PT0-002 Planning and Scoping — 30 Questions

Question 1

A penetration testing firm is scoping a test for a financial institution. The client insists that the test only be performed on systems located in the corporate headquarters, excluding cloud-based infrastructure and remote branch offices. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

The exclusion of cloud infrastructure may leave critical assets untested. Option B is correct because the client's exclusion of cloud-based infrastructure and remote branch offices creates a significant gap in the test scope. A penetration test that ignores cloud assets (e.g., AWS, Azure, or SaaS applications) may miss critical vulnerabilities in systems that process or store sensitive financial data, as these are often part of the institution's attack surface. The tester must emphasize that such exclusions can lead to a false sense of security, as attackers frequently target cloud and remote assets due to their accessibility and potential misconfigurations.

Answer

The test will include social engineering of remote employees

Answer

The test can only be performed during off-hours

Answer

The tester will require VPN access to the corporate network

Question 2

A penetration tester is scoping a test for a multinational corporation that has offices in the United States and the European Union. The client wants to test the entire environment. Which of the following is the MOST important legal consideration for the tester to include in the rules of engagement?

Accepted Answer

Ensuring compliance with GDPR and data protection laws. Option C is correct because the multinational corporation operates in the European Union, where the General Data Protection Regulation (GDPR) imposes strict requirements on the processing and transfer of personal data. A penetration test that accesses or stores EU residents' personal data must comply with GDPR, including data minimization, lawful processing, and breach notification obligations. Failure to include GDPR compliance in the rules of engagement could result in severe fines (up to 4% of annual global turnover) and legal liability for the tester and client.

Answer

Ensuring all testing is performed from a single external IP address

Answer

Obtaining explicit written authorization from each country's legal department

Answer

Restricting testing to non-business hours to minimize impact

Question 3

During a penetration test of a large e-commerce platform, the client requests additional testing on a newly discovered microservice mid-engagement. The scope defined in the rules of engagement (ROE) explicitly lists all target systems. What should the penetration tester do FIRST?

Accepted Answer

Inform the client that a scope amendment is needed and pause testing on the microservice until it is approved. Option C is correct because the rules of engagement (ROE) are a legally binding document that defines the scope of testing. Adding a new microservice mid-engagement without an approved scope amendment violates the ROE and could lead to legal or contractual issues. The penetration tester must first pause testing on the microservice and formally request a scope amendment to ensure all activities remain authorized.

Answer

Add the microservice to the test and include it in the final report as an unadvertised finding

Answer

Decline the request because the microservice was not part of the original scope

Answer

Test the microservice only if it is using the same technology stack as other targets

Question 4

A penetration testing firm is hired to assess a U.S.-based company that has recently expanded operations to a country with strict data privacy laws (e.g., GDPR-style regulations). Which of the following is the MOST important legal consideration to include in the rules of engagement?

Accepted Answer

Data collected during the test must be stored only within the country of operation and deleted after the engagement. Option B is correct because under strict data privacy laws like GDPR, personal data collected during a penetration test must be stored within the jurisdiction where it was obtained and deleted once the engagement is complete. This ensures compliance with data localization and minimization requirements, which are critical legal considerations in the rules of engagement.

Answer

The client's headquarters location determines which laws apply

Answer

All findings must be reported in the local language of the country of operation

Answer

The penetration testers must be citizens of the country where the systems reside

Question 5

A penetration testing firm is scoping a test for a client that has a hybrid infrastructure with on-premises servers and cloud-based virtual machines. The client insists on testing only the on-premises systems due to budget constraints. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

Limiting the scope to on-premises may result in an incomplete risk picture because cloud systems are part of the attack surface.. Option C is correct because the client's hybrid infrastructure means that cloud-based virtual machines are part of the overall attack surface, and limiting the scope to on-premises systems ignores potential attack vectors such as misconfigured cloud APIs, insecure inter-VPC routing, or compromised cloud credentials that could lead to lateral movement into on-premises systems. A penetration test must assess all components that can be exploited to provide a complete risk picture, as cloud systems often serve as entry points or pivot points into the on-premises environment.

Answer

The on-premises systems are more critical, so testing them is sufficient.

Answer

Cloud systems are generally more secure and do not require testing.

