical Skills

Which defence most effectively mitigates cross-site scripting in a web application?

  1. Disabling HTTP Strict Transport Security
  2. Context-aware output encoding of untrusted data Correct answer.
  3. Using HTTP GET for state-changing requests
  4. Storing session tokens in localStorage

Explanation

Context-aware output encoding converts untrusted data into safe form for the specific HTML, attribute, or script context, preventing injected script execution. A Content Security Policy adds defence in depth.

Question 39Core Technical Skills

A site accepts a request that changes a user's email address using only the victim's ambient session cookie. Which vulnerability class does this describe?

  1. Clickjacking
  2. Open redirect
  3. Cross-site request forgery Correct answer.
  4. Server-side request forgery

Explanation

CSRF abuses the browser's automatic inclusion of credentials to make an authenticated victim submit an unintended state-changing request. Anti-CSRF tokens and SameSite cookies mitigate it.

Question 40Core Technical Skills

Which control most directly limits the impact of a successful SQL injection by restricting what a compromised query can do?

  1. Using a least-privilege database account Correct answer.
  2. Enabling verbose error messages
  3. Disabling parameterised queries
  4. Increasing the connection pool size

Explanation

A least-privilege account limits the operations and objects a successful injection can reach, reducing blast radius. Parameterised queries remain the primary preventive control.

Question 41Core Technical Skills

Which file permission octal value grants the owner read, write, and execute, the group read and execute, and others no access?

  1. 755
  2. 760
  3. 750 Correct answer.
  4. 640

Explanation

Permissions are read as owner, group, and other digits, where read=4, write=2, execute=1. Owner rwx is 7, group r-x is 5, and others --- is 0, giving 750.

Question 42Core Technical Skills

Which Linux command displays the network connections currently listening on TCP ports together with their owning processes?

  1. ps aux
  2. uptime
  3. ss -lptn Correct answer.
  4. df -h

Explanation

The ss utility reports socket statistics, and the combined flags list listening TCP sockets with process information and numeric ports. ps shows processes, df shows filesystem usage, and uptime shows load and uptime.

Question 43Core Technical Skills

During triage an analyst must decide whether an alert indicates a genuine compromise. Which factor most strongly raises confidence that an event is malicious rather than benign?

  1. The event was generated by a single host
  2. The event occurred outside business hours
  3. The event matches a known attack pattern and correlates with other suspicious activity Correct answer.
  4. The alert volume is high

Explanation

Confidence increases when behaviour matches known adversary techniques and is corroborated by related events across sources. Time of day, host count, and raw volume are weak indicators that generate false positives.

Question 44Core Technical Skills

Which cryptographic concept ensures that a party cannot later deny having signed a message?

  1. Hashing alone
  2. Key exchange
  3. Digital signature Correct answer.
  4. Symmetric encryption

Explanation

A digital signature binds a message to the signer's private key, and any party can verify it with the public key, providing non-repudiation. Symmetric encryption and plain hashing do not bind identity.

Question 45Core Technical Skills

An organisation wants to detect tampering with log files after they are written. Which control best supports this?

  1. Forwarding logs to a remote server and applying cryptographic integrity protection Correct answer.
  2. Compressing the logs on the same server
  3. Increasing the log verbosity level
  4. Rotating log files daily

Explanation

Shipping logs to a separate system and protecting them with hashes or signatures means an attacker who compromises the source host cannot silently alter the retained records. Local compression, rotation, and verbosity do not provide tamper evidence.

Question 46Core Technical Skills

Which Windows feature provides a centralised directory service for authenticating users and computers in a domain?

  1. Task Scheduler
  2. Windows Defender Firewall
  3. Windows Registry
  4. Active Directory Correct answer.

Explanation

Active Directory stores directory objects and provides domain authentication and authorisation via protocols such as Kerberos and LDAP. The registry stores configuration, Task Scheduler runs jobs, and the firewall filters traffic.

Question 47Background Information Gathering and Open Source

Which DNS record type maps a hostname to an IPv4 address?

  1. MX
  2. CNAME
  3. A Correct answer.
  4. TXT

Explanation

An A (address) record resolves a name to an IPv4 address. Other record types serve different purposes such as mail routing or aliasing.

Question 48Background Information Gathering and Open Source

What does the WHOIS service primarily provide?

  1. The source code of a web application
  2. A live map of network packet routes
  3. The encrypted contents of a website's pages
  4. Registration and ownership details for a domain or IP block Correct answer.

Explanation

WHOIS returns registration data such as registrar, registrant, and allocation details for domains and IP ranges. It does not expose page content, routes, or application code.

Question 49Background Information Gathering and Open Source

In search-engine reconnaissance, what is a Google dork?

  1. A type of firewall rule for filtering traffic
  2. A browser extension that blocks tracking cookies
  3. A password-cracking dictionary file
  4. A crafted search query using advanced operators to surface specific results Correct answer.

Explanation

Dorks combine advanced search operators (such as site:, filetype:, inurl:) to narrow results toward exposed or sensitive content. They are search queries, not software or network rules.

Question 50Background Information Gathering and Open Source

Which protocol is used to transfer files anonymously from public archive servers during reconnaissance?

  1. SNMP
  2. SMTP
  3. FTP Correct answer.
  4. NTP

Explanation

Anonymous FTP allows unauthenticated downloads from public file servers, which can reveal documents and data. SMTP, SNMP, and NTP serve mail, management, and time synchronization respectively.