CREST CPSA EXAM
CREST PRACTITIONER SECURITY ANALYST
PRACTICE GUIDE 2026–2027
120 Practice Questions with Correct Answers & Cybersecurity Rationales
Already Graded A+ Style Review | Aligned to CREST CPSA Core Knowledge Domains
Cybercrime, Cybersecurity and Data Privacy | CREST International | Exam: 120 MCQs in 2 hours
Key Domains: Network Security, Web Application Security, Vulnerability Assessment, Security Tools and Methodologies, Cryptography,
Risk Management, and Information Security Governance
Introduction
This structured CREST Practitioner Security Analyst (CPSA) practice format for 2026–2027 provides high-quality exam-style
questions with correct answers and rationales. It emphasizes foundational cybersecurity principles, vulnerability assessment,
security tooling, cryptography, and risk/governance critical to professional security analysis and CREST certification
preparation. This is an independent educational study aid; it is not an official CREST live exam instrument. Always follow laws,
authorization/RoE, and current CREST syllabus guidance.
Answer Format
All correct answers appear in bold and cyan, with concise rationales explaining cybersecurity reasoning and why
alternative options are less appropriate.
EXAM QUESTIONS (1–120)
Section: Network Security
Question 1
The primary purpose of a firewall is to:
A. Control network traffic based on security rules between trust zones
B. Encrypt all disk contents automatically
C. Replace antivirus on endpoints exclusively
D. Generate cryptographic keys only
Correct Answer: A. Control network traffic based on security rules between trust zones
Rationale: Firewalls enforce policy on permitted/denied traffic between networks or hosts.
Question 2
Defense in depth means:
A. Layering multiple complementary security controls so failure of one does not cause total compromise
B. Using only a single strong perimeter control
C. Disabling logging to reduce noise
D. Trusting all internal traffic completely
Correct Answer: A. Layering multiple complementary security controls so failure of one does not cause total
compromise
Rationale: Multiple layers (network, host, app, data, identity) reduce single points of failure.
Question 3
A DMZ (demilitarized zone) is typically used to:
A. Host internet-facing services separated from the internal network
B. Store offline backup tapes only
C. Replace VPN authentication
D. Disable all inbound filtering
,Correct Answer: A. Host internet-facing services separated from the internal network
Rationale: Public services sit in a screened subnet with controlled access to internal systems.
Question 4
TLS primarily provides:
A. Confidentiality, integrity, and server (and optionally client) authentication for data in transit
B. Only disk encryption at rest
C. Only physical door access control
D. Only antivirus signatures
Correct Answer: A. Confidentiality, integrity, and server (and optionally client) authentication for data in
transit
Rationale: Transport Layer Security protects network communications.
Question 5
Which protocol is connectionless and does not guarantee delivery?
A. UDP
B. TCP
C. TLS always without UDP
D. HTTP only as a transport layer protocol
Correct Answer: A. UDP
Rationale: UDP is unreliable/datagram-oriented; TCP provides reliable streams.
Question 6
Port 443 is commonly associated with:
A. HTTPS
B. Telnet
C. SMTP plaintext only
D. DNS queries only
Correct Answer: A. HTTPS
Rationale: HTTPS typically uses TCP/443.
Question 7
Port 22 is commonly associated with:
A. SSH
B. HTTP
C. FTP data exclusively always
D. NTP only
Correct Answer: A. SSH
Rationale: Secure Shell commonly uses TCP/22.
Question 8
An IDS differs from an IPS in that an IDS typically:
A. Detects and alerts on suspicious activity, while an IPS can also block/prevent
B. Only encrypts traffic
C. Only manages passwords
D. Cannot generate alerts
Correct Answer: A. Detects and alerts on suspicious activity, while an IPS can also block/prevent
Rationale: IDS = detect/alert; IPS = detect and actively prevent (inline).
Question 9
Network segmentation helps security by:
A. Limiting lateral movement and containing breaches to smaller zones
B. Making all systems share one flat trust domain
C. Removing the need for authentication
D. Disabling monitoring
Correct Answer: A. Limiting lateral movement and containing breaches to smaller zones
Rationale: Segments and microsegmentation reduce blast radius.
Question 10
, A VPN is primarily used to:
A. Create an encrypted tunnel for remote or site-to-site connectivity over untrusted networks
B. Replace endpoint patching
C. Scan web apps for XSS only
D. Store cryptographic hashes of passwords only
Correct Answer: A. Create an encrypted tunnel for remote or site-to-site connectivity over untrusted networks
Rationale: VPNs protect confidentiality/integrity of traffic across untrusted paths.