Answer

Testing cloud systems would violate the shared responsibility model.

Question 6

A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?

Accepted Answer

List of allowed AWS regions and associated VPC CIDR ranges. Option B is correct because the rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.

Answer

Statement of Work (SOW)

Answer

Data Processing Agreement (DPA)

Answer

Penetration testing methodology document

Question 7

A penetration testing firm is hired to assess a client's network that includes both internal servers and external cloud-based services. The client wants to test only the internal network due to compliance concerns about testing cloud infrastructure. Which of the following should the penetration tester MOST strongly emphasize during the scoping meeting?

Accepted Answer

That the test will not provide a complete risk picture without cloud components. Option B is correct because the scope of a penetration test directly determines the validity of its risk assessment. Excluding cloud services creates a significant blind spot, as the client's attack surface includes both internal servers and external cloud-based services; without testing the cloud components, the test cannot provide a complete risk picture. The penetration tester must emphasize this limitation during scoping to ensure the client understands that the final report will not reflect the full security posture of their hybrid environment.

Answer

That cloud services are often the most vulnerable and should be included for a thorough test

Answer

That the client can always test cloud services later in a separate engagement

Answer

That compliance concerns are unfounded and the test should proceed anyway

Question 8

A penetration testing firm is hired to perform a test on a multinational company that has offices in Europe and North America. The client wants to test all systems including those in the European office, which is subject to GDPR. Which of the following is the MOST important legal consideration to include in the rules of engagement?

Accepted Answer

Data protection and privacy clauses addressing handling of personal data. The engagement involves testing systems in a European office subject to GDPR, which imposes strict requirements on the processing and protection of personal data. The rules of engagement must include data protection and privacy clauses to define how the penetration tester will handle any personal data encountered during the test, ensuring compliance with GDPR Article 5 (lawfulness, fairness, transparency) and Article 32 (security of processing). Without these clauses, the tester could inadvertently violate GDPR by collecting or storing personal data without a lawful basis, exposing both the client and the testing firm to significant fines.

Answer

A limitation of liability clause

Answer

A non-disclosure agreement

Answer

A schedule of testing hours

Question 9

A client requests a penetration test that simulates an external attacker with no prior knowledge of the internal network. The tester is not provided with any credentials, network diagrams, or source code. Which type of test does this describe?

Accepted Answer

Black-box test. This is a black-box test because the tester simulates an external attacker with no prior knowledge of the internal network, no credentials, no network diagrams, and no source code. In black-box testing, the tester must discover all vulnerabilities from an outsider's perspective, relying solely on publicly available information and active reconnaissance techniques such as port scanning, service enumeration, and vulnerability scanning. This approach aligns with the client's requirement to mimic a real-world attacker who has zero insider knowledge.

Answer

White-box test

Answer

Gray-box test

Answer

Covert test

Question 10

A penetration testing firm is scoping a test for a client that uses a hybrid infrastructure with both on-premises servers and cloud-based services (IaaS). The client specifies that only the cloud environment should be tested this year. Which concept is MOST important for the tester to discuss during the scoping meeting to avoid testing out-of-scope assets?

Accepted Answer

The shared responsibility model between the client and the cloud provider. The shared responsibility model defines which security controls and operational tasks are managed by the cloud provider versus the client. In a scoping meeting, understanding this model is critical because the penetration tester must only target the client's side of the responsibility boundary (e.g., guest OS, applications, and IaaS configurations) and avoid testing the provider's underlying infrastructure, which is out-of-scope. Without this discussion, the tester could inadvertently probe the provider's hypervisor or physical network, violating the scope agreement and potentially causing legal or contractual issues.

Answer

The need to test on-premises systems as well to get a complete picture

Answer

The potential for false positives in cloud vulnerability scanners

Answer

The cost of third-party cloud penetration testing tools

Question 11

A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?

Accepted Answer

Explicit exclusion of all cloud-based assets. The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.

Answer

Detailed network diagrams of the cloud environment

Answer

Approval from the cloud service provider

Answer

A list of all cloud API endpoints

Question 12

A penetration testing firm is hired to assess the security of a small business's web application. The client has explicitly stated that they do not want any testing that could cause a denial of service. Which section of the rules of engagement should specify this restriction?

