Question bank
Certified Tester - Infrastructure
40 Certified Tester - Infrastructure questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Application Security and Web Technologies
8 questions in this domain
- Question 1Single Choice
Which OWASP Top 10 category directly addresses failures in enforcing user permissions?
- AA01: Broken Access ControlCorrect answer
- BA03: Injection
- CA05: Security Misconfiguration
- DA10: SSRF
Why this is the answer
Broken Access Control (A01) is defined as failures in enforcing user permissions, including vertical and horizontal privilege escalation.
- Question 2Multiple Select
Which two characteristics are essential for secure session token generation?
- AUse a cryptographically secure pseudorandom number generatorCorrect answer
- BUse a combination of server timestamp and random salt
- CUse sequential counters
- DUse high-entropy random stringsCorrect answer
Why this is the answer
Secure tokens must be generated using a CSPRNG and be high-entropy, not timestamp-based or sequential.
- Question 3Interactive
Examine the code snippet. What vulnerability is present?
- ASQL injectionCorrect answer
- BCross-Site Scripting
- CCommand injection
- DBroken Access Control
Why this is the answer
The code concatenates user input directly into an SQL query string, causing SQL injection vulnerability.
- Question 4Single Choice
What is the primary defense against Cross-Site Scripting (XSS)?
- AOutput encodingCorrect answer
- BInput validation
- CHTTPS
- DRate limiting
Why this is the answer
Context‑aware output encoding neutralises malicious characters and prevents XSS, whereas input validation is secondary.
- Question 5Multiple Select
Which two cookie flags should be set on session cookies to improve security?
- ASecureCorrect answer
- BHttpOnlyCorrect answer
- CSameSite=None
- DDomain
Why this is the answer
Secure flag forces HTTPS only; HttpOnly prevents client‑side script access, mitigating XSS cookie theft.
- Question 6Interactive
Examine the code snippet. What vulnerability does it introduce?
- ACommand injectionCorrect answer
- BSQL injection
- CCross-Site Scripting
- DServer-Side Request Forgery
Why this is the answer
The code passes unsanitised user input to os.system, allowing arbitrary OS command execution.
- Question 7Single Choice
Which OWASP Top 10 category involves the server making requests to internal resources based on user input?
- AA10: SSRFCorrect answer
- BA03: Injection
- CA01: Broken Access Control
- DA05: Security Misconfiguration
Why this is the answer
SSRF (A10) is defined as the vulnerability where an application fetches external resources without validation, often targeting internal services.
- Question 8Multiple Select
Which two secure coding practices directly prevent injection attacks?
- AUse parameterised queriesCorrect answer
- BUse input whitelistingCorrect answer
- CUse output encoding
- DUse HTTPS for all traffic
Why this is the answer
Parameterised queries separate SQL logic from data; input whitelisting rejects malicious payloads at entry points.
Legal, Regulatory, and Professional Standards
6 questions in this domain
- Question 9Single Choice
Under the Computer Misuse Act 1990, Section 1, what key element must a penetration tester have to avoid committing an offence?
- AExplicit written authorisationCorrect answer
- BVerbal consent from the IT manager
- CImplied permission from best practice
- DA valid ethical hacking certificate
Why this is the answer
The CMA Section 1 requires explicit written authorisation; verbal or implied consent is insufficient.
- Question 10Multiple Select
Which two GDPR principles must a penetration tester follow when processing personal data during an infrastructure test?
- AData minimisationCorrect answer
- BLawful basis for processingCorrect answer
- CPublic disclosure of findings
- DUnlimited data retention
Why this is the answer
GDPR Articles 5 and 6 require data minimisation and a lawful basis; public disclosure and unlimited retention violate the regulation.
- Question 11Interactive
Review the test script in the code block. Which action would breach the Rules of Engagement if the RoE only allows scanning the 10.0.0.0/24 subnet?
- AScanning 10.0.1.1Correct answer
- BScanning 10.0.0.1
- CScanning 10.0.0.0/24
- DScanning 10.0.0.0/16
Why this is the answer
The RoE only authorises 10.0.0.0/24; scanning 10.0.1.1 falls outside that range and is an unauthorised access under the CMA.
- Question 12Single Choice
In a CREST-compliant report, which section contains detailed exploit steps and proof-of-concept code?
- AExecutive summary
- BTechnical annexCorrect answer
- CRisk matrix
- DDistribution list
Why this is the answer
The technical annex contains exploit details; the executive summary only covers business impact.
- Question 13Multiple Select
According to the CREST Code of Conduct, which two items must be in place before starting an infrastructure test?
- ASigned non-disclosure agreementCorrect answer
- BWritten authorisation from the system ownerCorrect answer
- CPublic vulnerability report
- DBackup of all test data
Why this is the answer
The code demands written authorisation and a signed NDA; public reports are post-engagement, and backups are not mandatory.