Question 11
NAT (Network Address Translation) primarily:
A. Maps private internal addresses to public addresses for connectivity (and can obscure internal topology)
B. Provides end-to-end application authentication by itself
C. Replaces TLS encryption
D. Detects malware in files
Correct Answer: A. Maps private internal addresses to public addresses for connectivity (and can obscure
internal topology)
Rationale: NAT is addressing/connectivity; not a complete security control alone.
Question 12
ARP spoofing attacks target:
A. Local network address resolution to redirect traffic (MITM on LAN)
B. Only DNS root servers on the internet exclusively
C. Only TLS certificate authorities globally always
D. Only physical cable cuts
Correct Answer: A. Local network address resolution to redirect traffic (MITM on LAN)
Rationale: ARP operates on local segments; defenses include dynamic ARP inspection, static entries, segmentation.
Question 13
DNS resolution translates:
A. Domain names to IP addresses (and related resource records)
B. MAC addresses to switch ports only
C. Passwords to hashes only
D. Files to antivirus verdicts only
Correct Answer: A. Domain names to IP addresses (and related resource records)
Rationale: DNS is critical infrastructure; protect with DNSSEC, filtering, logging.
Question 14
A SYN flood is primarily a type of:
A. Denial-of-service attack exhausting half-open TCP connection resources
B. SQL injection attack
C. Password spraying against SSH only
D. Ransomware encryption of disks
Correct Answer: A. Denial-of-service attack exhausting half-open TCP connection resources
Rationale: Resource exhaustion DoS; mitigations include SYN cookies, rate limiting, scrubbing.
Question 15
Which wireless security mode is considered obsolete and insecure?
A. WEP
B. WPA3-Enterprise
C. WPA2-Enterprise with strong EAP
D. WPA3-Personal
Correct Answer: A. WEP
Rationale: WEP is broken; use modern WPA2/WPA3 with strong configuration.
Question 16
802.1X is commonly used for:
A. Port-based network access control (NAC) authenticating devices/users before LAN/WLAN access
B. Encrypting email at rest only
CREST PRACTITIONER SECURITY ANALYST
PRACTICE GUIDE 2026–2027
120 Practice Questions with Correct Answers & Cybersecurity Rationales
Already Graded A+ Style Review | Aligned to CREST CPSA Core Knowledge Domains
Cybercrime, Cybersecurity and Data Privacy | CREST International | Exam: 120 MCQs in 2 hours
Key Domains: Network Security, Web Application Security, Vulnerability Assessment, Security Tools and Methodologies, Cryptography,
Risk Management, and Information Security Governance
Introduction
This structured CREST Practitioner Security Analyst (CPSA) practice format for 2026–2027 provides high-quality exam-style
questions with correct answers and rationales. It emphasizes foundational cybersecurity principles, vulnerability assessment,
security tooling, cryptography, and risk/governance critical to professional security analysis and CREST certification
preparation. This is an independent educational study aid; it is not an official CREST live exam instrument. Always follow laws,
authorization/RoE, and current CREST syllabus guidance.
Answer Format
All correct answers appear in bold and cyan, with concise rationales explaining cybersecurity reasoning and why
alternative options are less appropriate.
EXAM QUESTIONS (1–120)
Section: Network Security
Question 1
The primary purpose of a firewall is to:
A. Control network traffic based on security rules between trust zones
B. Encrypt all disk contents automatically
C. Replace antivirus on endpoints exclusively
D. Generate cryptographic keys only
Correct Answer: A. Control network traffic based on security rules between trust zones
Rationale: Firewalls enforce policy on permitted/denied traffic between networks or hosts.
Question 2
Defense in depth means:
A. Layering multiple complementary security controls so failure of one does not cause total compromise
B. Using only a single strong perimeter control
C. Disabling logging to reduce noise
D. Trusting all internal traffic completely
Correct Answer: A. Layering multiple complementary security controls so failure of one does not cause total
compromise
Rationale: Multiple layers (network, host, app, data, identity) reduce single points of failure.
Question 3
A DMZ (demilitarized zone) is typically used to:
A. Host internet-facing services separated from the internal network
B. Store offline backup tapes only
C. Replace VPN authentication
D. Disable all inbound filtering
,Correct Answer: A. Host internet-facing services separated from the internal network
Rationale: Public services sit in a screened subnet with controlled access to internal systems.
