I85PREP
⌘ K
LPF LPQ study materials
LPF LPQ study resources

LPF LPQ practice questions

One question at a time. Build your LPF LPQ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Fundamentals and Governance

Under a typical information security management system based on ISO/IEC 27001, which document formally states management's commitment to information security and defines the overall direction and objectives of the ISMS?

  1. The statement of applicability
  2. The risk treatment plan
  3. The information security policy Correct answer.
  4. The asset register

Explanation

The information security policy is the top-level management statement that sets direction, objectives, and commitment to information security across the organisation. The statement of applicability and risk treatment plan are derived documents that implement the policy rather than establish its direction.

Question 2Information Security Fundamentals and Governance

An organisation wants a formal certification of its information security management system against an international standard. Which standard defines the certifiable requirements for an ISMS?

  1. ISO/IEC 27005
  2. ISO/IEC 27001 Correct answer.
  3. ISO/IEC 27002
  4. ISO/IEC 27701

Explanation

ISO/IEC 27001 contains the auditable requirements an ISMS must satisfy and is the standard against which certification is granted. The other standards provide guidance, privacy extension, or risk management methodology but are not the certifiable ISMS requirements.

Question 3Information Security Fundamentals and Governance

In the CIA triad, which property is directly compromised when an unauthorised party alters a financial transaction record without detection?

  1. Non-repudiation
  2. Integrity Correct answer.
  3. Availability
  4. Confidentiality

Explanation

Integrity concerns the accuracy and completeness of information and is breached when data is modified without authorisation. Confidentiality relates to disclosure, availability to timely access, and non-repudiation to proving an action occurred.

Question 4Information Security Fundamentals and Governance

Which role is ultimately accountable for the information security management system and ensures it aligns with the organisation's strategic direction?

  1. The information security manager
  2. Top management Correct answer.
  3. The IT operations team lead
  4. The internal audit function

Explanation

ISO/IEC 27001 places accountability for the ISMS with top management, which must demonstrate leadership and ensure the ISMS integrates with business processes. Operational and audit roles support the ISMS but do not hold ultimate accountability.

Question 5Information Security Fundamentals and Governance

A company classifies data so that only staff with a documented business need may access certain records. Which security principle does this primarily implement?

  1. Separation of duties
  2. Defence in depth
  3. Fail-safe defaults
  4. Least privilege Correct answer.

Explanation

Least privilege grants users only the access necessary to perform their duties, matching the documented business-need restriction. Defence in depth uses layered controls, separation of duties splits conflicting tasks, and fail-safe defaults concern the default state of controls.

Question 6Information Security Fundamentals and Governance

Which type of control is a security awareness training programme for all employees?

  1. Preventive Correct answer.
  2. Detective
  3. Compensating
  4. Corrective

Explanation

Awareness training aims to stop incidents from occurring by improving behaviour and is therefore preventive. Detective controls identify events after they occur, corrective controls restore systems, and compensating controls substitute for a primary control.

Question 7Information Security Fundamentals and Governance

During a risk assessment, a team estimates that a ransomware event would cost approximately 2 million in recovery and downtime. Which risk component does this figure represent?

  1. Risk impact Correct answer.
  2. Risk appetite
  3. Risk owner
  4. Risk likelihood

Explanation

Impact quantifies the potential consequence or loss if a risk event occurs, which is what the recovery and downtime figure describes. Likelihood expresses probability, appetite expresses tolerance, and owner is the accountable person.

Question 8Information Security Fundamentals and Governance

An organisation decides to purchase cyber insurance to transfer part of its financial exposure. Which risk treatment option does this represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk mitigation

Explanation

Transferring risk shifts the financial consequence to a third party, which insurance accomplishes. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 9Information Security Fundamentals and Governance

A risk assessment team calculates risk as likelihood multiplied by impact. Which statement best describes the purpose of this calculation?

  1. It replaces the need for management judgement.
  2. It produces a definitive monetary value for each risk.
  3. It allows risks to be ranked and prioritised for treatment. Correct answer.
  4. It guarantees that residual risk falls below appetite.

Explanation

Multiplying likelihood by impact yields a relative score that enables comparison and prioritisation of risks. It does not produce precise monetary values, guarantee outcomes, or remove the need for judgement.

Question 10Information Security Fundamentals and Governance

Which statement best distinguishes a vulnerability from a threat?

