Question bank
Certified Tester - Application
42 Certified Tester - Application questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Application Security Fundamentals
7 questions in this domain
- Question 1Single Choice
What is the core principle of 'shifting left' in the Secure Software Development Lifecycle?
- APerforming all security testing only at the end of development
- BIntegrating security activities early in the development lifecycleCorrect answer
- CMoving security responsibilities from developers to testers
- DImplementing security only after a breach occurs
Why this is the answer
Shifting left means incorporating security early to reduce cost and risk, not postponing it.
- Question 2Multiple Select
Which of the following are integral components of a Secure Software Development Lifecycle (SSDLC)? (Select all that apply)
- AThreat modeling during design phaseCorrect answer
- BSecure coding standards enforcementCorrect answer
- CFinal stage security review only
- DSecurity requirements engineeringCorrect answer
Why this is the answer
SSDLC integrates security throughout; final-only review is insufficient.
- Question 3Interactive
Examine the following code snippet. Which vulnerability does it exhibit?
- ASQL InjectionCorrect answer
- BCross-Site Scripting (XSS)
- CCross-Site Request Forgery (CSRF)
- DInsecure Deserialization
Why this is the answer
Concatenating user input directly into a SQL query creates an injection vulnerability.
- Question 4Single Choice
What does the OWASP Top 10 category 'Broken Authentication' primarily cover?
- AAuthorization and privilege escalation
- BSession management and credential handlingCorrect answer
- CInput validation and output encoding
- DNetwork security and encryption
Why this is the answer
Broken Authentication involves vulnerabilities in session management and credential handling.
- Question 5Multiple Select
Which of the following are categories in the OWASP Top 10 2021? (Select all that apply)
- AInjectionCorrect answer
- BBroken Access ControlCorrect answer
- CBuffer Overflow
- DSecurity MisconfigurationCorrect answer
Why this is the answer
Injection, Broken Access Control, and Security Misconfiguration are in the OWASP Top 10 2021.
- Question 6Interactive
Analyze the following HTTP response headers. Which security header is missing that could prevent clickjacking?
- AX-Frame-OptionsCorrect answer
- BContent-Security-Policy
- CStrict-Transport-Security
- DSet-Cookie
Why this is the answer
X-Frame-Options prevents your page from being embedded in an iframe, mitigating clickjacking.
- Question 7Single Choice
In a three-tier web application architecture, which layer is responsible for business logic?
- APresentation tier
- BApplication tierCorrect answer
- CData tier
- DClient tier
Why this is the answer
The application (or logic) tier processes business rules and user requests.
Application Security Testing Tools and Techniques
12 questions in this domain
- Question 8Single Choice
What is the primary purpose of automated vulnerability scanning tools in application security testing?
- ATo completely replace manual penetration testing
- BTo serve as a force multiplier during reconnaissance and discovery phasesCorrect answer
- CTo guarantee the discovery of all business logic flaws
- DTo automate the entire exploitation process without human intervention
Why this is the answer
Automated scanners are force multipliers, not replacements; they aid in reconnaissance and discovery but miss logic flaws.
- Question 9Multiple Select
Which of the following are common limitations of automated vulnerability scanners? (Select all that apply.)
- AThey produce a high volume of false positivesCorrect answer
- BThey can detect business logic flaws effectively
- CThey may miss vulnerabilities without known signaturesCorrect answer
- DThey guarantee zero false negatives
Why this is the answer
Scanners often generate false positives and miss zero-day or signature-less vulnerabilities; they do not handle logic flaws.
- Question 10Interactive
In the context of automated scanning, what does the term 'signature-based detection' refer to?
- ADetection based on known vulnerability patternsCorrect answer
- BDetection based on anomaly analysis of user behavior
- CDetection based on machine learning models
- DDetection based on manual code review
Why this is the answer
Signature-based detection relies on a database of known vulnerability patterns to identify issues.
- Question 11Single Choice
What is a false positive in the context of automated vulnerability scanning?
