100+ Free CISAW-LPT Practice Questions

Prepare for the CISAW Penetration Testing Direction — LPT (信息安全保障人员认证-渗透测试方向) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

100+ Questions

100% Free

Loading practice questions...

Same family resources

Explore More China CISAW Information Security Assurance Workforce Certifications (信息安全保障人员认证)

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

2026 Statistics

Key Facts: CISAW-LPT Exam

84/120

Official passing score

CISAW 120-point paper (CCRC/ISCCC)

150 min

Typical CISAW written sitting

CISAW sitting logistics

RMB 1,080

Exam/certification fee

CACE 19 March 2025 CISAW-LPT notice; ryrzcisaw.isccc.gov.cn

RMB 8,800

Authorized training fee

CACE 19 March 2025 CISAW-LPT notice

3 years

Typical certificate validity

CISAW personnel certification practice

CISAW-LPT is CCRC/ISCCC’s penetration-testing personnel credential. The official sitting is mixed written and practical, 120 points, 84 to pass, typically 150 minutes for the written CISAW paper plus practical tasks. CACE’s 2025 notice lists RMB 8,800 training and RMB 1,080 exam/certification via ryrzcisaw.isccc.gov.cn. This free 2026 English MCQ bank trains recognition, sequencing, legal scope, and mitigation — never exploit payloads.

Sample CISAW-LPT Practice Questions

Try these sample questions to test your CISAW-LPT exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1A web application builds SQL statements by concatenating unsanitized user input into the query string. Which control most reliably prevents SQL injection?

A.Parameterized queries (prepared statements) with bound parameters

B.Client-side JavaScript that rejects apostrophes before submit

C.Hiding the database error page while still concatenating input

D.Relying on a web application firewall as the only control

Explanation: Parameterized queries keep data separate from SQL code, so user input cannot change the statement structure. This is the primary application-layer control against SQL injection. Client-side checks, hiding errors, and a WAF can help defense in depth but do not replace safe query construction.

2A comment field stores visitor input and later renders it in every user's browser without encoding. Which XSS class is this?

A.Reflected XSS

B.Stored (persistent) XSS

C.DOM-based XSS only, with no server storage

D.CSRF, because another user is affected

Explanation: Stored XSS occurs when untrusted input is saved on the server and later sent to other users without context-appropriate encoding. The payload executes in each victim's browser when they view the stored content. Reflected XSS is echoed in an immediate response; DOM XSS is client-side only; CSRF forges a state-changing request, not script storage.

3Which control best prevents CSRF on a cookie-authenticated form that changes account email?

A.A per-session unpredictable anti-CSRF token checked on the server

B.A long password policy for the account

C.Enabling directory listing on the form path so testers can see the HTML

D.Returning HTTP 200 for every POST regardless of origin

Explanation: A server-validated, unpredictable anti-CSRF token (often paired with SameSite cookies) binds the request to the user's real session and page. Attackers on another site cannot read that token. Password length, directory listing, and always-200 responses do not bind the request to the legitimate form.

4User A changes the account-id parameter in a profile URL and receives User B's personal data. What access-control failure is this?

A.Vertical privilege escalation to an administrator role

B.Insecure direct object reference (horizontal unauthorized access)

C.Cross-site request forgery against User B

D.Server-side request forgery to an internal host

Explanation: The tester stayed at the same privilege level but accessed another user's object by manipulating an identifier. That is a classic insecure direct object reference (IDOR) / horizontal access-control failure. Vertical escalation would grant a higher role; CSRF would forge User B's own request; SSRF would make the server fetch a URL.

5An application fetches a user-supplied URL on the server to generate a link preview. Which mitigation best reduces SSRF risk?

A.Allowlist of permitted destinations and block private/link-local address ranges

B.Trust any URL that uses HTTPS

C.Percent-encode the URL and then fetch it unchanged

D.Disable TLS certificate validation so more URLs succeed

Explanation: SSRF is reduced by fetching only destinations the application actually needs, resolving and checking addresses after redirects, and blocking private, loopback, and link-local ranges. HTTPS alone, encoding, or disabling certificate checks does not stop the server from reaching internal services.