  1. A vulnerability is a weakness that can be exploited, while a threat is a potential cause of harm. Correct answer.
  2. A vulnerability and a threat are both measures of the likelihood of an incident.
  3. A vulnerability is always technical, while a threat is always human.
  4. A vulnerability is a potential cause of harm, while a threat is a weakness that can be exploited.

Explanation

A vulnerability is a weakness in an asset or control that a threat could exploit, whereas a threat is any potential cause of an unwanted incident. They are distinct concepts, and neither is inherently technical or human.

Question 11Information Security Fundamentals and Governance

An employee receives an email that appears to come from the finance director requesting an urgent bank transfer. Which attack type does this best illustrate?

  1. SQL injection
  2. Business email compromise Correct answer.
  3. Denial of service
  4. Privilege escalation

Explanation

Business email compromise impersonates a trusted executive to trick staff into transferring funds or disclosing data. Denial of service disrupts availability, SQL injection attacks databases, and privilege escalation gains higher access rights.

Question 12Information Security Fundamentals and Governance

Which access control model assigns permissions based on the user's job function within the organisation?

  1. Rule-based access control
  2. Mandatory access control
  3. Role-based access control Correct answer.
  4. Discretionary access control

Explanation

Role-based access control grants permissions to roles reflecting job functions, and users inherit permissions through role assignment. Discretionary control lets owners set access, mandatory control uses labels and clearances, and rule-based control applies conditions.

Question 13Information Security Fundamentals and Governance

An organisation maintains an up-to-date inventory of its information assets with assigned owners. What is the primary governance benefit of this practice?

  1. It ensures every asset is encrypted at rest.
  2. It guarantees compliance with all legal requirements.
  3. It removes the need for access control reviews.
  4. It establishes accountability and supports risk assessment for each asset. Correct answer.

Explanation

An asset inventory with named owners creates clear accountability and provides the basis for identifying and assessing risks to each asset. It does not itself enforce encryption, replace access reviews, or guarantee legal compliance.

Question 14Information Security Fundamentals and Governance

Which principle requires that a user's identity be verified before access to a system is granted?

  1. Authorisation
  2. Accounting
  3. Authentication Correct answer.
  4. Federation

Explanation

Authentication verifies that a claimed identity is genuine, typically via passwords, tokens, or biometrics. Authorisation determines what an authenticated user may do, accounting records activity, and federation links identity across domains.

Question 15Information Security Fundamentals and Governance

A security team wants a control that detects unauthorised changes to critical system files. Which control best meets this requirement?

  1. Password complexity policy
  2. Network segmentation
  3. File integrity monitoring Correct answer.
  4. Full-disk encryption

Explanation

File integrity monitoring detects changes to critical files by comparing them against known-good baselines. Encryption protects confidentiality, segmentation limits lateral movement, and password policy strengthens authentication.

Question 16Information Security Fundamentals and Governance

An organisation must retain personal data only as long as necessary for its stated purpose. Which data protection principle does this reflect?

  1. Accuracy
  2. Lawful basis
  3. Storage limitation Correct answer.
  4. Data minimisation

Explanation

Storage limitation requires that personal data be kept no longer than needed for the purpose for which it was collected. Minimisation concerns collecting only necessary data, accuracy concerns correctness, and lawful basis concerns justification for processing.

Question 17Information Security Fundamentals and Governance

An organisation outsources payroll processing to a third party. Which governance action best addresses the associated information security risk?

  1. Transferring all internal access controls to the supplier.
  2. Removing the supplier from the asset inventory to simplify reporting.
  3. Performing due diligence and defining security requirements in the contract. Correct answer.
  4. Relying on the supplier's marketing claims about security.

Explanation

Supplier governance requires due diligence before engagement and contractual security requirements that define expectations and enable monitoring. Marketing claims are insufficient, the supplier remains a relevant asset, and accountability for internal controls cannot be delegated away.

Question 18Information Security Fundamentals and Governance

Following a security incident, a review finds that a known vulnerability was not patched because the patch process lacked clear ownership. Which governance weakness does this most directly indicate?

  1. Inadequate network bandwidth
  2. Insufficient defined roles and responsibilities Correct answer.
  3. Overuse of multi-factor authentication
  4. Excessive encryption of data at rest

Explanation

The failure stems from unclear accountability for the patching process, which is a governance weakness in defined roles and responsibilities. Bandwidth, encryption, and multi-factor authentication are unrelated to the missing patch ownership.