- AA real vulnerability that the scanner correctly identifies
- BA vulnerability reported by the scanner that does not actually existCorrect answer
- CA vulnerability missed by the scanner
- DA vulnerability that requires manual intervention to confirm
Why this is the answer
A false positive is an incorrect alert where the scanner reports a vulnerability that does not truly exist.
- Question 12Multiple Select
Which of the following are types of application security testing? (Select all that apply.)
- ADynamic Application Security Testing (DAST)Correct answer
- BStatic Application Security Testing (SAST)Correct answer
- CInteractive Application Security Testing (IAST)Correct answer
- DRandom Application Security Testing (RAST)
Why this is the answer
The standard types are DAST, SAST, and IAST; RAST is not a recognized term.
- Question 13Interactive
What is the difference between DAST and SAST?
- ADAST tests running applications externally; SAST analyzes source code internallyCorrect answer
- BDAST requires source code access; SAST does not
- CDAST is slower than SAST
- DSAST is always more accurate than DAST
Why this is the answer
DAST scans running applications without source code; SAST analyzes code internally.
- Question 14Single Choice
Which of the following best describes a limitation of DAST?
- AIt cannot assess code paths not exercised during testingCorrect answer
- BIt can analyze all code paths regardless of execution
- CIt is ideal for finding business logic flaws
- DIt does not require a running application
Why this is the answer
DAST can only test paths that are executed; it misses code not covered during scanning.
- Question 15Multiple Select
Which of the following are true about false negatives in automated scanning? (Select all that apply.)
- AA false negative is when a real vulnerability is missedCorrect answer
- BFalse negatives are more dangerous than false positivesCorrect answer
- CFalse negatives can be avoided by using multiple tools
- DFalse negatives occur when a scanner reports a non-existent vulnerability
Why this is the answer
False negatives miss real vulnerabilities; they are dangerous. Multiple tools reduce but do not eliminate them.
- Question 16Interactive
What is the main reason automated scanners can miss business logic flaws?
- AScanners lack understanding of the application's intended business flowCorrect answer
- BScanners do not have enough time to test all inputs
- CScanners are not designed for web applications
- DScanners only detect signature-based vulnerabilitiesCorrect answer
Why this is the answer
Scanners cannot interpret business context or multi-step workflows, and are limited to known patterns.
- Question 17Single Choice
Which phase of manual penetration testing involves gathering intelligence about the target without direct interaction?
- APassive reconnaissanceCorrect answer
- BActive reconnaissance
- CExploitation
- DPost-exploitation
Why this is the answer
Passive reconnaissance (OSINT) gathers information without directly touching the target systems.
- Question 18Multiple Select
Which of the following are well-known manual penetration testing methodologies? (Select all that apply.)
- AOWASP Testing GuideCorrect answer
- BPTES (Penetration Testing Execution Standard)Correct answer
- COSSTMM (Open Source Security Testing Methodology Manual)Correct answer
- DCVE (Common Vulnerabilities and Exposures)
Why this is the answer
OWASP, PTES, and OSSTMM are testing methodologies; CVE is a vulnerability database.
- Question 19Interactive
What is the purpose of threat modeling in manual penetration testing?
- ATo identify assets, attack surfaces, and prioritize testingCorrect answer
- BTo replace the need for vulnerability scanning
- CTo automatically generate exploit code
- DTo bypass authentication mechanisms
Why this is the answer
Threat modeling helps testers focus on high-risk areas by identifying assets and attack surfaces.
Professional Practice and Ethics
4 questions in this domain
- Question 20Single Choice
What is the primary purpose of the CREST Code of Conduct?
- ATo provide aspirational guidelines without enforcement
- BTo define binding, enforceable standards of professional behaviourCorrect answer
- CTo replace all legal requirements for penetration testers
- DTo limit the technical skills of certified testers
Why this is the answer
The CREST Code of Conduct is a binding, enforceable framework that governs the behaviour of all CREST members, not merely aspirational guidelines.
