I85PREP
⌘ K
CISAW-LPT study materials
CISAW-LPT study resources

CISAW-LPT practice questions

One question at a time. Build your CISAW-LPT understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web application and data-protection foundations

A web application builds SQL statements by concatenating unsanitized user input into the query string. Which control most reliably prevents SQL injection?

  1. Parameterized queries (prepared statements) with bound parameters Correct answer.
  2. Client-side JavaScript that rejects apostrophes before submit
  3. Hiding the database error page while still concatenating input
  4. Relying on a web application firewall as the only control

Explanation

Parameterized queries keep data separate from SQL code, so user input cannot change the statement structure. This is the primary application-layer control against SQL injection. Client-side checks, hiding errors, and a WAF can help defense in depth but do not replace safe query construction.

Question 2Web application and data-protection foundations

A comment field stores visitor input and later renders it in every user's browser without encoding. Which XSS class is this?

  1. Reflected XSS
  2. Stored (persistent) XSS Correct answer.
  3. DOM-based XSS only, with no server storage
  4. CSRF, because another user is affected

Explanation

Stored XSS occurs when untrusted input is saved on the server and later sent to other users without context-appropriate encoding. The payload executes in each victim's browser when they view the stored content. Reflected XSS is echoed in an immediate response; DOM XSS is client-side only; CSRF forges a state-changing request, not script storage.

Question 3Web application and data-protection foundations

Which control best prevents CSRF on a cookie-authenticated form that changes account email?

  1. A per-session unpredictable anti-CSRF token checked on the server Correct answer.
  2. A long password policy for the account
  3. Enabling directory listing on the form path so testers can see the HTML
  4. Returning HTTP 200 for every POST regardless of origin

Explanation

A server-validated, unpredictable anti-CSRF token (often paired with SameSite cookies) binds the request to the user's real session and page. Attackers on another site cannot read that token. Password length, directory listing, and always-200 responses do not bind the request to the legitimate form.

Question 4Web application and data-protection foundations

User A changes the account-id parameter in a profile URL and receives User B's personal data. What access-control failure is this?

  1. Vertical privilege escalation to an administrator role
  2. Insecure direct object reference (horizontal unauthorized access) Correct answer.
  3. Cross-site request forgery against User B
  4. Server-side request forgery to an internal host

Explanation

The tester stayed at the same privilege level but accessed another user's object by manipulating an identifier. That is a classic insecure direct object reference (IDOR) / horizontal access-control failure. Vertical escalation would grant a higher role; CSRF would forge User B's own request; SSRF would make the server fetch a URL.

Question 5Web application and data-protection foundations

An application fetches a user-supplied URL on the server to generate a link preview. Which mitigation best reduces SSRF risk?

  1. Allowlist of permitted destinations and block private/link-local address ranges Correct answer.
  2. Trust any URL that uses HTTPS
  3. Percent-encode the URL and then fetch it unchanged
  4. Disable TLS certificate validation so more URLs succeed

Explanation

SSRF is reduced by fetching only destinations the application actually needs, resolving and checking addresses after redirects, and blocking private, loopback, and link-local ranges. HTTPS alone, encoding, or disabling certificate checks does not stop the server from reaching internal services.

Question 6Web application and data-protection foundations

A feature accepts a URL, the server retrieves it, and the HTTP response body is shown only to the requesting user. Testers observe that supplying an internal hostname returns an internal error page. Which issue is indicated?

  1. Stored XSS, because the body is displayed
  2. CSRF, because a URL is involved
  3. SSRF, because the server is induced to contact an internal host Correct answer.
  4. Clickjacking, because an internal page appears

Explanation

The server, not the tester's browser, is making the connection to an internal name. That is the defining behavior of server-side request forgery. Displaying the body to the same user does not make it stored XSS; CSRF and clickjacking involve the victim's browser, not the application's outbound fetch.

Question 7Web application and data-protection foundations

Which file-upload design most reduces the chance that an uploaded file is later executed as code?

  1. Store files outside the web root, rename them, and serve them from a non-executable location Correct answer.
  2. Trust the client-supplied Content-Type header as the file type
  3. Allow any extension if the filename contains the word photo
  4. Keep the original name and place the file in the public scripts directory

Explanation

Storing uploads outside the web root, generating a new name, and serving through a handler that never executes the bytes as code is the core mitigation. Client Content-Type and filename keywords are attacker-controlled. Saving into a script directory with the original name is a common path to remote code execution.

