LPT (Master) sample questions

Question 1

You are the lead penetration tester for a multinational financial institution. During the scoping phase, the client requests a 'Black Box' assessment of their European subsidiary's payment gateway. However, the Rules of Engagement (ROE) explicitly state that no testing should be performed against systems hosting GDPR-protected data without specific written consent from the Data Protection Officer (DPO). While mapping the attack surface, you identify a load balancer (192.0.2.15) that routes traffic to both the payment gateway and a legacy HR portal hosting sensitive PII. The load balancer itself is within scope.

Based on the flowchart below and the scenario, what is the legally and ethically correct course of action?

Accepted Answer

Pause the engagement immediately and request an addendum to the ROE from the client explicitly authorizing potential incidental contact with the HR portal or isolating the target environment.

Answer

Proceed with testing the load balancer as it is explicitly in scope, but configure tools to strictly avoid HTTP Host headers requesting the HR portal.

Answer

Conduct passive OSINT gathering on the HR portal to confirm its functionality, then exploit the load balancer using only non-intrusive scanning techniques.

Answer

Perform a Denial of Service (DoS) test on the load balancer to verify resilience, as availability testing is standard in payment gateway assessments.

Question 2

A penetration tester is drafting a Statement of Work (SOW) for a client requiring PCI-DSS compliance testing. The client uses a cloud-native architecture with microservices. Which specific scoping requirement must be included to ensure the test satisfies PCI-DSS Requirement 11.3?

Accepted Answer

The scope must validate the segmentation controls separating the CDE from non-CDE systems, in addition to testing the CDE itself.

Answer

The scope must include only the Cardholder Data Environment (CDE) and exclude any connected systems to minimize cost.

Answer

The test must be performed using only automated vulnerability scanners approved by the PCI Security Standards Council.

Answer

The penetration test must be conducted exclusively as a White Box assessment with full access to source code.

Question 3

While utilizing AI-driven penetration testing tools during an engagement, you notice the tool is generating traffic that mimics a known ransomware propagation pattern (SMB scanning followed by encryption attempts on dummy files). The ROE strictly prohibits 'destructive testing' or 'simulation of malware that alters file integrity.' What is the immediate best practice response?

Accepted Answer

Suspend the tool's execution immediately, verify the configuration, and document the incident before consulting the client POC.

Answer

Allow the tool to continue as encryption of dummy files does not impact business continuity.

Answer

Reconfigure the tool to use HTTP traffic instead of SMB to evade detection while continuing the test.

Answer

Update the ROE unilaterally to include ransomware simulation as it is a critical threat vector.

Question 4

You are performing OSINT on a target organization 'Globex Corp'. You have identified their primary domain is `globex.com`. You suspect they are using a specific naming convention for their internal development servers which might be exposed. Using `massdns` or a similar tool, which wordlist strategy would yield the highest probability of discovering these hidden subdomains with minimal noise?

Accepted Answer

Generate a permutation list based on identified public subdomains (e.g., 'dev-www', 'staging-mail') using tools like Altdns.

Answer

Use a massive generic dictionary list (e.g., all English words) to brute force every possibility.

Answer

Perform a zone transfer request against the root TLD servers.

Answer

Query the WHOIS database for every IP address in the target's netblock.

Question 5

True or False: When performing a physical social engineering engagement, utilizing a ' pre-texting' call to the target facility's security desk to verify the arrival of a 'vendor' (yourself) constitutes a passive information gathering technique.

Accepted Answer

False

Answer

True

Question 6

Which of the following Shodan search filters would be MOST effective for identifying a target organization's exposed Industrial Control Systems (ICS) specifically running the Modbus protocol, restricted to their specific IP range?

Accepted Answer

port:502 net:192.0.2.0/24

Answer

port:80 product:"Modbus" org:"TargetCorp"

Answer

service:ics country:US net:192.0.2.0/24

Answer

title:"SCADA" hostname:target.com

Free LPT (Master) sample questions

A penetration tester is drafting a Statement of Work (SOW) for a client requiring PCI-DSS compliance testing. The client uses a cloud-native architecture with microservices. Which specific scoping requirement must be included to ensure the test satisfies PCI-DSS Requirement 11.3?

True or False: When performing a physical social engineering engagement, utilizing a ' pre-texting' call to the target facility's security desk to verify the arrival of a 'vendor' (yourself) constitutes a passive information gathering technique.

Which of the following Shodan search filters would be MOST effective for identifying a target organization's exposed Industrial Control Systems (ICS) specifically running the Modbus protocol, restricted to their specific IP range?

6 more free samples are waiting