- Question 14Interactive
The code block shows a database query run during a test. Which data protection principle is violated by this action?
- AData minimisationCorrect answer
- BPurpose limitation
- CAccuracy
- DStorage limitation
Why this is the answer
The query extracts all customer data, violating the principle of data minimisation (only necessary data should be accessed).
Network Infrastructure and Protocols
10 questions in this domain
- Question 15Single Choice
At which OSI layer does the IP protocol operate?
- ALayer 2 (Data Link)
- BLayer 3 (Network)Correct answer
- CLayer 4 (Transport)
- DLayer 1 (Physical)
Why this is the answer
IP operates at Layer 3 (Network) and is responsible for logical addressing and routing.
- Question 16Multiple Select
Which of the following protocols operate at the Application Layer of the OSI model? (Select all that apply)
- AHTTPCorrect answer
- BTCP
- CDNSCorrect answer
- DARP
Why this is the answer
HTTP and DNS are application layer protocols. TCP is transport layer, ARP is data link layer.
- Question 17Interactive
Based on the ARP table output shown, identify the OSI layer at which the ARP protocol primarily functions.
- ALayer 2 (Data Link)Correct answer
- BLayer 3 (Network)
- CLayer 4 (Transport)
- DLayer 7 (Application)
Why this is the answer
ARP maps IP addresses to MAC addresses and operates at Layer 2 (Data Link) within the local network.
- Question 18Single Choice
What is the default TCP port for HTTPS traffic?
- A80
- B443Correct answer
- C53
- D22
Why this is the answer
HTTPS uses TCP port 443 by default, providing encrypted communication via TLS/SSL.
- Question 19Multiple Select
Which statements about the TCP/IP model are true? (Select all that apply)
- AIt has 7 layers.
- BIt combines OSI Layers 5-7 into a single Application layer.Correct answer
- CThe Internet layer is equivalent to OSI Layer 3.Correct answer
- DIt includes a Presentation layer.
Why this is the answer
The TCP/IP model has 4 layers; its Application layer encompasses OSI Layers 5-7, and the Internet layer corresponds to OSI Layer 3.
- Question 20Interactive
The packet capture shows a TCP handshake. Which OSI layer is primarily responsible for managing this connection establishment?
- ALayer 4 (Transport)Correct answer
- BLayer 3 (Network)
- CLayer 2 (Data Link)
- DLayer 7 (Application)
Why this is the answer
TCP is a Transport layer protocol responsible for reliable connection establishment via the three-way handshake.
- Question 21Single Choice
What is the first message sent by a DHCP client to obtain an IP address?
- ADHCPOFFER
- BDHCPREQUEST
- CDHCPACK
- DDHCPDISCOVERCorrect answer
Why this is the answer
The DHCP client sends a DHCPDISCOVER broadcast to locate servers, starting the DORA process.
- Question 22Multiple Select
Which DNS record types are valid? (Select all that apply)
- AACorrect answer
- BMXCorrect answer
- CARP
- DCNAMECorrect answer
Why this is the answer
A, MX, and CNAME are standard DNS record types. ARP is not a DNS record.
- Question 23Interactive
Refer to the switch configuration. Which attack does the bpduguard setting primarily prevent?
- AVLAN hopping
- BARP spoofing
- CSTP manipulation (root bridge takeover)Correct answer
- DDHCP starvation
Why this is the answer
BPDU Guard disables a port if a BPDU is received, preventing rogue switches from manipulating Spanning Tree Protocol.
- Question 24Single Choice
What is the Protocol Data Unit (PDU) at the Network layer of the OSI model?
- AFrame
- BSegment
- CPacketCorrect answer
- DDatagram
Why this is the answer
The Network layer PDU is called a packet (for IP). Frame is Layer 2, segment is Layer 4, datagram often refers to UDP at Transport.
Operating System and Database Security
8 questions in this domain
- Question 25Single Choice
What is security hardening?
- AThe process of installing all available updates
- BSystematic reduction of system vulnerabilitiesCorrect answer
- CConfiguring firewall rules only
- DEnabling all services for functionality
Why this is the answer
Security hardening is the systematic process of reducing a system's vulnerability surface by removing unnecessary software and tightening permissions.
- Question 26Multiple Select
Which are key principles of security hardening? (Select all that apply)
- APrinciple of Least PrivilegeCorrect answer
- BService and Port ReductionCorrect answer
- CAllowing all default services
- DPatch ManagementCorrect answer
Why this is the answer
Key hardening principles include least privilege, service reduction, and patch management. Allowing default services contravenes hardening.