Question 8Web application and data-protection foundations

A session cookie is sent over HTTPS. Which cookie flag tells the browser not to include that cookie on cleartext HTTP requests?

  1. HttpOnly
  2. Secure Correct answer.
  3. SameSite=Lax
  4. Path=/

Explanation

The Secure flag restricts the cookie to HTTPS requests, reducing theft on open networks. HttpOnly blocks script access, SameSite limits cross-site sending, and Path scopes the cookie to a URL prefix. Testers should report missing Secure on authentication cookies.

Question 9Web application and data-protection foundations

Why should an authentication cookie set the HttpOnly flag?

  1. It encrypts the cookie value at rest on the server
  2. It stops the cookie from being sent to subdomains
  3. It prevents document.cookie (and similar script APIs) from reading the cookie Correct answer.
  4. It forces the cookie to expire when the tab closes

Explanation

HttpOnly keeps the cookie out of JavaScript, which reduces the impact of XSS that tries to steal session identifiers. It does not encrypt server-side storage, constrain domains, or define session lifetime. Combine it with Secure, SameSite, and XSS prevention.

Question 10Web application and data-protection foundations

Which SameSite cookie setting most strictly prevents the browser from sending the cookie on cross-site requests?

  1. SameSite=None without Secure
  2. SameSite=Lax
  3. SameSite=Strict Correct answer.
  4. Omitting SameSite on a modern browser that defaults to Lax

Explanation

SameSite=Strict withholds the cookie from all cross-site requests, including top-level GET navigations. Lax still sends the cookie on some top-level GET navigations. None is for explicit cross-site use and requires Secure. Omitting the attribute typically yields a Lax-like default, which is weaker than Strict for CSRF-sensitive cookies.

Question 11Web application and data-protection foundations

A tester receives a session identifier before login, authenticates, and observes that the identifier does not change. Which issue should be reported?

  1. Session fixation: the application failed to rotate the session ID at login Correct answer.
  2. CSRF, because the identifier is reused
  3. SSRF, because the identifier is client-supplied
  4. Open redirect, because the login flow continues

Explanation

Session fixation succeeds when an attacker can set a victim's pre-auth session ID and the server keeps it after authentication. The mitigation is to issue a new session ID on privilege change (login). CSRF, SSRF, and open redirect are different classes.

Question 12Web application and data-protection foundations

A request to an API without credentials returns HTTP 401. A request with a valid user cookie to an admin-only endpoint returns HTTP 403. What is the correct interpretation?

  1. 401 means the server is down; 403 means the URL is missing
  2. 401 means unauthenticated; 403 means authenticated but not authorized Correct answer.
  3. 401 and 403 are interchangeable success codes
  4. 403 means the cookie was never sent; 401 means CSRF succeeded

Explanation

HTTP 401 Unauthorized (despite the name) signals missing or invalid authentication. HTTP 403 Forbidden signals that the client is known but lacks permission. Testers use this distinction when mapping access-control behavior, not as a payload.

Question 13Web application and data-protection foundations

A tester requests a directory URL without an index file and receives a listing of backup archives and configuration files. What should the report recommend first?

  1. Disable directory listing and move sensitive files out of the web root Correct answer.
  2. Publish the listing in a blog so users can help review files
  3. Change the directory name but keep listing enabled
  4. Leave listing enabled for easier operations

Explanation

Directory listing is an information-disclosure flaw that often exposes backups and credentials. Disable autoindexing in the middleware and keep secrets outside the document root. Public posting of client files would violate authorization and data-protection duties.

Question 14Web application and data-protection foundations

An application includes a local file whose name is taken from a query parameter and concatenated onto a directory path. Which issue class should testers investigate?

  1. Local file inclusion / path traversal Correct answer.
  2. CSRF against the file system
  3. Clickjacking of static assets
  4. SPF record misconfiguration

Explanation

User-controlled file paths can cause local file inclusion or path traversal if the application does not map names to an allowlist. CSRF, clickjacking, and SPF are unrelated. Mitigation is an allowlist of permitted files, never raw path concatenation.

Question 15Web application and data-protection foundations

Which server configuration most directly reduces remote file inclusion risk in a PHP application?