Question 19Information Security Fundamentals and Governance

A company applies an ISO/IEC 27001-based ISMS but chooses not to implement a listed control, recording a justification. Where should this decision be documented?

  1. In the risk treatment plan only
  2. In the statement of applicability Correct answer.
  3. In the acceptable use policy
  4. In the business continuity plan

Explanation

The statement of applicability records which controls are applied and justifies any exclusions, providing transparency for auditors and management. The risk treatment plan describes treatment actions but the exclusion justification belongs in the statement of applicability.

Question 20Information Security Fundamentals and Governance

A risk owner accepts a risk that exceeds the organisation's stated risk appetite. What is the most appropriate governance response?

  1. The acceptance should be escalated for approval at the level authorised to accept such risk. Correct answer.
  2. The risk owner's decision stands because they own the risk.
  3. The risk should be silently removed from the risk register.
  4. The risk appetite should be changed to match the risk.

Explanation

Acceptance of risk beyond the defined appetite requires escalation to management with authority to accept it, preserving accountability and oversight. Risk owners act within delegated limits, and altering the register or appetite to mask the issue undermines governance.

Question 21Reconnaissance and Information Gathering

During an authorized LPQ-style external assessment, which activity is part of passive reconnaissance rather than active reconnaissance?

  1. Sending crafted packets directly to the target's web server
  2. Enumerating SMB shares on a discovered host
  3. Querying the target's public DNS records from a third-party resolver Correct answer.
  4. Running a port scan against the target's public IP range

Explanation

Passive reconnaissance collects information from third parties without sending traffic to the target, such as public DNS data, WHOIS databases, or cached search results. Active reconnaissance involves direct interaction with target systems, which is detectable and requires explicit scope authorization.

Question 22Reconnaissance and Information Gathering

An assessor wants to identify which mail servers accept email for a domain without sending any traffic to the organization's own infrastructure. Which record type should be queried?

  1. MX Correct answer.
  2. A
  3. TXT
  4. CNAME

Explanation

MX records list the mail exchange hosts responsible for a domain, and they can be retrieved from public resolvers without contacting the target. This makes MX enumeration a standard passive step for mapping external mail infrastructure.

Question 23Reconnaissance and Information Gathering

A penetration tester runs a WHOIS lookup on a target domain and finds a registrant organization name and an administrative contact email. What is the most appropriate next step within a scoped LPQ engagement?

  1. Register a lookalike domain using the same registrant name
  2. Pivot the email address into breach-data and social-media searches for related accounts Correct answer.
  3. Email the administrative contact to request credentials
  4. Publish the contact details to a public paste site

Explanation

WHOIS output is a seed for further open-source intelligence, such as correlating the contact email with breach data, social profiles, and other registered domains. Contacting the target or registering lookalike domains exceeds reconnaissance and may violate scope or law.

Question 24Reconnaissance and Information Gathering

Which tool is designed primarily for passive subdomain discovery by querying public certificate transparency logs?

  1. Nikto
  2. Nmap
  3. crt.sh Correct answer.
  4. Hydra

Explanation

crt.sh indexes certificate transparency logs, letting an assessor enumerate subdomains that have had TLS certificates issued without touching the target. Nmap, Nikto, and Hydra are active scanning or attack tools.

Question 25Reconnaissance and Information Gathering

A tester uses theHarvester against a target domain. Which type of data does this tool primarily aggregate?

  1. Open ports and service banners
  2. Password hashes from internal domain controllers
  3. Raw packet captures from the local network
  4. Email addresses, hostnames, and employee names from public sources Correct answer.

Explanation

theHarvester collects OSINT such as email addresses, subdomains, hosts, and employee names from search engines and public data sources. It does not scan ports, dump hashes, or capture traffic.

Question 26Reconnaissance and Information Gathering

During DNS enumeration, an assessor queries the target's authoritative nameserver for a zone transfer and receives the full zone. What does this result indicate?

  1. The nameserver permits unauthenticated zone transfers, exposing all records Correct answer.
  2. The resolver is caching stale records
  3. The domain uses DNSSEC validation
  4. The nameserver correctly restricts AXFR to authorized secondaries

Explanation

A successful AXFR from an unauthorized client means the server allows zone transfers without access control, disclosing every record in the zone. Properly configured servers restrict AXFR to known secondary nameservers.

