1|Page
CPSA FINAL EXAM AND STUDY GUIDE NEWEST 2026
TEST BANK| CREST PRACTITIONER SECURITY
ANALYST (CPSA) CERTIFICATION EXAM PREP WITH
COMPLETE 450 REAL EXAM QUESTIONS AND
CORRECT VERIFIED ANSWERS/ ALREADY GRADED
A+ (MOST RECENT!!)
What are the three FHRP Protocols? - ANSWER - HSRP (Hot Standy
Router Protocol), VRRP (Virtual Router Redundancy Protocol) and
GLBP (Gateway load-balancing protocol)
What is DES (Bit key size, block size) - ANSWER - DES uses a 56 bit
key with a 64 bit block
What is 3DES (Bit key size, block size) - ANSWER - 112/168 Bit key,
64 bit block and applies the DES algorithm 3 times
What is AES (Block size, Key size) - ANSWER - 128 Bit Block and
then a 128,192 or 256 bit key.
What is a Block Cipher? - ANSWER - A block cipher is a method of
encrypting text (to produce ciphertext) in which a cryptographic key and
algorithm are applied to a block of data (for example, 64 contiguous
bits) at once as a group rather than to one bit at a time.
,2|Page
What is a Stream Cipher - ANSWER - An encryption method that
encrypts a single bit at a time. Popular when data comes in long streams
(such as with older wireless networks or cell phones).
What is RC4 (Key size) - ANSWER - Stream Symmetric cipher, key
size of 40-2048 bits.
State some Asymmetric algorithms? - ANSWER - RSA (1024-4096),
ECC, DSA and DH
What is HMAC? - ANSWER - HMAC is a keyed-hash message
authentication code used to provide a checksum for a message, sent
along with the message to provide confidence that the message has not
been tampered.
What is PGP? - ANSWER - Pretty Good Privacy: An encryption
program that provides cryptographic privacy and authentication for data
communication (such as emails).
What two protocols does IPsec use? - ANSWER - Authentication
Header (AH) and Encapsulating Security Payload (ESP)
What is Internet Key Exchange? - ANSWER - IKE is a protocol used to
secure and authenticate communication channels between two parties.
,3|Page
What does IKE Phase 1 do? - ANSWER - Establishes a secure
authenticated communication channel using the Diffie-Hellman key
exchange algorithm and generates a shared secret key which is used in
further IKE communications.
What modes can Phase 1 operate in? - ANSWER - Either Main Mode or
Aggressive Mode. With Main Mode protecting the identify of peers and
the hash of the shared key by encrypting them and aggressive mode does
not.
What does IKE Phase 2 do? - ANSWER - Operates in quick mode and
uses ESP and AH.
What is IPsec vulnerable to? - ANSWER - Passive decryption of data if
a weak DH group is used, RCE, active and passive enum using
aggressive mode, exposure and cracking of preshared key values,
obtaining XAUTH creds once a PSK is known.
State methods on how to secure SSH - ANSWER - Disable root login,
disable public exposure, limit auth tries, disable sshv1 and sshv2, use a
custom port and limit access to only specific users
What two basic elements does a registry contain? - ANSWER - Keys
(similar to folders) and values (similar to files)
, 4|Page
List all 5 of the Root Keys (Windows Registry) - ANSWER -
HKEY_LOCAL_MACHINE or HKLM, HKEY_CURRENT_CONFIG
or HKCC, HKEY_CLASSES_ROOT or HKCR,
HKEY_CURRENT_USER or HKCU, HKEY_USERS or HKU
Where is the system registry file stored in windows? - ANSWER -
C:/Windows/System32/Config
What does a wireless sniffer need to be capable of? - ANSWER - To run
monitor mode which can operate on 802.11/b/g/n/ax (each letter refers to
a different channel)
List 4 tools that can be used for wireless testing - ANSWER - Fiddler,
WiFite, airmon-ng suite and Fern Wifi
List features of WEP (802.11 a/b) - ANSWER - RC4, unencrypted,
really weak, encrypts using 64-128 bit static key in hex.
List features of TKIP (802.11i) - ANSWER - RC4, dynamic key, 64 bit
msg integrity check, compatible with legacy.
List features of WPA/WPA2 (802.11i) - ANSWER - AES and TKIP.
Supports CCMP and GCMP and supports PSK.