  1. Enabling allow_url_include so remote resources can be reused
  2. Disabling allow_url_include and include-path features that fetch remote URLs, plus an allowlist of local files Correct answer.
  3. Displaying include errors with full paths to help debugging in production
  4. Mapping all query parameters directly to include() for flexibility

Explanation

Remote file inclusion is reduced by refusing remote URLs in include mechanisms (for PHP, allow_url_include off) and by including only allowlisted local files. Enabling remote includes, verbose path errors, or mapping parameters to include() increases risk.

Question 16Web application and data-protection foundations

An XML parser processes untrusted documents and resolves external entities. Which mitigation is appropriate?

  1. Disable external entity resolution and unused DTD features on the parser Correct answer.
  2. Increase parser entity-expansion limits without other changes
  3. Convert the XML to HTML and reflect it unencoded
  4. Store the raw XML in a world-readable web directory

Explanation

XXE is mitigated by disabling external entities and DTD processing in the XML parser and by using less powerful formats when possible. Raising expansion limits, reflecting XML as HTML, or publishing raw XML does not stop entity resolution against local or internal resources.

Question 17Web application and data-protection foundations

A REST API sets Access-Control-Allow-Origin to * and Access-Control-Allow-Credentials to true. Why is this dangerous?

  1. Browsers will ignore CORS entirely, so the API becomes unreachable
  2. Any origin could read credentialed responses, breaking origin isolation Correct answer.
  3. The combination is required for all public APIs
  4. It only affects FTP clients, not browsers

Explanation

Browsers reject the illegal combination of wildcard origin plus credentials, or, if a reflected origin is used with credentials, any website can read authenticated responses. CORS must echo a specific allowed origin when cookies or other credentials are used. Public unauthenticated APIs may use * without credentials.

Question 18Web application and data-protection foundations

Which control is the primary defense against XSS when rendering untrusted text into HTML?

  1. Context-appropriate output encoding (and a tight Content-Security-Policy) Correct answer.
  2. Relying only on HTTPS
  3. Using HTTP TRACE for all user content
  4. Disabling cookies site-wide

Explanation

XSS is stopped by encoding untrusted data for the HTML, attribute, JavaScript, or URL context in which it is placed, plus a restrictive CSP as defense in depth. HTTPS protects transport, TRACE is a risky method, and disabling cookies does not encode output.

Question 19Web application and data-protection foundations

A page never sends user input back in HTML, but client-side script reads a fragment identifier and writes it into the DOM with innerHTML. Which XSS class is this?

  1. Stored XSS on the server
  2. SQL injection in the fragment
  3. DOM-based XSS Correct answer.
  4. SSRF via the fragment identifier

Explanation

DOM-based XSS occurs when client-side script takes untrusted data (here the URL fragment) and sinks it into a dangerous API such as innerHTML without encoding. The server may never see the fragment. Stored XSS needs server persistence; SQLi and SSRF are server-side classes.

Question 20Web application and data-protection foundations

How should a tester distinguish CSRF from XSS when classifying a finding?

  1. CSRF forges a victim's authenticated request; XSS executes attacker-controlled script in the victim's browser Correct answer.
  2. They are two names for the same cookie theft bug
  3. XSS only affects APIs; CSRF only affects static files
  4. CSRF requires SQL concatenation; XSS requires XML entities

Explanation

CSRF abuses the browser's automatic credential sending so a third-party site can trigger a state change. XSS injects script into a page the user trusts. The mitigations differ: CSRF tokens/SameSite versus output encoding/CSP. Mixing the classes leads to the wrong fix.

Question 21Web application and data-protection foundations

Which statement correctly defines SQL injection at the conceptual level used in CISAW-LPT?

  1. User-controlled data is interpreted as SQL syntax, changing query logic or data access Correct answer.
  2. A user uploads an image that is stored outside the web root
  3. A cookie lacks the Secure flag on an HTTPS-only site
  4. A DNS zone allows anonymous AXFR from the internet

Explanation

SQL injection is a code-injection flaw: untrusted input becomes part of the SQL language instead of remaining data. Upload location, cookie flags, and DNS zone transfers are different finding types. CISAW items test this definition and the parameterized-query fix, not exploit strings.

Question 22Web application and data-protection foundations

A login form shows the same generic error for every failure, but response time increases only when the username exists and a specially crafted password expression is supplied. What does this pattern suggest?

