Question bank
Practitioner Security Analyst
40 Practitioner Security Analyst questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Information Security and Standards
8 questions in this domain
- Question 1Single Choice
Which of the CIA triad objectives ensures that sensitive information is accessible only to authorised individuals?
- AAvailability
- BIntegrity
- CConfidentialityCorrect answer
- DNon-repudiation
Why this is the answer
Confidentiality ensures that information is not disclosed to unauthorised parties. It is protected through encryption, access controls, and the principle of least privilege.
- Question 2Multiple Select
Which of the following are factors of authentication according to the AAA framework? (Select all that apply)
- ASomething you knowCorrect answer
- BSomething you haveCorrect answer
- CSomething you areCorrect answer
- DSomething you do
Why this is the answer
The three authentication factors are knowledge (e.g., password), possession (e.g., token), and inheritance (e.g., fingerprint). 'Something you do' is not a standard factor.
- Question 3Interactive
Refer to the code block below. Which security framework is described as having a control catalog of over 1,000 controls?
- AISO 27001
- BNIST 800-53Correct answer
- COWASP
- DGDPR
Why this is the answer
NIST SP 800-53 provides a comprehensive catalog of over 1,000 security and privacy controls organised into 20 families.
- Question 4Single Choice
Under GDPR, within how many hours must a data breach be reported to the supervisory authority?
- A24 hours
- B48 hours
- C72 hoursCorrect answer
- D7 days
Why this is the answer
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk.
- Question 5Multiple Select
Which of the following are typical classification levels in an information classification policy? (Select all that apply)
- APublicCorrect answer
- BConfidentialCorrect answer
- CRestrictedCorrect answer
- DShared
Why this is the answer
Common classification levels include Public, Internal, Confidential, and Restricted. 'Shared' is not a standard classification level.
- Question 6Interactive
Refer to the code block showing phases of the incident response lifecycle. Which phase comes immediately after 'Containment'?
- APreparation
- BEradicationCorrect answer
- CRecovery
- DLessons Learned
Why this is the answer
In the SANS PICERL model, the phases are Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. Eradication follows Containment.
- Question 7Single Choice
What does RTO stand for in disaster recovery planning?
- ARecovery Time ObjectiveCorrect answer
- BRecovery Point Objective
- CReturn on Investment
- DResponse Time Objective
Why this is the answer
RTO stands for Recovery Time Objective, which is the maximum acceptable time for restoring a business function after a disruption.
- Question 8Multiple Select
Which of the following are key characteristics of the Defense in Depth principle? (Select all that apply)
- ALayering of independent controlsCorrect answer
- BUse of diversity in technologiesCorrect answer
- CSingle point of failure
- DReliance on one strong control
Why this is the answer
Defense in depth uses multiple layers of diverse, independent controls so that the failure of one layer does not lead to complete compromise.
Networking and Technologies
12 questions in this domain
- Question 9Single Choice
Which protocol provides reliable, connection-oriented data delivery?
- ATCPCorrect answer
- BUDP
- CIP
- DICMP
Why this is the answer
TCP uses sequencing and acknowledgements to provide reliable, connection-oriented service at the transport layer.
- Question 10Multiple Select
Which two characteristics apply to IPv6 addressing?
- A32-bit address length
- B128-bit address lengthCorrect answer
- CNAT is mandatory for internet connectivity
- DEliminates the need for NATCorrect answer
Why this is the answer
IPv6 uses 128-bit addresses and removes the necessity for Network Address Translation (NAT).
- Question 11Interactive
Analyze the packet capture snippet. Which flag indicates a TCP connection request?
- ASYNCorrect answer
- BACK
- CFIN
- DRST
Why this is the answer
The SYN flag is set in the first packet of the TCP three-way handshake to initiate a connection.
- Question 12Single Choice
At which OSI layer does a switch operate?
- ALayer 1
- BLayer 2Correct answer
- CLayer 3
- DLayer 4
Why this is the answer
Switches forward frames based on MAC addresses at the Data Link layer (Layer 2).
- Question 13Multiple Select
Which two vulnerabilities are associated with Layer 2 switching?
- AARP spoofingCorrect answer
- BBGP hijacking
- CMAC floodingCorrect answer
- DIP spoofing
Why this is the answer
ARP spoofing and MAC flooding are attacks that exploit Layer 2 switching mechanisms.
- Question 14Interactive
Examine the STP port state description. Which state prevents frame forwarding but processes BPDUs?
- ABlockingCorrect answer
- BListening
- CLearning
- DForwarding
Why this is the answer
In the STP Blocking state, the port does not forward data frames but still receives and processes BPDUs.
- Question 15Single Choice
Which type of firewall keeps track of connection state?
- AStateless firewall
- BStateful firewallCorrect answer
- CPacket filter
- DApplication gateway
Why this is the answer
A stateful firewall keeps track of the state of active connections, using a state table to allow return traffic automatically.
- Question 16Multiple Select
Which two characteristics apply to a stateless firewall?