Question 4
TLS primarily provides:
A. Confidentiality, integrity, and server (and optionally client) authentication for data in transit
B. Only disk encryption at rest
C. Only physical door access control
D. Only antivirus signatures
Correct Answer: A. Confidentiality, integrity, and server (and optionally client) authentication for data in
transit
Rationale: Transport Layer Security protects network communications.
Question 5
Which protocol is connectionless and does not guarantee delivery?
A. UDP
B. TCP
C. TLS always without UDP
D. HTTP only as a transport layer protocol
Correct Answer: A. UDP
Rationale: UDP is unreliable/datagram-oriented; TCP provides reliable streams.
Question 6
Port 443 is commonly associated with:
A. HTTPS
B. Telnet
C. SMTP plaintext only
D. DNS queries only
Correct Answer: A. HTTPS
Rationale: HTTPS typically uses TCP/443.
Question 7
Port 22 is commonly associated with:
A. SSH
B. HTTP
C. FTP data exclusively always
D. NTP only
Correct Answer: A. SSH
Rationale: Secure Shell commonly uses TCP/22.
Question 8
An IDS differs from an IPS in that an IDS typically:
A. Detects and alerts on suspicious activity, while an IPS can also block/prevent
B. Only encrypts traffic
C. Only manages passwords
D. Cannot generate alerts
Correct Answer: A. Detects and alerts on suspicious activity, while an IPS can also block/prevent
Rationale: IDS = detect/alert; IPS = detect and actively prevent (inline).
Question 9
Network segmentation helps security by:
A. Limiting lateral movement and containing breaches to smaller zones
B. Making all systems share one flat trust domain
C. Removing the need for authentication
D. Disabling monitoring
Correct Answer: A. Limiting lateral movement and containing breaches to smaller zones
Rationale: Segments and microsegmentation reduce blast radius.
Question 10
, A VPN is primarily used to:
A. Create an encrypted tunnel for remote or site-to-site connectivity over untrusted networks
B. Replace endpoint patching
C. Scan web apps for XSS only
D. Store cryptographic hashes of passwords only
Correct Answer: A. Create an encrypted tunnel for remote or site-to-site connectivity over untrusted networks
Rationale: VPNs protect confidentiality/integrity of traffic across untrusted paths.
Question 11
NAT (Network Address Translation) primarily:
A. Maps private internal addresses to public addresses for connectivity (and can obscure internal topology)
B. Provides end-to-end application authentication by itself
C. Replaces TLS encryption
D. Detects malware in files
Correct Answer: A. Maps private internal addresses to public addresses for connectivity (and can obscure
internal topology)
Rationale: NAT is addressing/connectivity; not a complete security control alone.
Question 12
ARP spoofing attacks target:
A. Local network address resolution to redirect traffic (MITM on LAN)
B. Only DNS root servers on the internet exclusively
C. Only TLS certificate authorities globally always
D. Only physical cable cuts
Correct Answer: A. Local network address resolution to redirect traffic (MITM on LAN)
Rationale: ARP operates on local segments; defenses include dynamic ARP inspection, static entries, segmentation.
Question 13
DNS resolution translates:
A. Domain names to IP addresses (and related resource records)
B. MAC addresses to switch ports only
C. Passwords to hashes only
D. Files to antivirus verdicts only
Correct Answer: A. Domain names to IP addresses (and related resource records)
Rationale: DNS is critical infrastructure; protect with DNSSEC, filtering, logging.
Question 14
A SYN flood is primarily a type of:
A. Denial-of-service attack exhausting half-open TCP connection resources
B. SQL injection attack
C. Password spraying against SSH only
D. Ransomware encryption of disks
Correct Answer: A. Denial-of-service attack exhausting half-open TCP connection resources
Rationale: Resource exhaustion DoS; mitigations include SYN cookies, rate limiting, scrubbing.
Question 15
Which wireless security mode is considered obsolete and insecure?
A. WEP
B. WPA3-Enterprise
C. WPA2-Enterprise with strong EAP
D. WPA3-Personal
Correct Answer: A. WEP
Rationale: WEP is broken; use modern WPA2/WPA3 with strong configuration.
Question 16
802.1X is commonly used for:
A. Port-based network access control (NAC) authenticating devices/users before LAN/WLAN access
B. Encrypting email at rest only