CPSA FINAL EXAM AND STUDY GUIDE NEWEST 2026
TEST BANK| CREST PRACTITIONER SECURITY
ANALYST (CPSA) CERTIFICATION EXAM PREP WITH
COMPLETE 450 REAL EXAM QUESTIONS AND
CORRECT VERIFIED ANSWERS/ ALREADY GRADED
A+ (MOST RECENT!!)
What are the three FHRP Protocols? - ANSWER - HSRP (Hot Standy
Router Protocol), VRRP (Virtual Router Redundancy Protocol) and
GLBP (Gateway load-balancing protocol)
What is DES (Bit key size, block size) - ANSWER - DES uses a 56 bit
key with a 64 bit block
What is 3DES (Bit key size, block size) - ANSWER - 112/168 Bit key,
64 bit block and applies the DES algorithm 3 times
What is AES (Block size, Key size) - ANSWER - 128 Bit Block and
then a 128,192 or 256 bit key.
What is a Block Cipher? - ANSWER - A block cipher is a method of
encrypting text (to produce ciphertext) in which a cryptographic key and
algorithm are applied to a block of data (for example, 64 contiguous
bits) at once as a group rather than to one bit at a time.
,2|Page
What is a Stream Cipher - ANSWER - An encryption method that
encrypts a single bit at a time. Popular when data comes in long streams
(such as with older wireless networks or cell phones).
What is RC4 (Key size) - ANSWER - Stream Symmetric cipher, key
size of 40-2048 bits.
State some Asymmetric algorithms? - ANSWER - RSA (1024-4096),
ECC, DSA and DH
What is HMAC? - ANSWER - HMAC is a keyed-hash message
authentication code used to provide a checksum for a message, sent
along with the message to provide confidence that the message has not
been tampered.
What is PGP? - ANSWER - Pretty Good Privacy: An encryption
program that provides cryptographic privacy and authentication for data
communication (such as emails).
What two protocols does IPsec use? - ANSWER - Authentication
Header (AH) and Encapsulating Security Payload (ESP)
What is Internet Key Exchange? - ANSWER - IKE is a protocol used to
secure and authenticate communication channels between two parties.
,3|Page
What does IKE Phase 1 do? - ANSWER - Establishes a secure
authenticated communication channel using the Diffie-Hellman key
exchange algorithm and generates a shared secret key which is used in
further IKE communications.
What modes can Phase 1 operate in? - ANSWER - Either Main Mode or
Aggressive Mode. With Main Mode protecting the identify of peers and
the hash of the shared key by encrypting them and aggressive mode does
not.
What does IKE Phase 2 do? - ANSWER - Operates in quick mode and
uses ESP and AH.
What is IPsec vulnerable to? - ANSWER - Passive decryption of data if
a weak DH group is used, RCE, active and passive enum using
aggressive mode, exposure and cracking of preshared key values,
obtaining XAUTH creds once a PSK is known.
State methods on how to secure SSH - ANSWER - Disable root login,
disable public exposure, limit auth tries, disable sshv1 and sshv2, use a
custom port and limit access to only specific users
What two basic elements does a registry contain? - ANSWER - Keys
(similar to folders) and values (similar to files)
, 4|Page
List all 5 of the Root Keys (Windows Registry) - ANSWER -
HKEY_LOCAL_MACHINE or HKLM, HKEY_CURRENT_CONFIG
or HKCC, HKEY_CLASSES_ROOT or HKCR,
HKEY_CURRENT_USER or HKCU, HKEY_USERS or HKU
Where is the system registry file stored in windows? - ANSWER -
C:/Windows/System32/Config
What does a wireless sniffer need to be capable of? - ANSWER - To run
monitor mode which can operate on 802.11/b/g/n/ax (each letter refers to
a different channel)
List 4 tools that can be used for wireless testing - ANSWER - Fiddler,
WiFite, airmon-ng suite and Fern Wifi
List features of WEP (802.11 a/b) - ANSWER - RC4, unencrypted,
really weak, encrypts using 64-128 bit static key in hex.
List features of TKIP (802.11i) - ANSWER - RC4, dynamic key, 64 bit
msg integrity check, compatible with legacy.
List features of WPA/WPA2 (802.11i) - ANSWER - AES and TKIP.
Supports CCMP and GCMP and supports PSK.
