I85PREP
⌘ K
CREST CCT study materials
CREST CCT study resources

CREST CCT practice questions

One question at a time. Build your CREST CCT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security testing and assessment methodology

During a scoping meeting, the client asks which activity formally authorizes a penetration test and defines its boundaries. Which document should the tester obtain before active testing begins?

  1. A network topology diagram provided by the operations team
  2. A signed rules-of-engagement and authorization letter Correct answer.
  3. A vulnerability disclosure policy published on the website
  4. A verbal approval recorded in the kickoff meeting minutes

Explanation

Written authorization and rules of engagement establish legal cover, define in-scope targets, time windows, and prohibited actions before any active testing occurs. A verbal approval or published policy does not grant target-specific permission to the tester.

Question 2Security testing and assessment methodology

A tester plans an engagement against a production web application and wants to minimize business disruption. Which methodology choice best reflects a risk-averse assessment approach?

  1. Disable application logging so tests are not attributed to the tester
  2. Run aggressive automated exploitation during peak trading hours
  3. Test only after the report is drafted so findings can be confirmed
  4. Schedule intrusive tests in an agreed maintenance window with rollback plans Correct answer.

Explanation

Risk-averse testing schedules intrusive activity in agreed low-impact windows and prepares rollback or recovery steps. This reduces the chance of outages affecting real users while preserving test validity.

Question 3Security testing and assessment methodology

Which testing approach gives a tester no prior knowledge of internal architecture, credentials, or source code, simulating an external attacker?

  1. Gray-box testing
  2. Glass-box testing
  3. White-box testing
  4. Black-box testing Correct answer.

Explanation

Black-box testing provides no internal information, so the tester must discover the attack surface as an outsider would. White-box and gray-box approaches supply varying levels of internal knowledge to increase coverage or efficiency.

Question 4Security testing and assessment methodology

A tester is building a threat model for a new payment service before testing begins. Which sequence best represents a structured threat modeling process?

  1. Exploit the service, then document which attacks succeeded
  2. Interview only the developers, then write the final report
  3. Purchase a scanner license, then run it against the staging environment
  4. Enumerate assets and trust boundaries, identify threats, then rate and prioritize them Correct answer.

Explanation

Threat modeling starts by decomposing the system into assets, components, and trust boundaries, then systematically identifies threats and rates them by likelihood and impact. Prioritized threats then guide where testing effort is concentrated.

Question 5Security testing and assessment methodology

A tester must decide between manual review and automated scanning for a large legacy codebase. Which statement best describes the complementary roles of these techniques?

  1. Manual review should be avoided because it is subjective
  2. Automated scanners fully replace manual review for logic flaws
  3. Manual review finds design and business-logic issues that scanners typically miss Correct answer.
  4. Automated scanning is only useful for compiled binaries

Explanation

Automated tools excel at pattern-matching known vulnerability classes at scale, while human reviewers reason about business logic, authorization design, and context-dependent flaws. Effective assessment programs combine both to maximize coverage.

Question 6Security testing and assessment methodology

An assessor is asked to verify that a web application enforces authorization on every object request. Which test design most directly targets this control?

  1. Enumerate server versions from response banners
  2. Request objects belonging to another user's account using a valid low-privilege session Correct answer.
  3. Fuzz the login form with common passwords
  4. Measure page load times under load

Explanation

Authorization testing requires attempting to access resources owned by other users or higher-privilege roles while authenticated as a low-privilege user. Success or failure of those cross-object requests reveals whether access control is enforced server-side.

Question 7Security testing and assessment methodology

Which metric best indicates whether a testing program is improving the organization's security posture over time?

  1. Average length of the final report
  2. Total count of raw scanner alerts generated
  3. Trend in confirmed findings that recur across successive assessments Correct answer.
  4. Number of tools installed in the testing lab

Explanation

Recurring confirmed findings across assessments show whether previously identified weaknesses are actually being remediated. Raw alert counts and tool inventories measure activity, not posture improvement.

Question 8Security testing and assessment methodology

Before beginning an internal network assessment, a tester wants to confirm the target IP ranges match what the client intends. Which action best supports this?

  1. Confirm in-scope ranges and exclusions in writing with the client contact Correct answer.
  2. Ask a colleague who previously worked at the client
  3. Assume the default corporate subnet is in scope
  4. Scan the entire private address space to be thorough

Explanation

Scope confirmation must be explicit and documented, including excluded ranges that may host critical or third-party systems. Scanning beyond agreed scope can cause outages and legal exposure.

