CREST Practitioner Intrusion Analyst (CPIA) Certification Sample Questions

The purpose of this Sample Question Set is to provide you with information about the CREST Practitioner Intrusion Analyst exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the CPIA certification test. To get familiar with real exam environment, we suggest you try our Sample CREST Practitioner Intrusion Analyst Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual CREST Practitioner Intrusion Analyst (CPIA) certification exam.

These sample questions are simple and basic questions that represent likeness to the real CREST CPIA exam questions. To assess your readiness and performance with real time scenario based questions, we suggest you prepare with our Premium CREST Practitioner Intrusion Analyst Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.

CREST CPIA Sample Questions:

01. Endpoint protection on a design workstation quarantines plotsvc.exe as Heur.Suspicious.Gen. A multi-engine scanning service reports 2 of 68 engines flagging the file, both with generic heuristic names. The file carries a valid signature from the plotter manufacturer, and its hash appears in a known-good software reference set.

What is the best assessment?

a) A likely false positive, to be confirmed and reported

b) A confirmed infection that needs immediate eradication on the host

c) Evidence the file executed on this host

d) Targeted malware evading most engines, given the low detection count

e) A false positive best resolved by disabling the heuristic engine everywhere

02. Across an estate of 4,000 hosts, an analyst summarises a week of proxy data for five external destinations:

av-update.example.com: all 4,000 hosts, hourly, day and night

files.example.org: one host, irregular large downloads, office hours only

share.example.net: one host, a single 2 GB upload

img-cache.example.net: two hosts, every 15 minutes with slight jitter, about 1 KB each, day and night

calendar.example.org: 3,200 hosts, every 5 minutes, office hours only

Which destination is the strongest beacon candidate?

a) av-update.example.com, contacted hourly by every host

b) files.example.org, with irregular large downloads

c) img-cache.example.net, contacted by two hosts around the clock

d) share.example.net, after its single large upload

e) calendar.example.org, polled every five minutes by most hosts in office hours

03. Packet captures from a two-week monitoring deployment may be relied on in disciplinary proceedings. The analyst reviews the handling record for the capture files.

Which entry most weakens the evidential integrity of the captures?

a) Analysis was performed on working copies of the capture files

b) The sensor clock was synchronised to the internal NTP source

c) Capture files were rotated into 1 GB segments during collection

d) Original segment files were written to write-once media at the end of collection

e) Files were first hashed after being copied onto the analyst's laptop

04. Threat intelligence on a malware family states that its implant beacons over HTTPS with a base interval of ten minutes and up to 30% random jitter, changes its URI path on every request, and keeps each check-in under 2 KB.

Which detection approach is most likely to surface infected hosts in proxy logs?

a) Alert on any host contacting one destination at an exact ten-minute interval

b) Write a signature for the URI path seen in the published sample

c) Flag the hosts with the highest total outbound byte counts each day

d) Model the spread of intervals for every host-destination pair

e) Search for DNS NXDOMAIN bursts from each host

05. Before an engagement, an analyst is building a picture of a logistics client's internal technology from open sources only, without touching any of the client's systems.

Which source is most likely to reveal the specific firewall and endpoint products the client runs?

a) The client's domain WHOIS record

b) Job adverts and staff profiles on professional networks

c) The IP WHOIS allocation for the client's public address range

d) An active Nmap service scan of the client's internet perimeter

e) Sector threat reports from antivirus vendors

06. While investigating a compromised e-commerce web server for an online retailer, the analyst finds a script that has copied cardholder names, card numbers and expiry dates to 203.0.113.77 for three weeks. The engagement is for technical analysis only.

What is the analyst's most appropriate action regarding notification?

a) Notify the card brands directly so the affected cards can be blocked

b) Report the exfiltration to the police before informing the client

c) Hold the finding back until the root cause is fully confirmed

d) Ask the national CERT for a takedown

e) Report it promptly to the client and its counsel

07. During a privilege-escalation review of a Windows workstation, an analyst exports the ACLs of several registry keys. The service ScanAgent runs as LocalSystem.

Which finding presents the greatest risk of a standard user gaining SYSTEM privileges?

a) BUILTIN\Users hold Read on HKLM\SYSTEM\CurrentControlSet\Services

b) BUILTIN\Users hold Set Value on the HKLM\SYSTEM\CurrentControlSet\Services\ScanAgent key

c) Each user holds Full Control over their own HKCU\Software\Microsoft\Windows\CurrentVersion\Run key

d) BUILTIN\Administrators hold Full Control on HKLM\SOFTWARE

e) SYSTEM holds Full Control on HKLM\SAM

08. Investigating a charity's finance PC, an analyst finds that HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run has a last-write time of 2026-08-11 02:14 UTC. The key holds four values: three vendor updaters and one unknown value, svcupd. A colleague's draft states that svcupd was added at 02:14.

How should that statement be evaluated?

a) Proven, as each value carries its own creation time matching the key's last-write time

b) Proven, as a key's last-write time changes only when a new value is added to it

c) Unproven, as the key time shows only when the hive was last loaded at boot

d) Unproven: values carry no timestamp

e) Proven for whichever value is listed last, as values are stored in the order added

09. Reverse engineering of a ransomware sample shows that it encrypts each file with a random AES key, then encrypts that AES key with an RSA public key embedded in the binary and stores the result in the file trailer. A manager asks whether the extracted public key can be used to restore the files.

What is the best answer?

a) No; it only encrypts, and decrypting the AES keys needs the private key

b) Yes; the key that encrypted the AES keys can also decrypt them

c) Yes, once it has been converted into a matching AES key of the same bit length

d) No; the files were protected by RC4, and AES played no part

e) Yes, if it is combined with each file's MD5 hash

10. An analyst at a water utility runs a suspected loader on an analysis VM with its network adapter disconnected. Process and packet monitoring show the sample start, attempt to resolve update-check.example.org, receive a lookup failure and exit after four seconds. No files, registry values or child processes are created. Static triage found no debugger checks, VM-artefact strings or long sleeps.

What is the best next step in the live analysis?

a) Connect the VM directly to the internet and let the sample reach its server

b) Record it as benign, with no file, registry or process change seen at all

c) Re-run it on a host-only network with fake DNS and fake HTTP services

d) Stop live work and rely on disassembly of the sample alone

e) Run it on a spare production workstation with normal internet access

Answers:

Question: 01 Answer: a	Question: 02 Answer: c	Question: 03 Answer: e	Question: 04 Answer: d	Question: 05 Answer: b
Question: 06 Answer: e	Question: 07 Answer: b	Question: 08 Answer: d	Question: 09 Answer: a	Question: 10 Answer: c

Note: For any error in CREST Practitioner Intrusion Analyst (CPIA) (CPIA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.