- Question 21Multiple Select
Which of the following are principles of the CREST Code of Conduct? (Select all that apply)
- AIntegrityCorrect answer
- BObjectivityCorrect answer
- CProfit maximisation
- DConfidentialityCorrect answer
Why this is the answer
The CREST Code of Conduct includes Integrity, Objectivity, and Confidentiality. Profit maximisation is not a principle.
- Question 22Interactive
Consider the following scenario: A tester discovers an out-of-scope server during a penetration test. What should the tester do according to the code of conduct?
- ARun a quick scan to check for vulnerabilities
- BImmediately exploit any easy wins to show value
- CStop testing and request a scope change from the clientCorrect answer
- DIgnore the server and continue with in-scope testing
Why this is the answer
The code requires testers to respect scope boundaries. The correct action is to stop, notify the client, and request a formal scope change.
- Question 23Single Choice
What does the principle of 'Professional Competence and Due Care' require of a CREST-certified tester?
- AAlways accept the most difficult engagements
- BMaintain knowledge and skill to deliver competent serviceCorrect answer
- CNever ask for help from colleagues
- DOnly work on systems that are fully patched
Why this is the answer
Professional Competence and Due Care obligates testers to maintain their professional knowledge and skill at the level required to deliver competent service.
Reporting and Communication
6 questions in this domain
- Question 24Single Choice
What is the primary audience of an executive summary in a vulnerability report?
- ASenior managementCorrect answer
- BDevelopers
- CIT operations
- DQA testers
Why this is the answer
The executive summary targets non-technical senior management to communicate business impact and strategic priorities.
- Question 25Multiple Select
Which two items are essential components of a technical vulnerability description?
- ARoot causeCorrect answer
- BPersonal opinion
- CSecurity impactCorrect answer
- DDeveloper name
Why this is the answer
Root cause and security impact are required for a factual, actionable description. Personal opinion and developer names are inappropriate.
- Question 26Interactive
Given the CVSS vector string, what is the Attack Vector value?
- ANetworkCorrect answer
- BAdjacent
- CLocal
- DPhysical
Why this is the answer
AV:N stands for Attack Vector: Network, meaning the vulnerability is exploitable remotely over the network.
- Question 27Single Choice
What does the CVSS severity category 'High' correspond to in scores?
- A7.0 – 8.9Correct answer
- B4.0 – 6.9
- C9.0 – 10.0
- D0.1 – 3.9
Why this is the answer
CVSS v3.1 defines High as scores from 7.0 to 8.9 inclusive. Critical is 9.0-10.0, Medium 4.0-6.9.
- Question 28Multiple Select
Which two metrics are part of the CVSS Base group?
- AExploitabilityCorrect answer
- BTemporal
- CImpactCorrect answer
- DEnvironmental
Why this is the answer
The Base group consists of Exploitability and Impact sub-groups. Temporal and Environmental are separate optional groups.
- Question 29Interactive
In this finding title, identify the vulnerability type.
- ASQL InjectionCorrect answer
- BCross-Site Scripting
- CBroken Access Control
- DCryptographic Failure
Why this is the answer
The title clearly states 'SQL Injection' as the vulnerability in the login parameter.
Web Application Attacks and Exploitation
13 questions in this domain
- Question 30Single Choice
What is the primary defense against SQL injection according to OWASP?
- AParameterized queries (prepared statements)Correct answer
- BInput blacklisting
- CClient-side input validation
- DWeb application firewall only
Why this is the answer
Parameterized queries treat user input as data, not executable code, preventing SQL injection. OWASP recommends this as primary defense.
- Question 31Multiple Select
Which of the following are types of SQL injection? (Choose two)
- AError-based SQLiCorrect answer
- BBlind SQLi (boolean-based)Correct answer
- CHTML injection
- DLDAP injection
Why this is the answer
Error-based and blind (boolean/time-based) are two main SQL injection types. HTML and LDAP are separate injection categories.