  1. A purely client-side validation bug with no server query
  2. Possible blind (time-based) SQL injection that should be confirmed only in-scope with safe tests Correct answer.
  3. That TLS is misconfigured
  4. That the site uses HTTP 204 for all failures

Explanation

When output is constant but timing changes with injected SQL expressions, testers classify a possible blind time-based SQL injection. Confirmation must stay inside authorization, avoid destructive queries, and prefer parameterized-query recommendations. Timing alone is not TLS or HTTP 204 evidence.

Question 23Web application and data-protection foundations

User input is stored safely on registration but later concatenated into a SQL statement by a batch job that builds queries as strings. Which issue is this?

  1. Second-order SQL injection Correct answer.
  2. Reflected XSS in the batch job
  3. CSRF against the database engine
  4. Clickjacking of the registration form

Explanation

Second-order SQL injection happens when data is stored without immediately breaking a query and is later used unsafely in a different statement. The fix is parameterized queries at every use site, not only at first insert. XSS, CSRF, and clickjacking do not describe delayed SQL concatenation.

Question 24Web application and data-protection foundations

An application passes a filename into an operating-system shell command instead of using a file API. Which issue class is indicated?

  1. SQL injection
  2. OS command injection Correct answer.
  3. CSRF
  4. Open redirect

Explanation

When untrusted data reaches a shell, the operating system may interpret metacharacters as commands. Use language file APIs or strictly allowlisted arguments, never a shell. SQL injection targets a database parser; CSRF and open redirect are web-request classes.

Question 25Web application and data-protection foundations

A production error page prints a full SQL statement, table names, and stack trace. What should the finding emphasize?

  1. Information disclosure that helps attackers map the data store; use generic errors and server-side logs Correct answer.
  2. That stack traces are required by the PRC Cybersecurity Law
  3. That verbose errors prove the site cannot be SQL-injected
  4. That the page is automatically safe because it uses HTTPS

Explanation

Verbose errors leak schema and code paths. Applications should return generic messages to users and log details internally. The Cybersecurity Law does not require public stack traces, and HTTPS does not hide response bodies.

Question 26Web application and data-protection foundations

A login page redirects to a URL taken from a next= query parameter without checking that the destination is local. What is the issue?

  1. Open redirect Correct answer.
  2. SSRF, because the browser follows the URL
  3. XXE, because a query parameter is used
  4. Directory listing

Explanation

Open redirect lets an attacker send victims from a trusted domain to an arbitrary site, often for phishing. Mitigation is an allowlist of local paths. The user's browser following a Location header is not SSRF (the server is not fetching the URL as a client to an internal target).

Question 27Web application and data-protection foundations

An application generates password-reset links using the HTTP Host header without validating it against a configured domain allowlist. What is the primary risk?

  1. Host-header poisoning that can point reset links or cache keys at an attacker-controlled host Correct answer.
  2. That TLS will automatically reject any Host header
  3. That DNSSEC makes Host-header checks unnecessary
  4. That this only affects FTP virtual hosts

Explanation

If password-reset emails or cache keys trust a client-supplied Host header, attackers can poison links or caches. Applications should use a configured canonical host, not the raw header. TLS and DNSSEC do not validate application-level Host handling.

Question 28Web application and data-protection foundations

Which response header is a standard clickjacking control that stops the page from being framed by other origins?

  1. X-Frame-Options: DENY (or CSP frame-ancestors 'none') Correct answer.
  2. X-Powered-By: PHP
  3. Server: Apache
  4. Expires: 0

Explanation

X-Frame-Options DENY/SAMEORIGIN and CSP frame-ancestors restrict framing, which is the usual clickjacking control. Server and X-Powered-By disclose technology; Expires controls caching. Testers should recommend frame-ancestors as the modern complement to X-Frame-Options.

Question 29Web application and data-protection foundations

A tester finds /robots.txt listing /backup/ and /admin/. What is the correct interpretation?

  1. robots.txt is an access-control mechanism that blocks all testers and attackers
  2. robots.txt is a crawler hint and a recon source; it does not enforce authorization Correct answer.
  3. Anything listed in robots.txt is illegal to request even with a signed RoE
  4. Search engines encrypt those paths so they cannot be retrieved

Explanation

robots.txt tells well-behaved crawlers what not to index. It is useful reconnaissance and is not authentication. In-scope testers may request listed paths under the RoE; defenders should protect those paths with real access control, not robots.txt alone.

