LPT (Master) sample questions

Question 1

A penetration tester is drafting a Statement of Work (SOW) for a client requiring PCI-DSS compliance testing. The client uses a cloud-native architecture with microservices. Which specific scoping requirement must be included to ensure the test satisfies PCI-DSS Requirement 11.3?

Accepted Answer

The scope must validate the segmentation controls separating the CDE from non-CDE systems, in addition to testing the CDE itself.

Answer

The penetration test must be conducted exclusively as a White Box assessment with full access to source code.

Answer

The scope must include only the Cardholder Data Environment (CDE) and exclude any connected systems to minimize cost.

Answer

The test must be performed using only automated vulnerability scanners approved by the PCI Security Standards Council.

Question 2

While utilizing AI-driven penetration testing tools during an engagement, you notice the tool is generating traffic that mimics a known ransomware propagation pattern (SMB scanning followed by encryption attempts on dummy files). The ROE strictly prohibits 'destructive testing' or 'simulation of malware that alters file integrity.' What is the immediate best practice response?

Accepted Answer

Suspend the tool's execution immediately, verify the configuration, and document the incident before consulting the client POC.

Answer

Reconfigure the tool to use HTTP traffic instead of SMB to evade detection while continuing the test.

Answer

Update the ROE unilaterally to include ransomware simulation as it is a critical threat vector.

Answer

Allow the tool to continue as encryption of dummy files does not impact business continuity.

Question 3

You are performing OSINT on a target organization 'Globex Corp'. You have identified their primary domain is `globex.com`. You suspect they are using a specific naming convention for their internal development servers which might be exposed. Using `massdns` or a similar tool, which wordlist strategy would yield the highest probability of discovering these hidden subdomains with minimal noise?

Accepted Answer

Generate a permutation list based on identified public subdomains (e.g., 'dev-www', 'staging-mail') using tools like Altdns.

Answer

Perform a zone transfer request against the root TLD servers.

Answer

Use a massive generic dictionary list (e.g., all English words) to brute force every possibility.

Answer

Query the WHOIS database for every IP address in the target's netblock.

Question 4

True or False: When performing a physical social engineering engagement, utilizing a ' pre-texting' call to the target facility's security desk to verify the arrival of a 'vendor' (yourself) constitutes a passive information gathering technique.

Accepted Answer

False

Answer

True

Question 5

Which of the following Shodan search filters would be MOST effective for identifying a target organization's exposed Industrial Control Systems (ICS) specifically running the Modbus protocol, restricted to their specific IP range?

Accepted Answer

port:502 net:192.0.2.0/24

Answer

service:ics country:US net:192.0.2.0/24

Answer

title:"SCADA" hostname:target.com

Answer

port:80 product:"Modbus" org:"TargetCorp"

Question 6

You are testing a web application that uses JSON Web Tokens (JWT) for authentication. You intercept a token and notice the header contains `{"alg": "RS256"}`. You attempt to modify the payload to escalate privileges to 'admin', change the header to `{"alg": "HS256"}`, and sign the token using the server's public key (which you retrieved from a publicly accessible JWKS endpoint). What specific vulnerability are you attempting to exploit?

Accepted Answer

Algorithm Confusion (Key Confusion) Attack

Answer

None Algorithm Attack

Answer

JWT Kid (Key ID) Injection

Answer

JWKS Spoofing

Free LPT (Master) sample questions

A penetration tester is drafting a Statement of Work (SOW) for a client requiring PCI-DSS compliance testing. The client uses a cloud-native architecture with microservices. Which specific scoping requirement must be included to ensure the test satisfies PCI-DSS Requirement 11.3?

True or False: When performing a physical social engineering engagement, utilizing a ' pre-texting' call to the target facility's security desk to verify the arrival of a 'vendor' (yourself) constitutes a passive information gathering technique.

Which of the following Shodan search filters would be MOST effective for identifying a target organization's exposed Industrial Control Systems (ICS) specifically running the Modbus protocol, restricted to their specific IP range?

6 more free samples are waiting