- Question 32Interactive
Analyze the code snippet. What type of injection vulnerability exists?
- ASQL injectionCorrect answer
- BOS command injection
- CLDAP injection
- DNoSQL injection
Why this is the answer
The string concatenation of user input into an SQL query is a classic SQL injection vulnerability.
- Question 33Single Choice
Which character is commonly used to test for SQL injection in a numeric parameter?
- ASingle quote (')
- BDouble quote (")
- CA comment delimiter (--)
- DA number or mathematical expressionCorrect answer
Why this is the answer
For numeric parameters, injecting a mathematical expression (e.g., 2-1) tests if input is treated as part of a numeric SQL context.
- Question 34Multiple Select
Which of the following are common XSS variants? (Choose three)
- AReflected XSSCorrect answer
- BStored XSSCorrect answer
- CDOM-based XSSCorrect answer
- DSQLi-based XSS
Why this is the answer
Reflected, stored, and DOM-based are the three main XSS variants. SQLi-based XSS is not a valid category.
- Question 35Interactive
Evaluate the code below. What XSS context does the user input appear in?
- AHTML body
- BHTML attributeCorrect answer
- CJavaScript variable
- DCSS style
Why this is the answer
The input is placed inside an HTML attribute (value=\"...\"), requiring breaking out of the attribute with a quote.
- Question 36Single Choice
What does the HttpOnly flag on a cookie prevent?
- ACross-site scripting (access to cookie via JavaScript)Correct answer
- BCross-site request forgery
- CSQL injection
- DSession fixation
Why this is the answer
HttpOnly prevents client-side scripts from accessing the cookie, mitigating XSS-based cookie theft.
- Question 37Multiple Select
Which of the following are common CSRF mitigation techniques? (Choose two)
- AAnti-CSRF tokensCorrect answer
- BSameSite cookie attributeCorrect answer
- CClient-side JavaScript validation
- DSSL/TLS encryption
Why this is the answer
CSRF tokens and SameSite cookies are primary defenses. Client-side validation and TLS do not prevent CSRF.
- Question 38Interactive
Examine the CSRF PoC. Which protection is missing?
- AAnti-CSRF tokenCorrect answer
- BSameSite=Lax cookie
- CSecure cookie flag
- DReferer header validation
Why this is the answer
The form is a standard PoC for CSRF as it submits a state-changing request without any token verification.
- Question 39Single Choice
What is the typical goal of an SSRF attack?
- AInternal network resources and cloud metadataCorrect answer
- BClient-side session cookies
- CDNS servers
- DExternal CDN endpoints
Why this is the answer
SSRF tricks the server into making requests to internal systems, cloud metadata endpoints, or otherwise inaccessible resources.
- Question 40Multiple Select
Which of the following are methods to bypass authentication? (Choose two)
- ASQL injection in login queryCorrect answer
- BSession fixationCorrect answer
- CCross-site scripting
- DServer-Side Request Forgery
Why this is the answer
SQL injection can bypass login logic, and session fixation tricks a user into using a known session ID. XSS and SSRF are not direct bypass techniques.
- Question 41Interactive
Review this login code. How can it be exploited for authentication bypass?
- ABy inputting ' OR '1'='1Correct answer
- BBy using a long string to cause buffer overflow
- CBy submitting an empty password
- DBy sending a POST request instead of GET
Why this is the answer
The code directly concatenates user input into the SQL query, allowing SQL injection via ' OR '1'='1 which always returns true.
- Question 42Single Choice
What type of privilege escalation occurs when a user accesses another user's data without admin rights?
- AHorizontal privilege escalationCorrect answer
- BVertical privilege escalation
- CLateral movement
- DPrivilege de-escalation
Why this is the answer
Horizontal escalation grants access to resources of same-level users. Vertical escalates to higher privileges (e.g., admin).
Frequently asked questions
Everything about the Certified Tester - Application question bank and how to use it.