LPT (Master) Exam Preparation: 200 Certified Conceptual Practice Questions with Detailed Rationales Covering All 9 Domains – Windows, IoT, OT/SCADA, Binary Exploitation, Cloud, Wireless, Web, Privilege Escalation, Pivoting & Reporting for 2026/2

1



LPT (Master) Exam Preparation: 200 Certified
Conceptual Practice Questions with Detailed
Rationales Covering All 9 Domains – Windows,
IoT, OT/SCADA, Binary Exploitation, Cloud,
Wireless, Web, Privilege Escalation, Pivoting &
Reporting for 2026/2027 Success
200 Conceptual Practice Questions for the LPT
(Master) Exam
Domain 1: Advanced Windows Attacks (10%)
Q1. Which hashcat mode is used to crack a
Kerberos 5 TGS-REP etype 23 (RC4-HMAC) hash
extracted with GetUserSPNs.py?
• A. -m 1000
• B. -m 13100
• C. -m 18200
• D. -m 5600

,2



☑VERIFIED ANSWER: B
Rationale: Kerberos 5 TGS-REP etype 23 (RC4-
HMAC) hashes from a Kerberoasting attack are
cracked with hashcat mode -m 13100.
Impacket's GetUserSPNs.py with the -
request flag outputs the $krb5tgs$23$* format
consumed by this mode.


Q2. Which Impacket script forces a domain
controller to replicate the krbtgt account hash
so an attacker can later forge Golden Tickets?
• A. psexec.py
• B. secretsdump.py
• C. wmiexec.py
• D. GetADUsers.py
☑VERIFIED ANSWER: B
Rationale: secretsdump.py with a Domain

,3



Admin or DCSync-privileged account performs a
DRSUAPI GetNCChanges call to dump
the krbtgt NTLM hash (and all other account
hashes) from NTDS.dit remotely.


Q3. In BloodHound, which Cypher query
returns all users that have a path to the Domain
Admins group via ACL-based edges?
• A. MATCH p=(u:User)-[*1..]->(g:Group
{name:'DOMAIN '})
RETURN p
• B. MATCH (u:User) WHERE
u.admincount=true RETURN u
• C. MATCH p=shortestPath((u:User)-[r*1..]-
>(g:Group)) WHERE g.name CONTAINS
'DOMAIN ADMINS' AND ALL(rel IN r WHERE
type(rel) IN
['GenericAll','WriteDacl','GenericWrite','Writ

, 4



eOwner','AllExtendedRights','ForceChangeP
assword','AddMember']) RETURN p
• D. MATCH (u:User)-[:MemberOf]->(g:Group)
RETURN u
☑VERIFIED ANSWER: C
Rationale: Restricting the relationship list to
ACL-abuse edges (GenericAll, WriteDacl,
GenericWrite, WriteOwner, AllExtendedRights,
ForceChangePassword, AddMember) returns
only attack paths that exploit AD object
permissions, not membership-based control.


Q4. Which Mimikatz command extracts
cleartext credentials, NTLM hashes, and
Kerberos tickets from LSASS memory on a
Windows host?
• A. lsadump::dcsync /user:krbtgt