Question 27Reconnaissance and Information Gathering

An assessor wants to discover hosts and open ports on a target subnet while minimizing the chance of triggering simple IDS signatures. Which Nmap approach best fits this goal?

  1. A UDP scan of every port with maximum parallelism
  2. A TCP connect scan with default timing
  3. A SYN scan with fragmented packets and slower timing Correct answer.
  4. An XMAS scan against all ports at aggressive timing

Explanation

A half-open SYN scan with fragmentation and reduced timing is less likely to match simple signatures than a full connect scan or aggressive scans. Fragmentation and slower pacing complicate pattern detection, though no technique guarantees stealth.

Question 28Reconnaissance and Information Gathering

A tester identifies the web server as nginx 1.18.0 from a banner. What is the most reliable conclusion to draw from this banner alone?

  1. The server software and version are likely as reported, but the banner may be spoofed or patched Correct answer.
  2. The operating system is definitely Ubuntu
  3. The application uses PHP
  4. The server is vulnerable to a specific CVE

Explanation

Banners indicate the software and version the server advertises, but they can be altered, and a version string does not prove patch level or vulnerability. Confirmation requires further testing within scope.

Question 29Reconnaissance and Information Gathering

Which technique best supports discovering an organization's internet-facing attack surface by correlating IP ranges with the organization's registered ASN?

  1. SMTP banner grabbing on port 25
  2. Reverse DNS lookups on random IPs
  3. BGP and ASN lookups to map announced prefixes Correct answer.
  4. WHOIS queries on unrelated domains

Explanation

Mapping the organization's ASN to its announced BGP prefixes reveals the IP ranges it controls, which is a core step in external attack-surface discovery. Reverse DNS and unrelated WHOIS data are less reliable for this purpose.

Question 30Reconnaissance and Information Gathering

An assessor uses Google dorks such as site:example.com filetype:pdf to find documents. Which reconnaissance category does this represent?

  1. Vulnerability exploitation
  2. Passive search-engine reconnaissance Correct answer.
  3. Password spraying
  4. Active service enumeration

Explanation

Search-engine dorking uses indexed public content and does not directly interact with the target, making it passive reconnaissance. It can reveal documents, exposed directories, and metadata unintentionally published.

Question 31Reconnaissance and Information Gathering

A tester finds a publicly indexed PDF on the target's site. Which metadata field is most useful for identifying internal usernames and software versions?

  1. Author and Producer fields Correct answer.
  2. The PDF's page count
  3. The PDF's file size
  4. The PDF's creation date

Explanation

PDF metadata commonly includes Author, Creator, and Producer fields that can reveal usernames, authoring applications, and version information. This supports username harvesting and software fingerprinting.

Question 32Reconnaissance and Information Gathering

Which statement accurately describes the purpose of Shodan in reconnaissance?

  1. It indexes banners from internet-connected devices collected by its own crawlers Correct answer.
  2. It replaces DNS resolution for all queries
  3. It scans only hosts you explicitly authorize
  4. It performs authenticated vulnerability scans of internal networks

Explanation

Shodan continuously crawls the internet and indexes service banners, letting assessors search for exposed devices and services passively. It does not scan on your behalf or replace DNS.

Question 33Reconnaissance and Information Gathering

An assessor wants to enumerate valid usernames on a target's web login without triggering account lockout. Which approach is most appropriate during reconnaissance?

  1. Observing response timing and error-message differences for candidate usernames Correct answer.
  2. Using default credentials on all accounts
  3. Brute-forcing passwords for each username
  4. Sending thousands of login attempts per second

Explanation

Username enumeration relies on subtle differences in response timing, status codes, or error messages for valid versus invalid accounts. This avoids lockout and remains reconnaissance rather than authentication attack.

Question 34Reconnaissance and Information Gathering

A tester observes that a target's web application returns a 302 redirect to /login for unauthenticated users but a 200 response for a specific path. What does this behavior most likely suggest?

  1. The path is publicly accessible and may expose functionality Correct answer.
  2. The server is down
  3. The application uses only static content
  4. The path is protected by client-side JavaScript

Explanation

A 200 response where other paths redirect to login indicates the resource may be accessible without authentication. This is a common signal during forced browsing and content discovery.

Question 35Reconnaissance and Information Gathering

Which reconnaissance activity is most likely to reveal the technology stack behind a web application without sending exploit payloads?

