LPF LPQ study plan
LPF LPQ · Give each week a clear focus.
8 weeks · About 7 hours per week
Information Security Fundamentals and Governance & Penetration Testing Methodology and Tooling
Map each of the ten exam domains to its official weight and list the three sub-topics you understand least.
Explain the CIA triad, risk = likelihood × impact, defence in depth, and least privilege by writing a one-page summary with a concrete pentest example for each.
Describe the phases of a penetration test (scoping, reconnaissance, exploitation, post-exploitation, reporting) and the written authorisation artefacts required before testing.
Compare at least four tool categories (scanners, proxies, exploitation frameworks, password crackers) and note one strength and one limitation of each.
Set up an isolated lab (two VMs: one attacker, one target) and verify network isolation from your host.
Your checkpoint
A domain-weight tracker spreadsheet plus a one-page methodology diagram showing phases, authorisation gates, and tool categories.
Network and Infrastructure Penetration Testing
Execute host discovery and port scanning against the lab target with at least two different tools and compare the results.
Identify running services and versions on the target and match each to at least one known vulnerability class.
Perform OSINT and DNS enumeration on a deliberately exposed practice domain and record findings in a structured table.
Explain how TCP handshake, UDP, ICMP, and common firewall behaviours affect scan accuracy and timing.
Document the difference between a false positive and a false negative in service detection using a lab example.
Your checkpoint
A reconnaissance and scanning report for the lab target containing open ports, service versions, and three prioritised findings with evidence.
Network and Infrastructure Penetration Testing & Exploitation and Post-Exploitation
Exploit at least two lab vulnerabilities (e.g., a misconfigured service and a known CVE) and capture proof of access.
Explain the difference between initial access, privilege escalation, and lateral movement using your lab actions as examples.
Demonstrate password attack techniques (online guessing, offline cracking of a captured hash) and describe the defensive controls that stop each.
Perform basic Linux and Windows privilege escalation enumeration and list three misconfigurations that enable escalation.
Describe how to maintain access ethically in a lab, including why persistence must be explicitly authorised and cleaned up.
Your checkpoint
A lab exploitation log with screenshots or command transcripts for two exploits, one privilege escalation, and a cleanup checklist.
Web Application Security Testing
Map the OWASP Top 10 categories to concrete test cases you can run against a deliberately vulnerable web application.
Test for injection (SQLi and command injection) and cross-site scripting in the lab, capturing requests and responses.
Explain authentication and session management weaknesses (weak passwords, session fixation, missing cookie flags) and demonstrate at least one.
Test for broken access control (IDOR, forced browsing) and document the impact in business terms.
Describe how to test file upload, SSRF, and insecure deserialization safely and what evidence to retain.
Your checkpoint
A web application test report for the lab app covering at least five vulnerability classes with request/response evidence and remediation advice.
Reconnaissance and Information Gathering & Wireless and Mobile Security Testing
Perform passive and active information gathering on a target organisation using only public sources and document the legal boundaries.
Explain wireless security concepts (WPA2/WPA3, PSK vs enterprise, evil twin, deauthentication) and the risks each addresses.
Describe mobile application testing basics: static vs dynamic analysis, insecure data storage, and certificate pinning.
Identify at least three physical security weaknesses from a walkthrough scenario and link each to a social engineering vector.
Explain how reconnaissance findings feed into scoping and why out-of-scope data must be discarded.
Your checkpoint
A reconnaissance and wireless/mobile risk summary that lists five findings, their evidence source, and whether each is in scope.
Exploitation and Post-Exploitation & Social Engineering and Physical Security
Demonstrate post-exploitation data collection in the lab (system information, credentials, network shares) while staying within authorised scope.
Explain pivoting and tunnelling concepts and describe one lab scenario where pivoting would be required.
Design a phishing simulation for an authorised internal test, including pretext, target selection, and success metrics.
Describe at least three physical security controls and how a tester would evaluate them without causing harm.
Explain the ethical and legal limits of social engineering, including consent, deception boundaries, and data handling.
Your checkpoint
A social engineering test plan and a post-exploitation findings sheet with three findings, impact ratings, and containment notes.
Reporting, Remediation and Communication & Legal, Ethical and Compliance Considerations
Write a finding in a standard format (title, severity, evidence, impact, remediation) and have it reviewed against a rubric.
Explain CVSS base metrics and calculate a score for two lab findings, justifying each metric choice.
Draft an executive summary that communicates risk to a non-technical audience without jargon.
Summarise the legal and ethical requirements for penetration testing: authorisation, scope, data protection, and responsible disclosure.
Describe how to handle sensitive data discovered during a test and the reporting obligations that follow.
Your checkpoint
A complete mock penetration test report (executive summary, methodology, findings, remediation) for the lab environment, plus a legal/ethics checklist.
Information Security Fundamentals and Governance & Reporting, Remediation and Communication & Legal, Ethical and Compliance Considerations & Penetration Testing Methodology and Tooling
Review weak domains using your tracker and re-test at least ten practice questions per weak area.
Explain how governance, compliance, and legal constraints shape every phase of a penetration test.
Create a one-page methodology cheat sheet that links each phase to its key tools, deliverables, and legal checkpoints.
Deliver a 15-minute verbal walkthrough of a mock engagement from scoping to report, including lessons learned.
Complete a timed full-length practice exam and review every incorrect answer to identify remaining gaps.
Your checkpoint
A final revision pack containing the methodology cheat sheet, a scored practice exam with an error log, and a personal readiness statement.
Milestones
Week 2: You can scan a lab target, identify services, and explain three findings with evidence without referring to notes.
Week 4: You have produced a web application test report with at least five vulnerability classes and can explain the impact of each in business terms.
Week 6: You can describe a complete attack chain from reconnaissance through post-exploitation and explain where authorisation and scope limits apply at each step.
Week 8: You score at least 80% on a timed practice exam and your error log shows no domain below 70%.