EC-Council Licensed Penetration Tester (LPT Master): key terms

Flashcards for this exam EC-Council Licensed Penetration Tester (LPT Master) guide

• Assumed BreachA testing approach that starts with attacker access already inside the environment to focus on post-compromise detection and impact.Intermediate
• Attack NarrativeA chronological story in a pen test report describing how testers moved from initial access to their objective.Intermediate
• Authorization LetterWritten permission from an asset owner allowing testers to attack specified systems, sometimes called a get-out-of-jail-free letter.Foundational
• DeconflictionThe process of distinguishing authorized testing activity from a real attack when defenders detect suspicious behavior.Intermediate
• Executive SummaryA short, non-technical section of a report summarizing overall risk, key findings and business impact for leadership.Foundational
• Master Service Agreement (MSA)An umbrella contract setting the general legal terms for all future work between a client and a service provider.Foundational
• NIST SP 800-115NIST's Technical Guide to Information Security Testing and Assessment, covering review, target identification and vulnerability validation techniques.Intermediate
• Open Source Security Testing Methodology Manual (OSSTMM)A peer-reviewed security testing methodology from ISECOM focused on measurable, repeatable operational security testing.Intermediate
• Penetration Test ReportThe final deliverable of a pen test, documenting methodology, findings, risk ratings, evidence and remediation recommendations.Foundational
• Penetration Testing Execution Standard (PTES)A penetration testing methodology defining seven phases from pre-engagement interactions to reporting.Intermediate
• Post-Engagement CleanupRemoving all tools, accounts, shells, files and configuration changes introduced during testing.Foundational
• Remediation RetestA follow-up test verifying that previously reported vulnerabilities have been properly fixed.Foundational
• Rules of Engagement (RoE)The document defining how a security test will be conducted: timing, targets, allowed techniques, contacts and limits.Foundational
• ScopeThe defined boundaries of an engagement: which assets, locations, techniques and time frames are included or excluded.Foundational
• Scope CreepUncontrolled growth of an engagement's scope beyond what was originally agreed.Foundational
• Statement of Work (SOW)A contract document detailing the specific deliverables, timeline, scope and cost of a particular engagement.Foundational