  1. Running a full SQL injection scan
  2. Performing a password spray
  3. Reviewing HTTP response headers and cookies Correct answer.
  4. Attempting remote code execution

Explanation

Response headers such as Server, X-Powered-By, and cookie names often disclose frameworks, languages, and server software. This fingerprinting is passive in effect and avoids exploit traffic.

Question 36Reconnaissance and Information Gathering

An assessor uses a DNS brute-force tool with a wordlist to find subdomains that are not linked anywhere on the site. What is the main limitation of this approach?

  1. It cannot resolve any names
  2. It only works on internal networks
  3. It requires direct access to the authoritative server
  4. It only finds subdomains present in the wordlist or wildcard-resolvable names Correct answer.

Explanation

DNS brute-forcing depends on the quality and coverage of the wordlist, so names not in the list may be missed. Wildcard DNS can also produce false positives that must be filtered.

Question 37Reconnaissance and Information Gathering

During an assessment, an analyst finds an email address pattern [email protected] and wants to predict other employee addresses. Which factor most affects the reliability of this prediction?

  1. The organization's consistent naming convention across published addresses Correct answer.
  2. The number of open ports on the mail server
  3. The target's TLS certificate issuer
  4. The mail server's SMTP banner

Explanation

Predicting email addresses depends on whether the organization applies a consistent naming convention, which can be validated against known published addresses. Certificate issuer, port counts, and banners do not determine address format.

Question 38Reconnaissance and Information Gathering

An assessor wants to determine whether a target uses a specific content management system by examining publicly accessible files. Which artifact is the strongest indicator?

  1. A generator meta tag or versioned asset path unique to the CMS Correct answer.
  2. An HTTP 404 page
  3. A robots.txt entry for /admin
  4. A favicon of default size

Explanation

Generator meta tags and versioned asset paths are produced by the CMS itself and strongly indicate its identity and version. robots.txt entries and error pages are weaker, indirect signals.

Question 39Reconnaissance and Information Gathering

Which practice best protects the integrity of reconnaissance findings when collecting OSINT from multiple sources?

  1. Deleting raw output after summarizing
  2. Relying on a single search engine
  3. Recording source URLs and timestamps for each data point Correct answer.
  4. Sharing credentials used during collection

Explanation

Provenance-source URL and collection time-lets findings be verified and correlated later. Retaining raw output and corroborating across sources improves reliability and supports reporting.

Question 40Reconnaissance and Information Gathering

An assessor discovers an internal hostname in a public job posting. Which action is most consistent with responsible reconnaissance?

  1. Publishing the hostname to a forum for confirmation
  2. Attempting to connect to the hostname immediately
  3. Correlating the hostname with public DNS and certificate data before any interaction Correct answer.
  4. Using it to guess internal passwords

Explanation

Publicly leaked hostnames should be validated through passive sources such as DNS and certificate transparency before any direct interaction. This keeps activity within scope and avoids unnecessary contact with target systems.

Question 41Network and Infrastructure Penetration Testing

During an internal network penetration test you run Nmap with the -sn flag against a /24 range. What is the primary outcome of this scan?

  1. It detects the operating system of each responding host.
  2. It performs a TCP connect scan on the most common ports of every host.
  3. It identifies live hosts without performing port scanning on them. Correct answer.
  4. It enumerates SMB shares on domain-joined machines.

Explanation

The -sn option (formerly -sP) is a ping sweep that only determines which hosts are up, using ICMP echo, TCP SYN to 443, TCP ACK to 80, and ARP on local segments. It deliberately skips port scanning, so no service or OS detail is produced.

Question 42Network and Infrastructure Penetration Testing

An Nmap scan reports a port as 'open|filtered'. Which statement best explains this result?

  1. No response was received, so the port could be open or protected by a filtering device. Correct answer.
  2. The host replied with an ICMP port-unreachable message for a UDP probe.
  3. The port is open but the service banner could not be retrieved.
  4. The target returned a TCP RST, confirming the port is closed but the host is alive.

Explanation

Nmap uses 'open|filtered' when it cannot distinguish between an open port and one dropped by a firewall, because neither state generates a reply. This is common with UDP scans, where absence of an ICMP unreachable leaves the state ambiguous.

Question 43Network and Infrastructure Penetration Testing

You need to enumerate SMB shares on a Windows host using only null or guest credentials during an internal assessment. Which command accomplishes this?