Question 9Security testing and assessment methodology

A tester wants to establish a repeatable baseline of a target's exposed services before deeper testing. Which activity best describes this reconnaissance phase?

  1. Service and port enumeration to map the attack surface Correct answer.
  2. Exploiting a known vulnerability to gain a shell
  3. Patching the target to observe remediation
  4. Writing the executive summary of the report

Explanation

Reconnaissance maps the attack surface by identifying live hosts, open ports, and service versions, providing the baseline for later testing. Exploitation, reporting, and remediation occur in later phases.

Question 10Security testing and assessment methodology

An application uses a valid session token but the tester observes that the token is accepted after logout. Which vulnerability class does this behavior indicate?

  1. Cross-site request forgery
  2. Insecure direct object reference
  3. Session fixation on login
  4. Insufficient session expiration on logout Correct answer.

Explanation

If a session token remains valid after logout, the server is failing to invalidate sessions, allowing reuse of a stolen or captured token. Proper logout handling must destroy server-side session state.

Question 11Security testing and assessment methodology

A tester is validating input handling on a search function and wants to determine whether the backend concatenates user input into SQL. Which test approach is most appropriate?

  1. Disable JavaScript in the browser
  2. Submit payloads containing quote characters and boolean expressions and compare responses Correct answer.
  3. Upload a large file to the endpoint
  4. Change the HTTP method from GET to PUT

Explanation

Injecting quote characters and boolean expressions and observing differential responses is the standard technique for detecting SQL injection. Response differences reveal whether input alters query structure.

Question 12Security testing and assessment methodology

During a gray-box assessment, the client provides a low-privilege account. Why is this valuable for testing?

  1. It guarantees the tester can access administrative functions
  2. It removes the need for any reconnaissance
  3. It allows the tester to bypass all authentication controls
  4. It enables testing of privilege escalation and authorization from a realistic starting point Correct answer.

Explanation

A low-privilege account lets the tester attempt horizontal and vertical privilege escalation from a realistic user position. It does not bypass authentication or eliminate reconnaissance.

Question 13Security testing and assessment methodology

A tester reports that a web application returns detailed stack traces on malformed input. Which assessment conclusion is most defensible?

  1. The application is confirmed vulnerable to remote code execution
  2. Error handling leaks implementation details that aid attackers Correct answer.
  3. The server is running an unsupported operating system
  4. The application has no input validation at all

Explanation

Verbose error output discloses internal details such as framework versions and file paths, which assists attackers in refining attacks. It is an information disclosure issue and does not by itself prove code execution or total absence of validation.

Question 14Security testing and assessment methodology

An assessor needs to test file upload functionality safely. Which practice best balances thoroughness with safety?

  1. Skip upload testing because it is too risky
  2. Upload files until the disk is full to test limits
  3. Use a controlled test payload and verify server-side validation without executing harmful code Correct answer.
  4. Upload a live web shell directly to the production server

Explanation

Safe upload testing uses benign payloads to determine whether server-side validation of type, content, and storage location is enforced. This confirms control effectiveness without introducing harmful code.

Question 15Security testing and assessment methodology

A tester is designing test cases for an API that uses JSON Web Tokens. Which check most directly validates token integrity enforcement?

  1. Log the token to a file for later review
  2. Modify the token payload and signature and confirm the server rejects it Correct answer.
  3. Change the token's HTTP header name
  4. Measure token length

Explanation

Tampering with the payload or signature and confirming rejection verifies that the server validates token integrity. Accepting a modified token indicates missing or flawed signature verification.

Question 16Security testing and assessment methodology

A client asks whether a finding should be rated critical. Which factor combination best supports a critical rating?

  1. Informational disclosure of public information
  2. High impact and easy remote exploitation without authentication Correct answer.
  3. Low impact and difficult exploitation
  4. Medium impact requiring local access

Explanation

Critical ratings typically combine high business or technical impact with easy, unauthenticated remote exploitation. This combination represents the greatest realistic risk and warrants urgent remediation.

Question 17Security testing and assessment methodology

A tester wants to ensure that a retest confirms remediation rather than merely observing a changed response. Which approach is most rigorous?

  1. Re-run the original proof-of-concept and verify the vulnerable behavior no longer occurs Correct answer.
  2. Ask the developer to confirm the fix verbally
  3. Review the change log entry for the fix
  4. Check that the application version number increased

Explanation

A rigorous retest reproduces the original exploit attempt and confirms the vulnerable behavior is blocked while normal functionality still works. Verbal assurances, version changes, and changelogs do not prove the vulnerability is closed.

