CPSA Crest 2 — Questions and Answers
Question 1: Which TCP flag combination is used in a SYN scan to identify open ports without completing the three-way handshake?
- SYN-ACK then RST (Correct answer)
- SYN then ACK
- FIN then RST
- SYN then FIN
Correct answer: SYN-ACK then RST
A SYN scan sends a SYN packet; an open port replies with SYN-ACK, and the scanner immediately sends RST to avoid completing the connection.
Question 2: What is the default port used by SNMP for receiving traps?
- 161
- 162 (Correct answer)
- 179
- 514
Correct answer: 162
SNMP agents listen on UDP port 161 for queries, while SNMP traps are sent to the manager on UDP port 162.
Question 3: Which protocol does Kerberos primarily use for ticket exchange and on what port?
- UDP/TCP port 389
- TCP port 445
- UDP/TCP port 88 (Correct answer)
- TCP port 636
Correct answer: UDP/TCP port 88
Kerberos operates over UDP and TCP on port 88 for authentication ticket exchange in Active Directory environments.
Question 4: During a network assessment, you observe gratuitous ARP packets flooding the network. What attack does this most likely indicate?
- DNS poisoning
- ARP spoofing / man-in-the-middle (Correct answer)
- DHCP starvation
- SYN flood
Correct answer: ARP spoofing / man-in-the-middle
Gratuitous ARP packets sent repeatedly are a hallmark of ARP spoofing, used to redirect traffic through an attacker's machine for a MITM attack.
Question 5: What does the IP TTL value of 128 most likely indicate about the operating system of the target host?
- Linux/Unix system
- Cisco network device
- Windows system (Correct answer)
- FreeBSD system
Correct answer: Windows system
Windows systems default to a TTL of 128, while Linux/Unix systems typically start with TTL 64, aiding OS fingerprinting during reconnaissance.
Question 6: Which Nmap scan type is most appropriate when ICMP is blocked by a firewall but you need to discover live hosts on a subnet?
- ICMP echo scan (-PE)
- TCP SYN ping scan (-PS) (Correct answer)
- UDP ping scan (-PU)
- ARP ping scan (-PR)
Correct answer: TCP SYN ping scan (-PS)
TCP SYN ping (-PS) sends SYN packets to common ports to detect live hosts when ICMP is filtered by perimeter firewalls.
Question 7: What is the purpose of the LDAP protocol in an Active Directory environment during a CREST assessment?
- Encrypting domain controller communications
- Querying and enumerating directory objects such as users and groups (Correct answer)
- Authenticating Kerberos tickets
- Synchronizing time across domain members
Correct answer: Querying and enumerating directory objects such as users and groups
LDAP (port 389) is used to query Active Directory for objects including user accounts, group memberships, and computer accounts, making it valuable for enumeration.
CPSA Crest 2
Which TCP flag combination is used in a SYN scan to identify open ports without completing the three-way handshake?