PECB LPTP flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Penetration test definition

An authorized, scoped simulation of real adversary techniques against agreed targets, performed to validate exploitable weaknesses and their business impact rather than only to enumerate them.

Vulnerability assessment vs penetration test

A vulnerability assessment enumerates and reports potential weaknesses without exploiting them; a penetration test validates exploitability and impact through controlled attack steps.

Black-box testing

A testing mode where the tester receives little or no internal information about the target, simulating an external attacker with only publicly discoverable knowledge.

White-box testing

A testing mode where the tester receives architecture, source code, credentials, or configuration data, allowing deeper and faster coverage of logic flaws.

Red team engagement

A goal-based adversary simulation that tests detection, response, and resilience of people and processes, typically with limited or no notice to defenders.

False negative

A real vulnerability that testing failed to identify; it is the most damaging assurance failure because the client believes the asset is secure.

Rules of engagement

The documented agreement defining authorized targets, excluded systems, permitted techniques, test windows, escalation contacts, and stop conditions for an engagement.

Scope definition

The explicit list of in-scope hosts, domains, applications, and accounts, plus out-of-scope assets, agreed in writing before any active testing begins.

Authorization letter

A signed document from an officer with authority over the assets, granting permission to test specified targets during a specified period.

Third-party hosted assets

Systems hosted by a cloud or service provider require separate written permission from that provider; the client's consent alone does not authorize testing.

Statement of work

The contractual document specifying deliverables, schedule, testing type, scope, assumptions, and fees; it anchors the engagement commercially and legally.

Escalation path

The pre-agreed contact chain and timeframes used to notify the client when a critical vulnerability or active compromise is discovered during testing.

Test window selection

Choosing when testing occurs; business hours reduce outage risk and increase staff observation, off-hours reduce detection but raise operational risk.

Scope creep

Uncontrolled expansion of tested assets or techniques beyond the agreed scope; it creates legal exposure and unbudgeted effort.

Passive reconnaissance

Collecting target information without directly interacting with target systems, using OSINT, public DNS records, certificate transparency logs, and search engines.

Active reconnaissance

Directly probing target systems, for example with port scans and service banners, which generates traffic and may trigger logging or alerts.

Filtered port state

A scan result where no response or an ICMP unreachable message is received, indicating a firewall or filter is blocking the probe.

SYN scan

A half-open TCP scan that sends SYN, records the response, then resets the connection, avoiding a full handshake and requiring raw socket privileges.

Service version detection

Probing open ports with crafted requests to identify the software and version behind a service, enabling targeted vulnerability research.

Vertical privilege escalation

Gaining permissions of a higher-privileged account, such as moving from a standard user to administrator or root on the same system.

Horizontal privilege escalation

Accessing data or functions belonging to another user at the same privilege level, commonly seen as insecure direct object references.

Post-exploitation

Actions after initial compromise, such as credential harvesting, lateral movement, and impact demonstration, all constrained by the agreed scope.

CVSS base score

A 0 to 10 severity score derived from intrinsic exploitability and impact metrics; environmental and temporal metrics adjust it for context.

Evidence capture standard

For each validated finding, record timestamped screenshots, request and response pairs, and reproducible command sequences sufficient for independent verification.

Executive summary

The business-facing opening section of a report stating overall risk posture, key themes, and prioritized recommended actions without raw technical output.

Finding write-up components

Each finding states title, affected asset, description, evidence, risk rating with justification, business impact, and specific remediation guidance.

Findings readout meeting

A session where the client reviews draft findings and ratings before the final report, allowing context corrections and disputed ratings to be resolved.

Report classification

The sensitivity label and distribution list agreed at scoping, controlling who receives a report that contains exploitable detail and sensitive data.

Retest report

A follow-up deliverable confirming, with evidence, which findings are closed, partially remediated, or still open after the client applies fixes.

Testing cadence

The planned frequency of penetration tests, such as annual plus event-triggered testing after major changes or incidents, defined by the program.

Mean time to remediate

The average elapsed time from finding delivery to verified closure; a core program metric showing whether testing drives actual risk reduction.

Tester competency evaluation

Assessing a provider through certifications, references, sample reports, and demonstrated experience with the specific technologies and scope in question.

Report quality assurance

A review step checking accuracy, reproducibility of evidence, and consistent risk ratings before a report is released to the client.