CPSA Crest 5 — Questions and Answers
Question 1: What is the primary purpose of defining scope before a CREST penetration test engagement?
- To determine the cost of the assessment
- To legally and operationally bound the systems the tester is authorized to target (Correct answer)
- To select the tools to be used during testing
- To identify which vulnerabilities will be reported
Correct answer: To legally and operationally bound the systems the tester is authorized to target
Scope definition establishes the legal authorization boundary, protecting both the tester and client by clearly specifying which systems, networks, and applications are in scope.
Question 2: In a CREST penetration test report, what is the primary audience and purpose of the Executive Summary?
- Technical staff who will remediate findings
- Senior management who need a business-risk overview without technical detail (Correct answer)
- Developers who need to understand vulnerable code
- Security operations staff monitoring threats
Correct answer: Senior management who need a business-risk overview without technical detail
The Executive Summary communicates overall risk posture, business impact, and strategic recommendations in non-technical language suited for C-level and board-level readers.
Question 3: What is the difference between a vulnerability assessment and a penetration test?
- A vulnerability assessment uses automated tools while a penetration test is fully manual
- A vulnerability assessment identifies weaknesses without exploiting them; a penetration test actively exploits findings to demonstrate impact (Correct answer)
- A penetration test is always performed from outside the network
- A vulnerability assessment produces no report while a penetration test does
Correct answer: A vulnerability assessment identifies weaknesses without exploiting them; a penetration test actively exploits findings to demonstrate impact
Vulnerability assessments enumerate potential weaknesses, while penetration tests go further by actively exploiting vulnerabilities to prove real-world impact and chain attack paths.
Question 4: What does PTES (Penetration Testing Execution Standard) define?
- A scoring system for rating vulnerability severity
- A technical standard framework covering the full lifecycle of penetration testing from pre-engagement to reporting (Correct answer)
- A certification scheme for penetration testers
- A set of approved tools for use during CREST assessments
Correct answer: A technical standard framework covering the full lifecycle of penetration testing from pre-engagement to reporting
PTES provides a structured methodology covering seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
Question 5: Which factor should be weighted most heavily when determining the severity rating of a finding in a penetration test report?
- The ease of exploitation alone
- The combination of likelihood of exploitation and potential business impact (Correct answer)
- The number of CVEs associated with the vulnerability
- Whether a public exploit is available
Correct answer: The combination of likelihood of exploitation and potential business impact
Severity ratings should reflect both exploitability and the real-world impact on the organization's confidentiality, integrity, and availability if exploited.
Question 6: What is the correct action for a penetration tester who discovers evidence of a prior unauthorized breach during an engagement?
- Continue testing and include findings in the final report only
- Immediately stop all testing and escalate to the client under agreed incident procedures (Correct answer)
- Delete any evidence found to avoid contaminating the investigation
- Exploit the existing access to demonstrate deeper impact
Correct answer: Immediately stop all testing and escalate to the client under agreed incident procedures
Discovering an active or prior breach is a critical event requiring immediate client notification per rules of engagement, as it may trigger a formal incident response.
Question 7: What does 'gray box' testing mean in the context of a CREST assessment methodology?
- Testing performed exclusively from the internet without any internal access
- Testing where the tester has partial knowledge of the target environment, such as credentials or architecture diagrams (Correct answer)
- Testing limited to automated scanning tools without manual exploitation
- Testing performed after full source code review
Correct answer: Testing where the tester has partial knowledge of the target environment, such as credentials or architecture diagrams
Gray box testing provides testers with some insider information (e.g., user credentials, network diagrams) to simulate an attack from a partially informed adversary such as a malicious insider.
CPSA Crest 5
What is the primary purpose of defining scope before a CREST penetration test engagement?