  1. smbclient -L //10.10.10.5 -N Correct answer.
  2. dig axfr @10.10.10.5 corp.local
  3. nmap -sU -p 161 10.10.10.5
  4. ssh -L 445:10.10.10.5:445 [email protected]

Explanation

smbclient -L lists shares on a target, and the -N flag suppresses the password prompt to attempt a null session. This is a standard technique for checking whether anonymous SMB enumeration is permitted.

Question 44Network and Infrastructure Penetration Testing

A DNS server responds to a zone transfer request for the internal domain. Which tool and option combination is designed to request that transfer?

  1. whois -h 10.0.0.53 corp.local
  2. dig axfr corp.local @10.0.0.53 Correct answer.
  3. nslookup -type=MX
  4. traceroute -T -p 53 10.0.0.53

Explanation

The axfr query type instructs dig to request a full zone transfer from the specified name server. A misconfigured server will return the entire zone, exposing hostnames and IP addresses.

Question 45Network and Infrastructure Penetration Testing

Which Nmap scan type relies on the target's IP stack responding with a RST to a bare ACK packet, allowing firewall rule mapping rather than port-state discovery?

  1. TCP ACK scan (-sA) Correct answer.
  2. TCP SYN scan (-sS)
  3. UDP scan (-sU)
  4. Xmas scan (-sX)

Explanation

The TCP ACK scan sends ACK packets without a preceding handshake; reachable ports return RST while filtered ports return nothing. This lets the tester map firewall rulesets instead of determining whether ports are open.

Question 46Network and Infrastructure Penetration Testing

You capture traffic on a switched LAN and need to observe unicast frames destined for a colleague's workstation. Which attack technique directly causes the switch to forward those frames to your interface?

  1. DHCP starvation
  2. MAC flooding of the CAM table Correct answer.
  3. ARP cache poisoning
  4. VLAN hopping via double tagging

Explanation

Flooding the switch's content-addressable memory with bogus source MACs exhausts the CAM table, forcing the switch to fail open and broadcast unknown unicast frames to all ports. This lets the attacker capture traffic not intended for their interface.

Question 47Network and Infrastructure Penetration Testing

During an internal test you use Responder to capture NetBIOS Name Service and LLMNR traffic. What is the primary purpose of this technique?

  1. To decrypt Kerberos service tickets using a keytab file.
  2. To perform a DNS zone transfer against the domain controller.
  3. To enumerate Active Directory objects through LDAP queries.
  4. To obtain NTLMv2 challenge/response hashes for offline cracking. Correct answer.

Explanation

Responder answers broadcast name-resolution requests (LLMNR, NBT-NS, mDNS) and lures clients into authenticating to it, capturing NTLMv2 hashes. Those hashes can then be cracked offline or relayed to other services.

Question 48Network and Infrastructure Penetration Testing

Which Metasploit payload type establishes a callback from the compromised host to the attacker's listener?

  1. A reverse payload Correct answer.
  2. A bind payload
  3. A single payload
  4. A staged payload

Explanation

A reverse payload makes the target connect back to a handler the attacker controls, which is useful when inbound connections to the target are blocked by a firewall or NAT. Bind payloads instead open a listener on the target.

Question 49Network and Infrastructure Penetration Testing

You identify a Windows service whose binary path contains an unquoted space, such as C:\Program Files\Acme Agent\agent.exe. Which privilege escalation technique does this configuration enable?

  1. Token impersonation via SeImpersonatePrivilege
  2. Kerberoasting of a service account with an SPN
  3. Unquoted service path exploitation by planting a binary earlier in the path Correct answer.
  4. DLL search order hijacking in a writable system directory

Explanation

When the path is unquoted, Windows tries to execute intermediate paths such as C:\Program.exe before reaching the intended binary. If an attacker can write to one of those locations, they can place a malicious executable that runs with the service's privileges.

Question 50Network and Infrastructure Penetration Testing

A Linux host is being assessed. You find a file owned by root with the SUID bit set that executes a shell command without dropping privileges. What does this misconfiguration allow?

  1. The kernel automatically patches the binary's vulnerabilities.
  2. The file becomes readable by all users regardless of permissions.
  3. Any local user can execute the command with root privileges. Correct answer.
  4. Remote unauthenticated users can log in as root over SSH.

Explanation

The SUID bit causes a program to run with the privileges of its owner, so a root-owned SUID binary executes as root. If it invokes commands without sanitizing input or dropping privileges, a local user can leverage it to escalate to root.