Question 30Web application and data-protection foundations

A public web directory contains app.bak and web.config.copy. What is the most appropriate finding?

  1. Sensitive backup/config exposure; remove the files and block archive extensions at the server Correct answer.
  2. Proof that backups are always safer than databases
  3. A required PCI DSS control
  4. Evidence that parameterized queries are in use

Explanation

Backup and copy files often contain credentials, source, or connection strings. They should not be in the document root, and servers should not serve common backup extensions. This finding is independent of SQL parameterization.

Question 31Web application and data-protection foundations

A JSON Web Token is accepted when the header declares that no signature algorithm is used, and the server does not verify a signature. What should the report recommend?

  1. Always verify a cryptographic signature with an explicit allowed algorithm list; reject unsigned tokens Correct answer.
  2. Store JWTs in localStorage without other controls
  3. Disable HTTPS so signatures are unnecessary
  4. Print the token in error pages for support staff

Explanation

Accepting unsigned tokens (historically associated with a none algorithm) lets anyone forge identity claims. Servers must whitelist algorithms such as RS256 or ES256, verify signatures with the correct key, and never honor unsigned tokens. Storage and transport issues are separate findings.

Question 32Web application and data-protection foundations

A JSON profile-update endpoint copies every field from the request body onto the user object, including isAdmin. What issue is this?

  1. Mass assignment / over-posting of privileged fields Correct answer.
  2. SSRF via JSON
  3. DNS cache poisoning
  4. Missing HSTS only

Explanation

Mass assignment occurs when the application binds untrusted fields onto sensitive model properties. Bind only an allowlist of editable fields and enforce authorization on role changes. SSRF, DNS poisoning, and HSTS are different controls.

Question 33Web application and data-protection foundations

A money-transfer function is reachable with an HTTP GET that includes amount and destination as query parameters and uses the session cookie. Why is this a problem?

  1. GET is not safe/idempotent here; the action is easier to trigger via CSRF and is logged in proxies Correct answer.
  2. GET is the only method banks are allowed to use
  3. Query parameters cannot be sent over HTTPS
  4. Cookies never attach to GET requests

Explanation

HTTP GET is defined as safe and is stored in history, logs, and Referer. State-changing operations belong on POST/PUT/PATCH/DELETE with CSRF defenses. Cookies do attach to GET, which is why GET transfers are CSRF-friendly.

Question 34Web application and data-protection foundations

An authentication API allows unlimited password guesses at high speed with no lockout, CAPTCHA, or throttling. What should testers recommend?

  1. Rate limiting, progressive delays or lockout, monitoring, and multi-factor authentication Correct answer.
  2. Removing passwords entirely and printing them in access logs
  3. Disabling TLS to speed guesses
  4. Returning the valid password hash in the 401 body to help users

Explanation

Unbounded login attempts enable credential stuffing and online guessing. Controls include rate limits, account lockout or CAPTCHA after failures, anomaly detection, and MFA. Returning hashes or disabling TLS would make abuse easier.

Question 35Web application and data-protection foundations

Two concurrent requests each redeem the same one-time coupon because the application checks remaining uses and then writes the new count without a transaction. Which issue is this?

  1. Stored XSS
  2. A time-of-check to time-of-use (TOCTOU) race condition Correct answer.
  3. Open redirect
  4. Missing robots.txt

Explanation

A TOCTOU race occurs when a check and a later update are not atomic, so two requests both pass the check. Fix with transactions, row locks, or atomic decrements. XSS, redirects, and robots.txt are unrelated.

Question 36Web application and data-protection foundations

A Java application deserializes blobs supplied by users with a powerful native deserializer. What is the safest design change?

  1. Do not deserialize untrusted data; use an explicit, constrained data format (for example JSON with a schema) Correct answer.
  2. Keep native deserialization but expose it on more endpoints
  3. Trust any blob if it is Base64-encoded
  4. Disable authentication on the deserialize endpoint to simplify testing

Explanation

Insecure deserialization can instantiate unexpected types and run dangerous object graphs. The robust fix is to avoid native deserialization of untrusted bytes and to parse a simple documented format with a schema. Encoding or widening exposure does not constrain types.