Question 18Security testing and assessment methodology

A tester must assess a mobile application's handling of sensitive data. Which test provides the most direct evidence of insecure local storage?

  1. Check the app store rating
  2. Review the marketing screenshots
  3. Measure the app's battery consumption
  4. Inspect the app's private data directory on a rooted test device for plaintext secrets Correct answer.

Explanation

Examining the application's private storage on a controlled device reveals whether secrets, tokens, or personal data are stored in plaintext. This directly demonstrates insecure local storage.

Question 19Security testing and assessment methodology

An organization wants assurance that its detection capability works, not just that vulnerabilities exist. Which testing objective addresses this?

  1. Vulnerability scanning only
  2. Adversary emulation with monitoring of whether alerts fire Correct answer.
  3. Source code linting
  4. Compliance checklist review

Explanation

Adversary emulation tests detection and response by executing realistic attacker techniques while observing whether monitoring generates alerts. This measures defensive capability rather than only identifying weaknesses.

Question 20Security testing and assessment methodology

A tester is preparing a report and must prioritize findings. Which presentation best serves both technical and executive audiences?

  1. Only screenshots without narrative
  2. A list of CVEs without business context
  3. An executive summary with risk context followed by detailed technical findings Correct answer.
  4. A single unsorted list of raw tool output

Explanation

Reports should lead with an executive summary framing risk in business terms, then provide detailed technical findings with evidence and remediation guidance. This structure serves both decision-makers and engineers.

Question 21Security testing and assessment methodology

A tester observes that an application uses sequential numeric identifiers in URLs and can retrieve other users' invoices by changing the number. Which control failure is most directly demonstrated?

  1. Absent rate limiting
  2. Missing server-side object-level authorization Correct answer.
  3. Insufficient password complexity
  4. Weak transport encryption

Explanation

Retrieving another user's invoice by changing an identifier demonstrates missing object-level authorization, often called IDOR. The server must verify that the authenticated user owns or may access the requested object.

Question 22Security testing and assessment methodology

A red team wants to test whether segmentation between a corporate network and a payment zone is effective. Which approach provides the strongest evidence?

  1. Attempt controlled lateral movement from a corporate host toward the payment zone and observe results Correct answer.
  2. Review the firewall rule export only
  3. Scan the payment zone from an already-authorized payment host
  4. Ask the network team whether segmentation is configured

Explanation

Segmentation is proven by attempting controlled movement across the boundary from a realistic starting position and observing whether it is blocked. Rule reviews and interviews describe intended configuration, not effective enforcement.

Question 23Security testing and assessment methodology

A tester finds that an application accepts a JWT with the algorithm set to 'none' and no signature. What is the most accurate characterization of the risk?

  1. Signature verification can be bypassed, allowing forged tokens Correct answer.
  2. The token uses an outdated character encoding
  3. The token lifetime is too short
  4. The token is encrypted with a weak cipher

Explanation

Accepting an unsigned token with algorithm 'none' means the server is not enforcing signature verification, enabling attackers to forge arbitrary claims. This is an authentication bypass risk requiring strict algorithm allowlisting.

Question 24Security testing and assessment methodology

During an assessment, a tester discovers a critical vulnerability in a production system outside the agreed scope. What is the most appropriate course of action?

  1. Exploit it fully to demonstrate maximum impact
  2. Publish the finding to a public disclosure platform
  3. Ignore it and omit it from the report
  4. Stop testing it, document the observation, and notify the client contact promptly Correct answer.

Explanation

Out-of-scope discoveries should not be exploited further; the tester documents what was observed and notifies the client so they can authorize follow-up. This respects scope and legal boundaries while protecting the client.

Question 25Security testing and assessment methodology

A tester wants to reduce false positives from a static analysis tool before reporting. Which practice is most effective?

  1. Lower the tool's severity threshold to zero
  2. Delete alerts that seem unlikely
  3. Report every alert exactly as generated
  4. Manually triage alerts by tracing data flow to confirm exploitability Correct answer.

Explanation

Manual triage that traces tainted data from source to sink confirms whether an alert represents a real, exploitable path. This reduces false positives and produces credible findings.

Question 26Security testing and assessment methodology

An assessor is planning a black-box penetration test of an internet-facing web application. Which activity is appropriate during the reconnaissance phase before any exploitation attempts?

