CREST Practitioner Security Analyst (CPSA) Certification Sample Questions

The purpose of this Sample Question Set is to provide you with information about the CREST Practitioner Security Analyst exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the CPSA certification test. To get familiar with real exam environment, we suggest you try our Sample CREST Practitioner Security Analyst Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual CREST Practitioner Security Analyst (CPSA) certification exam.

These sample questions are simple and basic questions that represent likeness to the real CREST CPSA exam questions. To assess your readiness and performance with real time scenario based questions, we suggest you prepare with our Premium CREST Practitioner Security Analyst Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.

CREST CPSA Sample Questions:

01. Which of the following fields in an IPv4 header is used for packet fragmentation and reassembly?

a) Header Checksum

b) Time to Live (TTL)

c) Protocol

d) Identification

02. What HTTP response header can help mitigate XSS by instructing the browser not to execute scripts from unauthorized origins?

a) Content-Type

b) X-XSS-Protection

c) Content-Security-Policy (CSP)

d) Referrer-Policy

03. Why is enabling the xp_cmdshell stored procedure a critical security concern in SQL Server?

a) It allows command execution on the operating system level

b) It disables SQL logging

c) It grants SA privileges to all users

d) It leaks encryption keys from the master database

04. During traffic analysis, which layer of the OSI model would reveal source and destination MAC addresses?

a) Layer 3 – Network

b) Layer 5 – Session

c) Layer 2 – Data Link

d) Layer 7 – Application

05. Which of the following techniques is most effective for discovering unlinked web content?

a) DNS zone transfer

b) Directory brute-forcing with a wordlist

c) Traceroute mapping

d) SSL certificate inspection

06. What is a key security consideration in a three-tier web architecture (presentation, application, and database layers)?

a) Only the presentation layer requires access control

b) All tiers should use the same credentials

c) The application tier should validate all input before passing to the database

d) SSL is only necessary between users and the database

07. You review an Nmap scan output and observe port 80/tcp is open with a service name "http-proxy." What does this imply?

a) The web server is using port forwarding

b) A proxy service (such as Squid) is running on that port

c) The port is misconfigured and should be closed

d) SSL encryption is enforced on that port

08. What is the purpose of the DBMS_METADATA.GET_DDL function in Oracle?

a) Deletes user accounts from the database

b) Dumps full contents of a database table

c) Retrieves the DDL (schema) for database objects

d) Encrypts stored procedures

09. In which part of a web application is DOM-based XSS typically executed?

a) Within client-side JavaScript execution

b) In the HTML meta tags

c) In the server-side script

d) Inside CSS stylesheets

10. Which file, when misconfigured, can allow passwordless login using RSH or RLOGIN?

a) /etc/shadow

b) /etc/hosts.deny

c) /etc/passwd

d) .rhosts

Answers:

Question: 01 Answer: d	Question: 02 Answer: c	Question: 03 Answer: a	Question: 04 Answer: c	Question: 05 Answer: b
Question: 06 Answer: c	Question: 07 Answer: b	Question: 08 Answer: c	Question: 09 Answer: a	Question: 10 Answer: d

Note: For any error in CREST Practitioner Security Analyst (CPSA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.

CREST Practitioner Security Analyst (CPSA) Certification Sample Questions

CREST CPSA Sample Questions:

Answers:

Blogs