Question 37Web application and data-protection foundations

Which password-storage approach is appropriate for a web application in 2026?

  1. A modern password hashing function such as Argon2id or bcrypt with a unique salt per user Correct answer.
  2. Unsalted MD5 of the password
  3. Plaintext in the users table for support convenience
  4. A single global SHA-1 hash shared by all accounts

Explanation

Passwords must be stored with a slow, salted, memory-hard or bcrypt-class algorithm. Unsalted MD5, plaintext, and shared SHA-1 are broken or inadequate for password storage. Testers should report these as high-impact findings when observed in authorized reviews.

Question 38Web application and data-protection foundations

Besides output encoding, which HTTP response policy reduces XSS impact by limiting script sources?

  1. A strict Content-Security-Policy that disallows unsafe-inline and unknown script sources Correct answer.
  2. X-Powered-By listing every framework
  3. Access-Control-Allow-Origin: * with credentials
  4. Enabling HTTP TRACE

Explanation

CSP is a defense-in-depth policy that tells the browser which scripts, frames, and connections are allowed. It does not replace encoding. Technology headers, permissive CORS with credentials, and TRACE work against that goal.

Question 39Web application and data-protection foundations

Which statement correctly contrasts the same-origin policy with CORS?

  1. Same-origin policy is the default isolation; CORS is an explicit server opt-in that relaxes it for listed origins Correct answer.
  2. CORS replaces TLS
  3. Same-origin policy only applies to FTP
  4. CORS forces all cookies to be HttpOnly

Explanation

Browsers isolate origins (scheme, host, port). CORS headers are the server's way to allow specific cross-origin reads. CORS does not replace TLS, is not an FTP-only rule, and does not set HttpOnly. Testers should treat overly broad CORS as a finding.

Question 40Web application and data-protection foundations

A file-upload filter allows a file solely because the client sent Content-Type: image/jpeg. Why is that insufficient?

  1. Content-Type is assigned by IANA to each file on disk automatically
  2. Clients control Content-Type; testers should require server-side type checks, extension allowlists, and non-executable storage Correct answer.
  3. Browsers ignore Content-Type on uploads so it is always safe
  4. JPEG is immune to all web vulnerabilities

Explanation

Content-Type on an upload is attacker-controlled. Servers must inspect content, allowlist extensions, rename files, and store them where they cannot execute. No MIME label makes a file inherently safe.

Question 41Assessment authorization, evidence, reporting and closeout

Before any live probe of a client's production system, what must a CISAW-LPT practitioner have?

  1. A verbal suggestion from a friend who works at the company
  2. Written authorization and an agreed scope/rules of engagement Correct answer.
  3. A public CVE for any product the client might use
  4. Anonymous access to a search engine

Explanation

The professional workflow in this scenario requires documented authorization, asset scope and rules of engagement before live probing. A random employee’s suggestion, a public vulnerability or a search engine is not a substitute for that authority. Actual legal consequences depend on the relevant facts and applicable law.

Question 42Assessment authorization, evidence, reporting and closeout

Under the PRC Cybersecurity Law, which activity is prohibited without lawful authorization?

  1. Applying for a CISAW certificate through CCRC
  2. Reading a public CCRC exam notice
  3. Illegally intruding into another party's network, disrupting its functions, or stealing network data Correct answer.
  4. Patching your own company's in-scope servers after a ticket

Explanation

The PRC Cybersecurity Law forbids illegal intrusion into others' networks, interference with normal functions, theft of network data, providing specialized intrusion tools, and assisting such activity. Authorized CISAW testing, applying for a credential, and administering your own systems are not that prohibition.

Question 43Assessment authorization, evidence, reporting and closeout

During an engagement, a scan discovers a live host that is not on the in-scope list. What is the correct action?

  1. Immediately exploit it so the client sees extra value
  2. Stop testing that host, document it, and obtain written scope change before any further probing Correct answer.
  3. Sell the finding on a public forum
  4. Use the host as a pivot to the internet backbone

Explanation

Out-of-scope assets must not be attacked. The professional response is to halt, record the observation, and request a written scope amendment. Extra exploitation, public leaking, or pivoting onto third-party infrastructure violates RoE and Chinese law.

Question 44Assessment authorization, evidence, reporting and closeout

A client's web app runs on a third-party cloud tenant. The RoE lists only the client's URL. Testers identify that a finding would require probing the cloud provider's shared management plane. What should they do?