  1. Injecting payloads into login forms to observe error behavior
  2. Exploiting a suspected SQL injection point to confirm database access
  3. Attempting credential brute force against the authentication endpoint
  4. Enumerating publicly available DNS records, subdomains, and technology fingerprints Correct answer.

Explanation

Reconnaissance gathers information about the target's footprint without directly attacking it, so passive and low-impact enumeration of DNS, subdomains, and technology banners fits this phase. Active exploitation and credential attacks belong to later phases and carry higher risk.

Question 27Security testing and assessment methodology

Which testing methodology is characterized by testers having no prior knowledge of the target's internal design, source code, or architecture?

  1. Gray-box testing
  2. White-box testing
  3. Black-box testing Correct answer.
  4. Glass-box testing

Explanation

Black-box testing simulates an external attacker with no internal knowledge, so the tester relies only on observable behavior. Gray-box and white-box methods provide partial or full internal information respectively.

Question 28Security testing and assessment methodology

A tester is scoping an engagement and needs to define what systems, accounts, and techniques are permitted. Which document primarily governs this?

  1. The remediation tracker
  2. The vulnerability severity matrix
  3. The rules of engagement Correct answer.
  4. The final penetration test report

Explanation

Rules of engagement define scope, permitted techniques, timing, and constraints for the assessment. Reports, severity matrices, and trackers are outputs or references used during or after testing, not the authorization boundary.

Question 29Security testing and assessment methodology

Which term describes the process of confirming that a reported vulnerability is genuinely exploitable rather than a tool artifact?

  1. Validation Correct answer.
  2. Fingerprinting
  3. Prioritization
  4. Enumeration

Explanation

Validation is the step where a tester manually reproduces and confirms a finding to distinguish real issues from false positives. Enumeration and fingerprinting are discovery activities, and prioritization ranks findings after validation.

Question 30Security testing and assessment methodology

A tester is preparing a test plan and wants to align activities with a widely used open standard for security testing execution. Which reference framework is most appropriate?

  1. NIST CSF
  2. PTES Correct answer.
  3. PCI DSS
  4. ISO 27001

Explanation

PTES (Penetration Testing Execution Standard) provides a structured methodology for executing penetration tests from pre-engagement through reporting. ISO 27001, PCI DSS, and NIST CSF are governance, compliance, and risk frameworks rather than execution methodologies.

Question 31Security testing and assessment methodology

During a web application assessment, a tester needs to map all input vectors including headers, cookies, and hidden form fields. Which practice best supports comprehensive coverage?

  1. Testing only the visible form fields in the browser
  2. Reviewing server logs after the engagement
  3. Scanning with a single automated tool and accepting its output
  4. Intercepting and reviewing all client-server traffic through a proxy Correct answer.

Explanation

A proxy reveals the complete request surface, including headers, cookies, and hidden parameters that are not visible in the rendered page. Relying on visible fields or a single scanner leaves input vectors untested.

Question 32Security testing and assessment methodology

Which activity best demonstrates that a testing program follows a consistent, reproducible process across engagements?

  1. Documenting a standard methodology with defined phases and deliverables Correct answer.
  2. Running only automated scanners on every target
  3. Reusing the same report template without changes
  4. Assigning testers without defined roles

Explanation

A documented methodology with defined phases and deliverables makes engagements repeatable and auditable. Scanner-only testing, static templates, and undefined roles reduce consistency and quality.

Question 33Security testing and assessment methodology

A tester is about to begin an assessment and wants to confirm that testing will not disrupt production. Which planning element most directly addresses this concern?

  1. Choosing a random start date
  2. Agreeing on testing windows and acceptable impact levels Correct answer.
  3. Relying on the client to notice outages
  4. Skipping the kickoff meeting

Explanation

Agreeing on testing windows and acceptable impact levels in the rules of engagement directly controls disruption risk. Random timing, skipped coordination, and passive detection increase the chance of unplanned outages.

Question 34Security testing and assessment methodology

A tester is assessing an application and wants to determine whether it distinguishes between valid and invalid usernames during login. Which testing approach most directly evaluates this?

  1. Measuring page load time of the homepage
  2. Comparing response content, timing, and status codes for valid versus invalid usernames Correct answer.
  3. Reviewing the application's marketing pages
  4. Checking whether the login page uses HTTPS

Explanation

Username enumeration is detected by comparing observable differences such as message content, response timing, and status codes between existing and non-existing accounts. Marketing pages, transport security, and homepage timing do not reveal account validity differences.

