LPF LPQ case studies
LPF LPQ · Put your knowledge to work in context.
The LPF LPQ (Licensed Penetration Tester Qualification, often shortened to LPQ) is a vendor-neutral, multiple-choice credential aimed at practitioners who want evidence that they understand penetration testing as a disciplined, documented process rather than a collection of exploits. It suits junior-to-mid-level testers, SOC and blue-team staff moving toward offensive work, and security generalists who must scope, review, or commission penetration tests. The LPF LPQ case studies are 5 cases and about 4,789 words.
1The /22 That Wasn't in the Statement of Work
Northbridge Mutual, a mid-size insurer, has contracted you for a five-day external penetration test. The statement of work lists three hostnames and two /28 blocks (198.51.100.16/28 and 203.0.113.32/28) and states: 'No testing of assets outside the defined scope.
918 words, about 5 min2Proving Blind SQL Injection Without Emptying the Database
Vantage Retail runs a PCI-DSS-scoped e-commerce platform behind a CDN and a WAF. You have written authorisation for a grey-box test of the checkout flow with two hard constraints: no more than 300 requests per minute to any endpoint, and no retrieval of real customer data, with proof of access limited to one row and one column per finding.
932 words, about 5 min3Certificate Validation, Shared PSKs and a Travel Router in the Loading Bay
Halden Logistics runs a 24/7 distribution centre across three floors. Corporate Wi-Fi uses WPA2-Enterprise with PEAP-MSCHAPv2 and a private CA; the guest SSID uses WPA2-PSK; and 40 handheld scanners use a third SSID whose PSK has not changed since 2019.
1,009 words, about 5 min4Domain Admin in Four Hours and a Verbal Instruction to Keep Going
It is day one of a three-day internal Active Directory assessment for a 1,400-user healthcare provider. At 10:40 you Kerberoast a service account, svc backup, whose password was set at build and never changed, and by 14:15 you hold Domain Admin.
944 words, about 5 min5When the Vendor Says False Positive and the Client Says Downgrade
Six weeks after delivering a 34-finding report to Corvus Financial, the customer-portal vendor emails: 'The IDOR is a false positive - all object identifiers are GUIDv4 and cannot be guessed.' You had demonstrated it two ways: as user A you fetched user B's monthly statement by taking B's GUID from a support-ticket attachment URL, and once by receiving a GUID in an unauthenticated API response that enumerated recent tickets. Separately, the IT manager argues that the unauthenticated deserialisation RCE should drop from Critical to Medium because the endpoint is only reachable over the corporate VPN and 'an attacker would need a VPN account'.
986 words, about 5 min