GPEN Pen Test Planning — 20 Questions

Question 1

An enterprise client insists on a blind 'black-box' penetration test where the testing team receives zero prior knowledge regarding network architecture, IP ranges, or applications. However, the client's primary objective is to thoroughly test deep-seated business logic vulnerabilities within a critical custom web application. Why is this planning approach fundamentally misaligned with the client's stated objective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Discovery phases consume disproportionate time, leaving insufficient hours for the deep manual analysis required to uncover logic flaws.. Black-box testing forces testers to spend the majority of the engagement on reconnaissance and basic discovery rather than deep vulnerability analysis. To effectively evaluate complex business logic flaws, testers require white-box or gray-box scoping with documentation and credentials to achieve adequate depth within standard assessment timeframes.

Answer

Black-box testing is legally prohibited under international cybersecurity standards for any application handling financial data.

Answer

Zero-knowledge assessments automatically violate standard industry rules of engagement by preventing the execution of automated scanners.

Answer

Client stakeholders cannot legally authorize a penetration test without providing a complete network diagram and asset inventory.

Question 2

During the scoping phase of a penetration test for a global e-commerce client, you identify that the client uses a cloud-based Content Delivery Network (CDN) to host static assets. Which action is the most critical for ensuring the engagement remains within the Rules of Engagement (RoE)?

Accepted Answer

Verify if the client has explicit written permission from the CDN provider.. Testing a CDN often involves third-party infrastructure that falls outside the client's direct control. Testing these assets without explicit authorization from the CDN provider can trigger automated DDoS mitigations or legal disputes. Confirming whether the CDN is in-scope prevents accidental service disruption and potential contractual violations, ensuring the pentest methodology adheres to legal boundaries and professional standards regarding third-party service provider interaction.

Answer

Perform a SYN scan against the CDN IP ranges to identify open ports.

Answer

Incorporate the CDN provider's IP space into the primary target scope.

Answer

Bypass the CDN by mapping the origin server's IP address directly.

Question 3

You are drafting the Rules of Engagement for an internal penetration test. Which TWO of the following items are considered mandatory for the 'Communication Plan' section?

Accepted Answer

The names and 24/7 contact information for designated incident response leads.. A robust communication plan is essential for maintaining control during an engagement. By defining specific emergency protocols and status reporting cadences, both the testing team and the client minimize the risk of operational downtime. These elements ensure that technical findings are communicated effectively while providing a clear escalation path if an unexpected system failure occurs, maintaining professional accountability throughout the duration of the testing period.

Answer

A list of all vulnerabilities found during the previous year's audit.

Answer

The specific exploit payloads that will be used during the test.

Answer

The estimated total cost of the project and payment schedule.

Question 4

Refer to the exhibit. You are performing a penetration test based on this policy. You discover an unpatched SQL injection vulnerability on 192.168.10.20 that could be used to trigger a database lock-up. What is the most appropriate course of action?

Accepted Answer

Document the vulnerability and the risk of DoS without exploitation.. Adhering strictly to the defined scope and allowed attack types is the cornerstone of professional pentesting. Since 'DoS' is explicitly forbidden, any exploit that causes service instability must be avoided. The tester must report the vulnerability as a high-risk finding without executing the destructive payload, as the client's policy prioritizes service availability over demonstrating the full potential of an exploit that risks system uptime.

Answer

Execute the SQL injection to prove the vulnerability exists.

Answer

Attempt the exploit on the excluded host 192.168.10.50 to see if it is vulnerable.

Answer

Extend the testing window to allow for a safer, non-disruptive exploit.

Question 5

Which document is primarily responsible for defining the 'Rules of Engagement' (RoE) in a penetration testing project?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement document serves as the operational handbook for the penetration test, detailing exactly what is permitted, what is prohibited, and the emergency procedures to follow. It bridges the gap between the legal contract and the technical execution, ensuring that all parties have a mutual understanding of the engagement's boundaries, safety protocols, and professional expectations, which is critical for minimizing risks during testing.

Answer

The Statement of Work (SOW).

Answer

The Non-Disclosure Agreement (NDA).

Answer

The Service Level Agreement (SLA).

Question 6

During planning, a client requests that you use a specific automated scanner that is known to produce false positives and potential system instability. What is the most professional way to handle this request?

Accepted Answer

Document the risks, communicate them to the client, and propose a validated alternative.. Professional pentesting requires the expert to validate the tools used against the client's operational constraints. Accepting a tool that causes instability ignores the core principle of 'do no harm'. By explaining the technical risks and proposing a safer, more reliable methodology, the tester acts as a trusted advisor, ensuring the client receives accurate, actionable intelligence without risking their production environment's stability during the process.

Answer

Agree to use the tool but run it only during off-peak hours.

Answer

Refuse the request and insist on using your own proprietary toolset.

Answer

Use the requested tool but ignore the potential instability issues.