6A feature accepts a URL, the server retrieves it, and the HTTP response body is shown only to the requesting user. Testers observe that supplying an internal hostname returns an internal error page. Which issue is indicated?

A.Stored XSS, because the body is displayed

B.CSRF, because a URL is involved

C.SSRF, because the server is induced to contact an internal host

D.Clickjacking, because an internal page appears

Explanation: The server, not the tester's browser, is making the connection to an internal name. That is the defining behavior of server-side request forgery. Displaying the body to the same user does not make it stored XSS; CSRF and clickjacking involve the victim's browser, not the application's outbound fetch.

7Which file-upload design most reduces the chance that an uploaded file is later executed as code?

A.Store files outside the web root, rename them, and serve them from a non-executable location

B.Trust the client-supplied Content-Type header as the file type

C.Allow any extension if the filename contains the word photo

D.Keep the original name and place the file in the public scripts directory

Explanation: Storing uploads outside the web root, generating a new name, and serving through a handler that never executes the bytes as code is the core mitigation. Client Content-Type and filename keywords are attacker-controlled. Saving into a script directory with the original name is a common path to remote code execution.

8A session cookie is sent over HTTPS. Which cookie flag tells the browser not to include that cookie on cleartext HTTP requests?

A.HttpOnly

B.Secure

C.SameSite=Lax

D.Path=/

Explanation: The Secure flag restricts the cookie to HTTPS requests, reducing theft on open networks. HttpOnly blocks script access, SameSite limits cross-site sending, and Path scopes the cookie to a URL prefix. Testers should report missing Secure on authentication cookies.

9Why should an authentication cookie set the HttpOnly flag?

A.It encrypts the cookie value at rest on the server

B.It stops the cookie from being sent to subdomains

C.It prevents document.cookie (and similar script APIs) from reading the cookie

D.It forces the cookie to expire when the tab closes

Explanation: HttpOnly keeps the cookie out of JavaScript, which reduces the impact of XSS that tries to steal session identifiers. It does not encrypt server-side storage, constrain domains, or define session lifetime. Combine it with Secure, SameSite, and XSS prevention.

10Which SameSite cookie setting most strictly prevents the browser from sending the cookie on cross-site requests?

A.SameSite=None without Secure

B.SameSite=Lax

C.SameSite=Strict

D.Omitting SameSite on a modern browser that defaults to Lax

Explanation: SameSite=Strict withholds the cookie from all cross-site requests, including top-level GET navigations. Lax still sends the cookie on some top-level GET navigations. None is for explicit cross-site use and requires Secure. Omitting the attribute typically yields a Lax-like default, which is weaker than Strict for CSRF-sensitive cookies.

About the CISAW-LPT Exam

CISAW Penetration Testing Direction (CISAW-LPT, 信息安全保障人员认证-渗透测试方向) is a CCRC/ISCCC personnel certification under ISO/IEC 17024. It evaluates whether a practitioner can plan and perform authorized tests of networks and applications, recognize common web, middleware, and OS weaknesses, and report remediation without causing unlawful intrusion. The official exam is a Chinese mixed written and practical assessment on a 120-point paper with a passing score of 84; typical written time is 150 minutes. Authorized CACE training in the 19 March 2025 notice is RMB 8,800 plus RMB 1,080 exam/certification paid at ryrzcisaw.isccc.gov.cn. This question bank is a free English-language MCQ study adaptation for 2026. It is not an official CCRC translation, not a dump of exam items, and not permission to test any system.

Assessment

Mixed written paper (objective and constructed-response items in Chinese) plus practical/performance tasks covering authorized reconnaissance, vulnerability recognition, safe validation, and reporting. CCRC published an updated CISAW penetration-testing outline effective 1 September 2026; always follow the current notice in the personnel system.

Time Limit

150 minutes typical CISAW sitting, with an additional practical/performance component for LPT as published in the exam notice

Passing Score

84 out of 120

Exam Fee

RMB 1,080 exam/certification fee via ryrzcisaw.isccc.gov.cn (CACE 2025 notice); authorized training RMB 8,800 (China Cybersecurity Review, Certification and Market Regulation Big Data Center (CCRC / ISCCC / 中国网络安全审查认证和市场监管大数据中心))

CISAW-LPT Exam Content Outline

40%

Web Application Security

SQL injection, XSS, CSRF, SSRF, file upload and include, access control, session management, HTTP semantics, and cookie flags, with emphasis on detection cues and mitigations rather than exploits.