- AMaintains a connection state table
- BRequires explicit rules for return trafficCorrect answer
- CInspects each packet independentlyCorrect answer
- DCan detect SYN floods automatically
Why this is the answer
A stateless firewall inspects packets independently without context and needs explicit bidirectional rules.
- Question 17Interactive
Analyze the firewall rule. What is the purpose of the 'established' keyword in a stateful firewall rule?
- AAllows all outbound traffic
- BMatches packets belonging to an existing sessionCorrect answer
- CMatches TCP SYN packets only
- DMatches packets with any flag set
Why this is the answer
The 'established' keyword matches packets that are part of an already established connection, used by stateful firewalls.
- Question 18Single Choice
What does DMZ stand for in network segmentation?
- ADemilitarized ZoneCorrect answer
- BDual Main Zone
- CDemarcation Zone
- DData Management Zone
Why this is the answer
DMZ stands for Demilitarized Zone, a buffer network between untrusted and trusted networks.
- Question 19Multiple Select
Which two principles should guide DMZ design?
- ADMZ hosts can initiate any outbound connection
- BDMZ should contain sensitive databases
- CTraffic from DMZ to internal should be restrictedCorrect answer
- DOnly necessary services should be exposed in the DMZCorrect answer
Why this is the answer
DMZ hosts should only run necessary services, and traffic from DMZ to internal must be restricted to limit lateral movement.
- Question 20Interactive
Examine the following network zone description. Which trust level is typically assigned to a DMZ?
- AUntrusted
- BPartially TrustedCorrect answer
- CFully Trusted
- DHighly Restricted
Why this is the answer
A DMZ is considered a partially trusted zone, serving as a buffer between untrusted external networks and trusted internal networks.
Penetration Testing Methodologies
8 questions in this domain
- Question 21Single Choice
What is the primary purpose of the Rules of Engagement (RoE) document in a penetration test?
- ASets the payment terms
- BDefines legal and technical boundariesCorrect answer
- CLists all vulnerabilities found
- DDescribes the testing team's skills
Why this is the answer
The RoE is a legal contract that defines the scope, methods, and constraints of the test. It is the single source of truth for all parties.
- Question 22Multiple Select
Which two elements must be included in a penetration test scoping document?
- ATarget IP addressesCorrect answer
- BTesters' educational background
- CTime window for testingCorrect answer
- DClient's marketing budget
Why this is the answer
A scoping document lists target IP addresses/URLs and the testing time window. It does not include tester backgrounds or client budgets.
- Question 23Interactive
Given the nmap command shown, what scan type does it perform?
- ASYN stealth scanCorrect answer
- BTCP connect scan
- CUDP scan
- DPing sweep
Why this is the answer
The option -sS indicates a SYN stealth scan, which is the default when run with root privileges.
- Question 24Single Choice
What is the first step a penetration tester should take after receiving a client request for a test?
- AStart scanning immediately
- BDefine scope and obtain written authorisationCorrect answer
- CSend an invoice
- DGather OSINT
Why this is the answer
The first step is to define a scoping document with clear boundaries and obtain written authorisation before any technical activity.
- Question 25Multiple Select
Which two of the following are considered OSINT (passive reconnaissance) techniques?
- AQuerying certificate transparency logsCorrect answer
- BPerforming a SYN scan on target IP
- CUsing Shodan to find open portsCorrect answer
- DExploiting a SQL injection
Why this is the answer
CT logs and Shodan are sources that collect public data without sending traffic to the target. SYN scanning is active.
- Question 26Interactive
Examine the following command. What task does it perform during OSINT?
- AEnumerating subdomains via CT logs
- BSearching for emails on public sourcesCorrect answer
- CPerforming a DNS zone transfer
- DScanning for open ports
Why this is the answer
The command uses theHarvester with a domain to collect email addresses from public sources like search engines.
- Question 27Single Choice
Which tool is primarily used for intercepting and modifying web traffic during web application testing?
- ANmap
- BNessus
- CBurp SuiteCorrect answer
- DWireshark
Why this is the answer
Burp Suite's Proxy module intercepts and allows modification of HTTP/S traffic. Nmap is for network scanning, Nessus for vulnerability scanning.
- Question 28Multiple Select
Which two scan types does Nmap offer for port scanning?
- ASYN stealth scanCorrect answer
- BFTP bounce scan
- CTCP connect scanCorrect answer
- DHTTP GET scan
Why this is the answer
Nmap's primary scan types are SYN (-sS) and TCP connect (-sT). FTP bounce and HTTP GET are not standard Nmap scan types.
Professional Conduct and Ethics
4 questions in this domain
- Question 29Single Choice
What is the primary purpose of the CREST Code of Ethics for penetration testers?
- ATo provide guidelines that can be ignored in emergencies
- BTo ensure testers prioritize profit over safety
- CTo uphold integrity, trust, and professionalism in the testing industryCorrect answer
- DTo allow testers to alter reports as requested by clients
Why this is the answer
The CREST Code of Ethics is a binding requirement that upholds integrity, trust, and professionalism. It is not aspirational and must be adhered to.