Question 7

When defining the 'Scope' for a penetration test, which THREE factors are critical to document to ensure the engagement is legally and operationally sound?

Accepted Answer

The exact IP ranges and subnets authorized for testing.. Defining the scope accurately is the most important part of the planning phase. It prevents 'scope creep', protects the tester from claims of unauthorized access, and ensures the testing effort is focused on the most critical assets. By clearly documenting IP ranges, business-critical systems, and exclusions, the tester ensures that the activity remains within the agreed-upon boundaries and that both parties agree on what is being assessed and protected.

Answer

The personal email addresses of the IT administrators.

Answer

The specific passwords used for internal testing accounts.

Question 8

A client asks for an 'unannounced' penetration test to test their incident response team. What is the most important preparatory step before commencing this exercise?

Accepted Answer

Obtain written authorization from a senior executive who can stop the test.. An unannounced test simulates a real-world breach, but it carries significant risk to business operations if the responders block legitimate internal traffic or if the testers are arrested by physical security. Ensuring that at least one senior decision-maker, such as the CISO, is aware of the test is vital. This provides a 'safe harbor' and a mechanism to immediately stop the test if it causes unintended consequences.

Answer

Ensure that the entire IT staff is informed of the test dates.

Answer

Launch the test during a holiday weekend to minimize user disruption.

Answer

Use only low-impact passive scanning to avoid triggering alarms.

Question 9

Refer to the exhibit. You are currently at 17:15. You have just identified a critical, easily exploitable vulnerability on 10.1.1.20. What is the correct next step?

Accepted Answer

Immediately report the finding using the emergency contact procedure.. The defined 'Testing_Time' is 08:00 to 17:00. Performing actions outside this window is a violation of the Rules of Engagement. Given the finding is critical, the tester should halt further testing immediately and notify the client using the established 'Escalation' procedure. This prevents unauthorized testing outside the agreed window while ensuring the critical risk is brought to the client's attention promptly, maintaining both compliance and security awareness.

Answer

Continue testing until you have fully compromised the system.

Answer

Wait until 08:00 the next day to report the vulnerability.

Answer

Run a full vulnerability scan on the remaining hosts to finish early.

Question 10

Which of the following best describes the 'Gray-box' testing methodology?

Accepted Answer

Partial knowledge of internal systems and limited documentation.. Gray-box testing combines elements of both black-box and white-box testing. The tester has limited knowledge of the environment, such as network diagrams or internal documentation, but does not have full source code access. This approach is highly effective for simulating a sophisticated attacker, such as an insider or an attacker who has already gained an initial foothold, allowing for a more focused and efficient security assessment.

Answer

Complete lack of knowledge about the target environment.

Answer

Full access to source code, network diagrams, and documentation.

Answer

Testing only the physical security controls of a facility.

Question 11

What is the primary purpose of the 'Scope' section in the Rules of Engagement?

Accepted Answer

To define the specific boundaries of the assessment.. The scope section is essential to clearly define the boundaries of the test. It explicitly identifies which systems, applications, and networks are authorized for testing, protecting both the client and the tester from potential legal issues. By delineating these boundaries, it prevents 'scope creep' and ensures that the testing effort is focused on the intended targets, maximizing the impact of the assessment while minimizing risk.

Answer

To outline the payment terms for the penetration test.

Answer

To detail the specific tools to be used by the tester.

Answer

To list the names of all employees who will be interviewed.

Question 12

If a penetration tester discovers a vulnerability that could compromise a third-party hosted service during an engagement, what is the correct professional responsibility?

Accepted Answer

Report the finding to the client and let them handle vendor disclosure.. The tester must report this finding only to the primary client, as they are the contractual entity. The tester should not contact the third-party provider directly, as this could violate the engagement's legal agreements. The client is responsible for coordinating with their third-party vendors. Professional ethics require that testers respect the chain of command and the contractual structure established at the start of the engagement.

Answer

Contact the third-party service provider immediately to warn them.

Answer

Ignore the finding as it is outside the client's direct control.

Answer

Publish the finding on a public bug bounty site for remediation.

Question 13

When planning for an engagement involving sensitive data, which TWO of the following must be included in the data handling plan?

Accepted Answer

The encryption standards for data at rest and in transit.. Data handling is paramount when managing sensitive information during a penetration test. The tester must ensure that data is encrypted at rest and in transit, and that it is securely destroyed once the project concludes. These protocols protect the client from data breaches caused by the testing activity itself, maintaining the integrity and confidentiality of the sensitive information processed during the course of the engagement.

Answer

The public keys of all developers involved in the project.

Answer

The names of all servers used to store the data.

Answer

A list of all public websites the testers use for research.

Question 14

You are finalizing the Rules of Engagement (RoE) for a penetration test of a regional hospital network. The client's legal counsel requires that any testing activity be immediately suspended if a life-safety system is affected. Which element should you add to the RoE to satisfy this requirement?

