CREST CCT case studies

CREST CCT · Put your knowledge to work in context.

The CREST Certified Tester (CCT) is a professional certification offered by CREST, a not-for-profit body that accredits and certifies cyber security service providers and their people. The CCT sits in CREST's skills and certifications pathway alongside its other tester qualifications, and is aimed at hands-on penetration testers and security consultants who want independent, vendor-neutral evidence of their practical testing ability. The CREST CCT case studies are 5 cases and about 3,708 words.

The dual-homed historian: availability constraints in a live utility

You are on day two of a five-day on-site assessment for a water utility. The scope names the corporate IT network (10.10.0.0/16) and 'the SCADA historian at 10.20.4.15'.

750 words, about 4 min 2

Scanner critical versus backported patch: triage under deadline

A retail client's internal network scan returns 312 findings. One is a CVSS 9.8 'critical' deserialization issue on a JBoss 6.1.0 application server on the payment VLAN.

743 words, about 4 min 3

Domain admin and the HR share: where proof stops

During an internal Active Directory assessment for a 4,000-user logistics company, you request a Kerberoastable service account ticket and crack the password in 14 minutes (it is 'Summer2023!'). The account has local admin on a file server.

730 words, about 4 min 4

The acquisition, the board summary and a screenshot full of PII

You are lead tester writing the report for a 10-day external and internal test of a 900-staff insurance broker. You found a critical SQL injection in the policy quote portal that returns 1.2 million quote records including names, addresses and dates of birth; the fix is scheduled for the next sprint in three weeks.

754 words, about 4 min 5

WAF friction, an adjacent host and 180 untested IPs

You have a four-day external test of a client's 250 public IP addresses. The rules of engagement authorize the listed ranges only, prohibit denial-of-service, and allow testing at any time.

731 words, about 4 min