20%

Methodology, Reporting, Ethics and Law

PTES-like stages, rules of engagement, written authorization, report structure, CVSS v3.1 qualitative ratings, evidence handling, and PRC Cybersecurity Law limits on unauthorized intrusion and hacking tools.

15%

Reconnaissance and Scanning

Passive OSINT, DNS and WHOIS, host discovery, Nmap scan-type recognition, CIDR host-count calculations, and service fingerprinting on authorized targets only.

15%

Operating Systems and Middleware

Linux and Windows least-privilege hardening, Apache, Nginx, IIS, Tomcat, and WebLogic exposure, default credentials, and patching of management consoles.

10%

Exploitation Concepts and Post-Exploitation Safety

In-scope confirmation, safe validation, no out-of-scope pivoting, production-impact limits, cleanup, and stopping when unexpected personal data appears.

How to Pass the CISAW-LPT Exam

What You Need to Know

Passing score: 84 out of 120
Assessment: Mixed written paper (objective and constructed-response items in Chinese) plus practical/performance tasks covering authorized reconnaissance, vulnerability recognition, safe validation, and reporting. CCRC published an updated CISAW penetration-testing outline effective 1 September 2026; always follow the current notice in the personnel system.
Time limit: 150 minutes typical CISAW sitting, with an additional practical/performance component for LPT as published in the exam notice
Exam fee: RMB 1,080 exam/certification fee via ryrzcisaw.isccc.gov.cn (CACE 2025 notice); authorized training RMB 8,800

Keys to Passing

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

CISAW-LPT Study Tips from Top Performers

1Memorize authorization and stop-work rules before tooling: no written RoE means no live test.

2Practice CIDR usable-host counts and CVSS v3.1 qualitative bands (Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0) because those are standard, not invented cutoffs.

3For web items, name the flaw class and the control (parameterized queries, output encoding, CSRF tokens, SSRF allowlists) instead of rehearsing payloads.

4Treat Nmap, Burp Suite, and sqlmap as authorized-lab tools: know what each is for, how noisy it is, and when the RoE forbids it.

5Write report outlines with an executive summary, technical evidence, CVSS rating, and concrete remediation — CISAW-LPT grades communication, not dump files.

Frequently Asked Questions

What is CISAW-LPT?

CISAW-LPT is the penetration-testing direction of China’s Information Security Assurance Workforce certification (信息安全保障人员认证-渗透测试方向), issued by CCRC/ISCCC. It certifies authorized testing knowledge and skill for networks and applications, not a license to attack systems without written permission.

What is the official exam format and passing score?

CISAW uses a 120-point mixed assessment with a passing score of 84. Typical written sitting time is 150 minutes. CISAW-LPT also includes practical/performance tasks. Exact item mix is published in the current CCRC outline and exam notice, not as a single public MCQ count.

Does this OpenExamPrep bank replace the official Chinese exam?

No. Official delivery is in Chinese and mixes written and practical work. This bank is a free 2026 English-language MCQ study adaptation for concept recognition, legal/scope judgment, sequencing, and mitigation. It is not an official translation and does not simulate the practical range.

What fees apply?

The CACE CISAW-LPT notice dated 19 March 2025 lists training at RMB 8,800 per person and the exam/certification fee at RMB 1,080 per person, paid to the exam body through https://ryrzcisaw.isccc.gov.cn. Confirm any later fee change in that system before you register.

Is unauthorized penetration testing legal in China?

No. The PRC Cybersecurity Law prohibits illegally intruding into another party’s network, disrupting normal network functions, stealing network data, and providing tools or assistance for those acts. CISAW-LPT work requires documented authorization and a defined scope.

How long is the certificate valid?

CISAW certificates are typically valid for three years. Holders generally complete published continuing-education hours (commonly 16 hours) in the CCRC personnel system before expiry and then apply for recertification. Always follow the current system instructions.