Accepted Answer

A documented emergency stop procedure with named client contacts and a defined notification method.. An emergency stop procedure is the operational control that lets the hospital halt testing instantly when a life-safety system is at risk. It specifies authorized personnel, the notification channel, and the required acknowledgment, making the requirement enforceable and auditable. Scheduling limits, waivers, and reporting timelines all operate after or around the event rather than stopping it in real time.

Answer

A liability waiver transferring all damages from the testing firm to the hospital.

Answer

A requirement that all findings be delivered in a written report within thirty days of testing.

Answer

An expanded scan window that limits intrusive testing to overnight hours only.

Question 15

A financial services client engages you for an external penetration test and wants contractual protection before testing begins. Which TWO items belong in a master services agreement or statement of work to limit the firm's legal exposure while authorizing the work? (Choose two.)

Accepted Answer

A signed authorization and consent to test that identifies the in-scope assets and the permitted time window.. Legal protection for a penetration engagement rests on a signed authorization that identifies in-scope assets and permitted testing windows, paired with a limitation of liability clause that caps damages and excludes consequential losses. Together they establish consent and bound financial exposure. One-sided letters, publication rights, and verbal permissions do not create enforceable authority or meaningful risk transfer.

Answer

A get-out-of-jail-free authorization letter signed only by the tester's project manager.

Answer

A confidentiality clause that allows the tester to publish anonymized findings at will.

Answer

A verbal agreement recorded in meeting minutes that testing may proceed as discussed.

Question 16

During planning for a penetration test, the client states the goal is to evaluate how well the security operations center detects and responds to attacker activity. Which engagement type best aligns with this objective?

Accepted Answer

A red team engagement that emulates adversary tactics and measures detection and response.. When the goal is evaluating detection and response, the engagement should generate realistic adversary activity that the defensive team can observe and act on. A red team engagement does exactly that, with objectives tied to whether the SOC detects, investigates, and contains the simulated intrusion, producing measurable findings about people and process rather than only technical weaknesses.

Answer

A vulnerability assessment that enumerates and rates missing patches across the environment.

Answer

A wireless survey mapping access point coverage and rogue device presence.

Answer

A compliance audit against a regulatory framework with control-by-control evidence collection.

Question 17

You are planning a penetration test for a healthcare provider that must comply with HIPAA. The client wants to test a new patient portal hosted on AWS. During the kickoff meeting, the client's legal team asks how you will handle any protected health information (PHI) that you might encounter. Which of the following is the most appropriate action to take before testing begins?

Accepted Answer

Sign a Business Associate Agreement (BAA) with the client and ensure your testing infrastructure is covered under it.. Under HIPAA, a penetration tester acting as a business associate must sign a BAA before accessing systems that may contain PHI. This agreement establishes permissible uses and safeguards for protected health information. Without it, the engagement could be non-compliant regardless of technical precautions.

Answer

Encrypt all test data at rest and in transit, and avoid accessing any real patient data by using synthetic records.

Answer

Obtain written authorization from the client's CEO and proceed with testing without additional agreements.

Answer

Conduct the test only after hours to minimize the risk of encountering live patient data.

Question 18

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 19

You are the lead penetration tester for a financial services client. During the scoping meeting, the client states they want to test their external perimeter but are concerned about accidental disruption to production trading systems. They ask you to propose a testing approach that minimizes operational risk while still validating exploitable vulnerabilities. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Execute a controlled penetration test using non-destructive exploitation techniques, with a defined stop condition for any sign of instability.. The client requires validation of exploitable vulnerabilities with minimal risk to production. A controlled penetration test using non-destructive techniques and clear stop conditions achieves this by avoiding disruptive payloads and ensuring immediate cessation if instability occurs. It respects the client's risk tolerance while still providing meaningful security validation, unlike approaches that either disrupt services or fail to validate exploitability.

Answer

Simulate an insider threat by deploying a physical implant in the data center to test physical security controls.

Answer

Conduct a vulnerability assessment with authenticated scans during off-peak hours and manually validate only critical findings.

Answer

Perform a full-scale denial-of-service test against the trading platform to assess resilience under attack conditions.

Question 20

A client asks you to perform a penetration test on their internal network. During the planning phase, they provide you with a list of IP addresses and ask you to sign a document that limits your testing to those addresses. Which of the following best describes the purpose of this document?

Accepted Answer

It defines the scope of the engagement and legally authorizes testing only on the specified targets.. The document is a scope and authorization agreement. It legally permits testing only on specified IP addresses and protects both parties by clearly defining what is allowed. Without it, testing could be deemed unauthorized, leading to legal consequences.

Answer

It is a liability waiver that absolves the tester of any responsibility for system damage.

Answer

It is a service level agreement outlining the expected uptime of the target systems during testing.

Answer

It serves as a non-disclosure agreement to protect the client's confidential information.