  1. Treat the provider's shared infrastructure as automatically in scope
  2. Pause, confirm written authorization covering that cloud scope, and involve the client/provider as required Correct answer.
  3. Scan every IP in the provider's public ASN
  4. Ignore cloud entirely even if the client later adds the tenant to scope in writing

Explanation

Shared cloud control planes and neighboring tenants are typically out of scope unless the provider and client explicitly authorize them. Scanning a whole ASN is reckless and likely illegal. After a written scope change, authorized tenant testing may proceed.

Question 45Assessment authorization, evidence, reporting and closeout

After delivering the report, a tester wants to post screenshots of the client's unpatched production admin panel on a public social network. What is the correct action?

  1. Post immediately to build a personal brand
  2. Do not publish; client evidence remains confidential unless the client authorizes disclosure Correct answer.
  3. Post only the passwords in the screenshots
  4. Sell the screenshots to a third-party broker

Explanation

Engagement data is confidential. Public posting or sale of client screenshots, credentials, or vulns violates NDAs, ethics, and often the Cybersecurity Law and data-protection rules. Disclosure, if any, follows the client's authorized process.

Question 46Assessment authorization, evidence, reporting and closeout

A test dump accidentally contains customer national ID numbers. How should the tester handle that data under Chinese personal-information rules?

  1. Email the full dump to a personal mailbox for later study
  2. Publish a sample of IDs to prove impact
  3. Minimize collection, protect it, report the exposure to the client, and delete copies not needed as evidence Correct answer.
  4. Ignore it because testers are exempt from PIPL-style duties

Explanation

Personal information discovered during a test is still personal information. Testers should collect the minimum needed, safeguard it, notify the client, and purge extras. Testers are not exempt from the Personal Information Protection Law's protection duties.

Question 47Assessment authorization, evidence, reporting and closeout

The client asks whether testers may run a production-wide packet-flood availability test on Friday peak hours. The RoE is silent. What is correct?

  1. Proceed because availability tests are always implied
  2. Refuse until the RoE explicitly authorizes the method, window, and rollback plan Correct answer.
  3. Run it first and apologize if the site fails
  4. Target a random other company so the client is not affected

Explanation

Denial-of-service style tests can harm production and third parties. They require explicit written permission, a maintenance window, monitoring, and abort criteria. Implied consent or testing someone else is unethical and illegal.

Question 48Assessment authorization, evidence, reporting and closeout

A researcher finds a vulnerability in a product they do not own. Which disclosure approach matches professional CISAW ethics?

  1. Immediate full public exploit release with no vendor notice
  2. Selling the issue only to criminal groups
  3. Coordinated/responsible disclosure to the vendor or an authorized national vulnerability process, without public exploit dumping Correct answer.
  4. Quietly using it against random internet users

Explanation

Responsible disclosure notifies the vendor or an authorized channel (in China, processes such as CNNVD/CNVD where applicable) and avoids reckless public weaponization. Criminal sale or unauthorized use is illegal.

Question 49Assessment authorization, evidence, reporting and closeout

A colleague asks you to send a specialized intrusion toolkit to a stranger who admitted they will use it to break into a hospital they do not work for. What does the PRC Cybersecurity Law require?

  1. Send the toolkit if they promise to share screenshots
  2. Post the toolkit on a public drive and claim ignorance
  3. Refuse; providing specialized intrusion tools or assistance for illegal intrusion is prohibited Correct answer.
  4. Only send it after midnight so the law does not apply

Explanation

The Cybersecurity Law prohibits providing programs or tools specialized for illegal intrusion, disruption, or data theft, and prohibits assisting such activity. Time of day and willful ignorance are not defenses. CISAW holders must refuse.

Question 50Assessment authorization, evidence, reporting and closeout

Which items belong in rules of engagement for a single CISAW-LPT assessment?

  1. Only the tester's résumé
  2. In-scope targets, testing window, allowed/forbidden techniques, emergency contacts, and data-handling rules Correct answer.
  3. A list of unrelated third-party banks to scan for practice
  4. The client's competitors' production IPs

Explanation

RoE is the operational contract for one test: what may be touched, when, how, who to call, and how evidence is stored. Résumés and third-party or competitor systems are out of scope and, if scanned, may be unlawful.