- Question 27Interactive
Examine the command and select the correct purpose: find / -perm -4000 -type f
- AList all world-writable files
- BFind all SUID root binariesCorrect answer
- CSearch for files modified in last 24 hours
- DDisplay disk usage statistics
Why this is the answer
The command finds files with the SUID bit set (4000). These are setuid binaries that run with owner privileges.
- Question 28Single Choice
What does the Principle of Least Privilege (PoLP) entail?
- AGive all users administrative rights
- BGrant only necessary permissions for a taskCorrect answer
- CUse only one account for all users
- DDisable all user accounts by default
Why this is the answer
PoLP means every user or process should have only the permissions essential to perform its function, reducing attack surface.
- Question 29Multiple Select
Which of the following are common privilege escalation vectors? (Select all that apply)
- ASUID binary exploitationCorrect answer
- BPassword reset for all users
- CMisconfigured sudoers entriesCorrect answer
- DKernel vulnerability exploitationCorrect answer
Why this is the answer
Common vectors include exploiting SUID binaries, misconfigured sudoers, and kernel vulnerabilities. Password reset is not an escalation technique.
- Question 30Interactive
Analyze the output and identify the permission issue: -rwsr-xr-x 1 root root 34896 Jan 12 10:00 /usr/bin/example
- AWorld-writable file
- BSUID bit set on a root-owned binaryCorrect answer
- CFile is owned by a non-root user
- DMissing execute permission for group
Why this is the answer
The 's' in owner execute position indicates SUID. This binary runs with root privileges, which can be a vector if exploitable.
- Question 31Single Choice
What is the most effective defense against SQL injection?
- AInput validation only
- BParameterized queries (prepared statements)Correct answer
- CStored procedures in all queries
- DWeb application firewall
Why this is the answer
Parameterized queries separate SQL code from data, preventing injection. Other methods are secondary or can be bypassed.
- Question 32Multiple Select
Which authentication mechanism(s) are available in Microsoft SQL Server? (Select all that apply)
- AWindows AuthenticationCorrect answer
- BSQL Server AuthenticationCorrect answer
- CLDAP Authentication
- DToken-based Authentication
Why this is the answer
SQL Server supports Windows (integrated) and SQL Server (username/password) authentication. LDAP and token are not native modes.
Security Testing Methodologies and Tools
8 questions in this domain
- Question 33Single Choice
What is the primary purpose of the penetration testing lifecycle?
- AEnsures consistency and defensibilityCorrect answer
- BAutomates vulnerability detection
- CReplaces manual testing
- DMeets all compliance standards
Why this is the answer
The lifecycle provides a repeatable, evidence-based process for professional security assessments.
- Question 34Multiple Select
Which of the following are passive reconnaissance techniques?
- AGoogle dorkingCorrect answer
- BPort scanning
- CUsing ShodanCorrect answer
- DPing sweep
Why this is the answer
Passive reconnaissance uses public sources without direct interaction with the target.
- Question 35Interactive
Examine the command below and identify the vulnerability scanner being used.
- ANessus
- BOpenVASCorrect answer
- CNmap
- DNexpose
Why this is the answer
The command 'openvas-scanner' is the command-line interface for OpenVAS.
- Question 36Single Choice
In Metasploit, which module type delivers executable code after exploitation?
- Aexploit
- BpayloadCorrect answer
- Cauxiliary
- Dencoder
Why this is the answer
Payload modules contain shellcode or stagers that run after exploitation.
- Question 37Multiple Select
Which countermeasures help prevent deauthentication attacks?
- AEnable Management Frame ProtectionCorrect answer
- BUse WPA3-SAE
- CDisable SSID broadcast
- DUse a Wireless Intrusion Prevention SystemCorrect answer
Why this is the answer
802.11w protects management frames; WIPS detects and blocks attacks.
- Question 38Interactive
Examine the HTML snippet. What social engineering technique is being used?
- APhishingCorrect answer
- BVishing
- CTailgating
- DSmishing
Why this is the answer
The HTML form captures credentials, typical of a phishing attack.
- Question 39Single Choice
What is the main advantage of authenticated vulnerability scanning?
- AProvides deeper insight into local configurationsCorrect answer
- BIs faster than unauthenticated scanning
- COnly works on Windows systems
- DDetects business logic flaws
Why this is the answer
Authenticated scanning logs into the target, enabling enumeration of patches and settings.
- Question 40Multiple Select
Which are post-exploitation capabilities of Metasploit?
- APrivilege escalationCorrect answer
- BPort scanning
- CKeyloggingCorrect answer
- DPayload generation
Why this is the answer
Post-exploitation includes privilege escalation and keylogging for lateral movement and data capture.
Frequently asked questions
Everything about the Certified Tester - Infrastructure question bank and how to use it.