- Question 30Multiple Select
Which of the following are key elements of responsible vulnerability reporting? (Select all that apply)
- ACoordinated disclosure with the asset ownerCorrect answer
- BImmediate public posting of all findings
- CUse of encrypted channels for transmissionCorrect answer
- DIncluding raw PII in the report to prove impact
Why this is the answer
Responsible reporting involves coordinated disclosure with the asset owner, using encrypted channels, and avoiding inclusion of raw PII. Immediate public posting can cause harm.
- Question 31Interactive
During a penetration test, you discover a vulnerability that allows you to access a database containing personal data of UK residents. According to the legal boundaries described in the playbook, what must you do? Refer to the code snippet below as context.
- AContinue testing and include the data in the report
- BStop testing, secure the evidence, and contact the client immediatelyCorrect answer
- CIgnore the data as it is outside the signed scope
- DDelete the data and proceed as if nothing happened
Why this is the answer
Upon discovering personal data outside scope, the analyst must stop testing, secure the evidence, and inform the client immediately to avoid legal violations under UK DPA and CMA.
- Question 32Single Choice
What is a key requirement for client communication and transparency according to CREST?
- AOnly share positive findings to maintain good relationships
- BProvide regular status updates and report critical incidents immediatelyCorrect answer
- CWait until the final report to share any information
- DShare all raw data in real-time without filtering
Why this is the answer
Transparency requires regular updates and immediate notification of critical incidents. Hiding issues or delaying communication violates ethical principles.
Tools and Technical Skills
8 questions in this domain
- Question 33Single Choice
Which command is used to execute an auxiliary module in the Metasploit Framework?
- ArunCorrect answer
- Bexploit
- Cexecute
- Dstart
Why this is the answer
Auxiliary modules use the 'run' command; exploit modules use 'exploit'. This distinction is fundamental in MSF usage.
- Question 34Multiple Select
Which of the following are Burp Suite modules? (Select two.)
- ARepeaterCorrect answer
- BIntruderCorrect answer
- CMetasploit
- DWireshark
Why this is the answer
Burp Suite includes Repeater for manual request replay and Intruder for automated fuzzing. Metasploit and Wireshark are separate tools.
- Question 35Interactive
In Wireshark, what does the display filter shown below do?
- AShows only HTTP POST requests
- BDisplays only DNS queries (not responses)Correct answer
- CFilters all UDP port 53 traffic
- DCaptures only DNS responses from the server
Why this is the answer
The filter `dns.flags.response == 0` isolates DNS queries (where the response bit is not set). It does not show responses or all UDP/53 traffic.
- Question 36Single Choice
Which Nmap scan type sends only a SYN packet and does not complete the TCP handshake?
- ATCP SYN scan (-sS)Correct answer
- BTCP Connect scan (-sT)
- CUDP scan (-sU)
- DFIN scan (-sF)
Why this is the answer
SYN scan (-sS) sends a SYN, receives SYN/ACK (open) or RST (closed), and does not send the final ACK. It is the default privileged scan.
- Question 37Multiple Select
Which two attack modes are supported by Hashcat for password cracking? (Select two.)
- ADictionary attack (-a 0)Correct answer
- BMask attack (-a 3)Correct answer
- CIncremental mode
- DSingle crack mode
Why this is the answer
Hashcat uses numeric modes: -a 0 for dictionary and -a 3 for mask. Incremental and single crack are John the Ripper modes.
- Question 38Interactive
What does the following Bash one-liner do?
- ACounts the number of unique IP addresses in a log file
- BFilters lines containing 'failed' and counts occurrences per dayCorrect answer
- CDeletes log entries older than 24 hours
- DExtracts all IP addresses that failed authentication
Why this is the answer
The command uses grep to select lines with 'failed', awk to extract the date field, sort, and uniq -c to count occurrences per unique date. It shows failed event counts by day.
- Question 39Single Choice
Which tool is used to enumerate Windows domain users via LDAP queries?
- AldapsearchCorrect answer
- Benum4linux
- CBloodHound
- DNmap
Why this is the answer
ldapsearch is the standard LDAP client for querying directories. enum4linux uses SMB/RPC, BloodHound maps AD relationships, Nmap is for network scanning.
- Question 40Multiple Select
Which two prerequisites must be met before using Aircrack-ng to capture WPA handshakes? (Select two.)
- AEnable monitor mode on the wireless interfaceCorrect answer
- BKill interfering processes (e.g., NetworkManager)Correct answer
- CInstall the Hashcat tool
- DConnect to the target AP using a valid password
Why this is the answer
Monitor mode allows capturing all 802.11 frames; killing interfering processes prevents driver conflicts. No valid association or Hashcat is needed at the capture stage.
Frequently asked questions
Everything about the Practitioner Security Analyst question bank and how to use it.