Question 35Security testing and assessment methodology

During an assessment, a tester wants to verify that session identifiers are resistant to prediction. Which test design is most appropriate?

  1. Collecting many session tokens and analyzing their randomness and structure Correct answer.
  2. Checking that cookies have the HttpOnly flag set
  3. Confirming the login page uses a CAPTCHA
  4. Verifying that passwords meet complexity rules

Explanation

Token predictability is assessed by collecting a large sample and analyzing entropy, structure, and patterns. Flags, CAPTCHAs, and password policies address different controls and do not test randomness.

Question 36Security testing and assessment methodology

A tester is evaluating an application's error handling and wants to determine whether verbose errors leak internal implementation details. Which observation provides the strongest evidence?

  1. Responses using HTTP/2 instead of HTTP/1.1
  2. Responses returning generic 500 pages
  3. Responses including a request ID header
  4. Responses containing framework names, file paths, and stack traces Correct answer.

Explanation

Verbose errors that expose framework names, file paths, or stack traces directly reveal internal implementation details. Generic error pages and protocol or request-ID headers do not disclose such information.

Question 37Security testing and assessment methodology

A tester wants to assess whether an application is vulnerable to server-side request forgery. Which test approach is most direct?

  1. Testing password reset email delivery
  2. Checking whether the application uses CSRF tokens
  3. Reviewing the TLS certificate chain
  4. Supplying a URL parameter that points to an internal address and observing the server's response Correct answer.

Explanation

SSRF is confirmed by inducing the server to fetch an attacker-controlled or internal URL and observing whether the request is made. CSRF tokens, email delivery, and TLS chains address unrelated controls.

Question 38Security testing and assessment methodology

An assessor is testing a REST API and wants to verify that it enforces object-level authorization. Which test design is most appropriate?

  1. Checking that the API returns JSON instead of XML
  2. Sending malformed JSON to observe parser errors
  3. Measuring response time under load
  4. Using a low-privilege token to request resources belonging to another user Correct answer.

Explanation

Object-level authorization is tested by attempting to access another user's resources with a lower-privilege identity and confirming access is denied. Parser errors, content type, and performance do not evaluate authorization.

Question 39Security testing and assessment methodology

A tester wants to determine whether a web application is susceptible to cross-site scripting through a reflected parameter. Which approach is most reliable?

  1. Reviewing the application's privacy policy
  2. Checking whether the page uses a Content Security Policy header
  3. Testing whether cookies are marked Secure
  4. Submitting a benign script payload and confirming it executes in the response context Correct answer.

Explanation

Reflected XSS is confirmed by injecting a benign payload and verifying that it executes in the returned page context. CSP headers, privacy policies, and cookie flags are related controls but do not by themselves confirm execution.

Question 40Security testing and assessment methodology

During a network assessment, a tester wants to identify live hosts and open ports without triggering intrusion prevention alerts. Which approach best balances discovery with low noise?

  1. Running a full aggressive scan of all ports at maximum rate
  2. Broadcasting ICMP to the entire subnet repeatedly
  3. Scanning only port 80 on every host
  4. Using slow timing templates and targeted port scans Correct answer.

Explanation

Slow timing templates with targeted ports reduce the scan signature and avoid IPS triggers while still discovering relevant services. Aggressive full scans and repeated broadcasts are noisy, and scanning a single port misses services.

Question 41Security testing and assessment methodology

A tester is evaluating whether an application's file inclusion functionality can read arbitrary local files. Which test is most direct?

  1. Supplying a traversal sequence targeting a known system file and observing the output Correct answer.
  2. Checking whether directory listing is enabled
  3. Uploading a large file to test storage limits
  4. Reviewing the application's robots.txt

Explanation

Local file inclusion is confirmed by using traversal sequences to request a known file and observing whether its contents are returned. Upload limits, directory listing, and robots.txt address different behaviors.

Question 42Security testing and assessment methodology

An assessor wants to test whether an application enforces authorization on administrative functions. Which test design is most appropriate?

  1. Checking whether the admin panel uses HTTPS
  2. Requesting admin endpoints with a standard user session and checking for denial Correct answer.
  3. Testing the admin login page for weak password policy
  4. Reviewing admin documentation for feature lists

Explanation

Administrative authorization is tested by attempting to reach admin functions with a lower-privileged session and confirming access is denied. Password policy, transport security, and documentation do not evaluate function-level access control.

