Gain Success in Your CREST Practitioner Security Analyst (CPSA) Exam with the Most Current CREST-CPSA Dumps (V8.02)

1. What is the main purpose of an interim report during an assessment?

2. Which protocol version is considered insecure and deprecated in modern web encryption?

3. Which HTTP status code is often returned with a detailed application error stack trace in misconfigured environments?

4. What HTTP status code typically indicates that a discovered URL exists but requires authentication?

5. What protocol is primarily used by Active Directory for directory services?

6. Which file, when misconfigured, can allow passwordless login using RSH or RLOGIN?

7. A well-configured Checkpoint Firewall is running on your local network segment.

Which of the following types of probe is it most likely to respond to?

8. Which of the following wireless encryption protocols is considered secure for enterprise use?

9. Which command-line tool is used on Windows to enumerate users from the local system or domain?

10. Which HTTP method is used by web servers to retrieve data without making changes to server-side resources?

11. Which of the following fields in an IPv4 header is used for packet fragmentation and reassembly?

12. Why should verbose error messages be avoided in production web applications?

13. What is the primary goal of performing a manual source code review during a web assessment?

14. Which of the following tools is typically used to retrieve WHOIS data for domain registration information?

15. Which of the following tools is most suitable for discovering hidden directories and files during web reconnaissance?

16. Which protocol is commonly used for remote client access in Microsoft Exchange?

17. What command-line tool is commonly used to test SMTP servers for open relay vulnerabilities?

18. Which of the following is a popular open-source web application server used to deploy Java-based applications?

19. Which port does traditional FTP use for control communication?

20. Why is VoIP considered a high-value target during penetration tests?

21. Which type of DNS record is used to define the mail server for a domain?

22. What information is commonly exposed in email headers that may aid an attacker?

23. What valuable information can often be gained by analyzing publicly accessible robots.txt files on a target website?

24. Which of the following best describes the purpose of the HTML <form> tag?

25. Which UK legislation specifically makes unauthorized access to computer systems a criminal offence?

26. Which tool is commonly used for capturing and analyzing network traffic in real time?

27. Which technique is best used to evaluate an unknown service running on a non-standard port?

28. What HTTP response header can help mitigate XSS by instructing the browser not to execute scripts from unauthorized origins?

29. Which programming language is executed directly in the user’s browser?

30. Which framework is commonly used in web application threat modelling to categorize potential attacker goals?

31. During traffic analysis, which layer of the OSI model would reveal source and destination MAC addresses?

32. Which of the following configuration issues presents the highest risk on a network device?

33. 1.Which term best describes the likelihood that a threat will exploit a vulnerability causing harm?

34. On a Linux system, which of the following permission settings allows a file to be executed only by the owner?

35. Which HTTP header would you modify to help perform an "HTTP request smuggling" attack?

36. What is the primary goal of application fingerprinting during a security assessment?

37. Which of the following conditions makes an FTP server highly vulnerable to abuse?

38. Why is directory listing considered a security risk on web servers?

39. Which Nmap option performs aggressive OS detection?

40. Which transport layer protocol provides reliable data transfer with flow control and sequencing?

41. Which Oracle privilege, if granted improperly, can allow a user to execute functions as another user, potentially leading to privilege escalation?

42. Which cryptographic concept ensures that a message has not been altered in transit?

43. Which of the following is a key sign that a SQL injection vulnerability is present?

44. Why is exposing the application server’s administrative console to the public internet a security risk?

45. Which of the following helps automate patch deployment in enterprise environments?

46. When conducting a penetration test on personal data, which regulation must be taken into consideration?

47. What is a potential security risk of embedding unvalidated user input inside HTML pages?

48. Which DNS enumeration technique retrieves the entire DNS zone file from a DNS server?

49. Which method is most effective for verifying security configuration compliance on network devices?

50. You review an Nmap scan output and observe port 80/tcp is open with a service name "http-proxy." What does this imply?

51. Which of the following best describes perfect forward secrecy (PFS) in TLS?

52. Which protocol is used to securely transmit HTTP traffic over an encrypted channel?

53. Which Unix command can enumerate RPC services running on a remote host?

54. Which service in Exchange may expose email address enumeration through HTTP response codes?

55. Which of the following best describes the purpose of Google hacking in reconnaissance?