Question 43Security testing and assessment methodology

A tester is preparing to assess a thick-client desktop application that communicates with a backend API. Which methodology consideration is most important for coverage?

  1. Testing only the client's user interface controls
  2. Measuring the client's memory usage
  3. Capturing and analyzing the client-server traffic to identify API endpoints and parameters Correct answer.
  4. Reviewing the installer's digital signature

Explanation

Thick clients often expose backend APIs that are the real attack surface, so capturing and analyzing traffic reveals endpoints and parameters to test. UI-only testing, signature review, and memory measurement miss the server-side surface.

Question 44Security testing and assessment methodology

A tester needs to assess whether an application is vulnerable to insecure direct object references in a reporting module. Which observation most strongly indicates the issue?

  1. Changing an object identifier returns another user's report content Correct answer.
  2. The report module uses POST instead of GET
  3. The report module requires authentication
  4. The report page loads slowly under load

Explanation

Insecure direct object references are confirmed when altering an identifier grants access to another user's data. Performance, HTTP method, and authentication requirements do not demonstrate broken object-level access control.

Question 45Security testing and assessment methodology

An assessor is planning a test of a wireless network and wants to evaluate whether rogue access points can be introduced without detection. Which testing focus best addresses this?

  1. TLS configuration of the intranet site
  2. Password complexity of the corporate directory
  3. Monitoring and detection capability against unauthorized access points Correct answer.
  4. Backup frequency of the wireless controller

Explanation

Rogue access point testing evaluates whether monitoring and detection controls identify unauthorized devices on the wireless estate. Directory passwords, TLS configuration, and backups address different controls.

Question 46Security testing and assessment methodology

A tester wants to confirm that a vulnerability scanner's reported SQL injection finding is real before reporting it. Which action best supports this?

  1. Disabling the scanner's SQL injection checks
  2. Manually crafting requests to observe database error or boolean-based behavioral differences Correct answer.
  3. Accepting the scanner output as-is
  4. Reporting the finding with a low confidence note

Explanation

Manual confirmation through error-based or boolean-based behavioral differences validates the scanner's claim. Accepting output unchanged or reporting low confidence without testing does not establish exploitability.

Question 47Security testing and assessment methodology

A tester is evaluating an application's password reset flow and wants to determine whether reset tokens are predictable. Which test design is most appropriate?

  1. Checking whether the reset email uses HTML formatting
  2. Requesting multiple resets and analyzing token length, structure, and randomness Correct answer.
  3. Verifying that the reset page is served over HTTPS
  4. Measuring the time to send the reset email

Explanation

Predictability is assessed by collecting multiple reset tokens and analyzing their entropy and structure. Email formatting, transport security, and delivery timing do not reveal token randomness.

Question 48Security testing and assessment methodology

A red team is asked to evaluate whether an organization's SOC can detect and respond to a simulated credential theft and lateral movement scenario. Which methodology element is most critical to the assessment's validity?

  1. Defining realistic adversary tactics and measuring detection and response timelines Correct answer.
  2. Avoiding all interaction with the SOC
  3. Maximizing the number of vulnerabilities reported
  4. Using only automated scanners

Explanation

Adversary simulation is valid when it emulates realistic tactics and measures whether and how quickly defenders detect and respond. Volume of findings, avoiding the SOC, and scanner-only approaches do not evaluate detection capability.

Question 49Security testing and assessment methodology

A tester must decide whether to use a full port scan or a targeted scan during a time-boxed internal assessment. Which factor most directly justifies the choice?

  1. The number of open ports found on the internet
  2. The tester's personal preference for scan types
  3. The default configuration of the scanning tool
  4. The engagement scope and the likelihood that non-standard ports host in-scope services Correct answer.

Explanation

Scan breadth should be driven by the agreed scope and the probability that in-scope services run on non-standard ports. Personal preference, internet findings, and tool defaults are not valid scoping criteria.

Question 50Security testing and assessment methodology

An assessor is testing a multi-tenant application and wants to determine whether tenant isolation can be bypassed. Which test design is most rigorous?

  1. Using tenant A's credentials to request tenant B's resources across multiple endpoints and methods Correct answer.
  2. Checking whether tenants share the same login page
  3. Measuring database query times for each tenant
  4. Reviewing the application's tenant onboarding documentation

Explanation

Tenant isolation is rigorously tested by attempting cross-tenant access with one tenant's identity across many endpoints and HTTP methods. Shared login pages, documentation, and query timing do not demonstrate isolation failures.