Accepted Answer

Limitations. The restriction against denial of service testing is a limitation on the types of activities permitted during the engagement. In the rules of engagement (RoE), the Limitations section explicitly defines what is prohibited, such as specific attack vectors, tools, or impacts like DoS, to ensure testing stays within agreed boundaries. This is distinct from the Scope, which defines what is tested (e.g., IP ranges, URLs), not what is forbidden.

Answer

Scope

Answer

Scheduling

Answer

Legal

Question 13

A client with a hybrid on-premises and cloud infrastructure requests a penetration test. The client uses an IaaS provider for some servers. Which of the following is the MOST important aspect to clarify in the rules of engagement regarding the cloud environment?

Accepted Answer

The authorization from the cloud provider for testing. The most critical aspect to clarify in the rules of engagement for a cloud environment is obtaining explicit authorization from the IaaS provider. Without this authorization, the penetration test may violate the provider's acceptable use policy or terms of service, potentially leading to legal action or service termination. This is a foundational scoping requirement because the client does not own the underlying infrastructure; the cloud provider retains control over the network and hypervisor layers.

Answer

The list of operating systems used in the cloud

Answer

The public IP addresses of the cloud servers

Answer

The budget allocated for cloud testing

Question 14

A small business hires a penetration tester to assess the security of their network. The owner is concerned about employee data breaches and wants to ensure compliance with industry regulations. Which of the following is the MOST critical document to establish before the test begins?

Accepted Answer

Rules of engagement. The Rules of Engagement (RoE) is the most critical document because it defines the legal boundaries, scope, and authorization for the penetration test. Without a signed RoE, the tester has no legal protection and the test could be considered unauthorized access, violating laws like the Computer Fraud and Abuse Act (CFAA). It also specifies key constraints such as testing times, target IP ranges, and prohibited actions, ensuring compliance with industry regulations like PCI DSS or HIPAA.

Answer

Vulnerability scan report

Answer

Penetration test report

Answer

Risk assessment matrix

Question 15

A client requests a penetration test that includes both their internal network and a third-party cloud service provider's infrastructure. The cloud provider has not given permission for testing. Which action should the penetration tester take regarding the cloud provider's assets?

Accepted Answer

Exclude the cloud provider's assets from the scope and update the rules of engagement. The correct action is to exclude the cloud provider's assets from the scope and update the rules of engagement (ROE). Penetration testing without explicit authorization from the asset owner violates legal and ethical boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The ROE must clearly define the scope to avoid testing third-party infrastructure that the client does not own or have permission to test.

Answer

Test the cloud assets as part of the engagement because they support the client's business

Answer

Test only the client-facing parts of the cloud service

Answer

Request the client to sign an additional liability waiver for testing third-party assets

Question 16

A penetration testing firm is hired to assess a client's web application that integrates with a third-party payment processor's API. The client wants to include the payment processor's API in the test scope. Which action should the tester take FIRST?

Accepted Answer

Request written permission from the payment processor. The correct first action is to request written permission from the payment processor because the API is owned and operated by a third party, not the client. Testing a third-party API without explicit authorization could violate the Computer Fraud and Abuse Act (CFAA) and the payment processor's terms of service, potentially leading to legal liability for both the tester and the client. The scope of a penetration test must be legally defined and agreed upon by all parties whose systems are being tested.

Answer

Begin testing the API because it is part of the client's environment

Answer

Only test the client's internal systems, excluding the API

Answer

Use the payment processor's sandbox environment without notifying them

Question 17

A client with a hybrid infrastructure (on-premises and cloud IaaS) requests a penetration test covering both environments. The cloud provider's terms of service require notification and restrict scanning to specific IP ranges. In which document should these constraints be documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the authoritative source for defining the legal and technical boundaries of a penetration test, including provider-mandated constraints such as notification requirements and restricted IP ranges. In a hybrid infrastructure with cloud IaaS, the ROE must explicitly list the allowed source IPs, target CIDR blocks, and any time windows or rate limits imposed by the cloud provider to ensure compliance with their terms of service. This document is signed by both the client and the testing team before any testing begins, making it the correct place to document these operational constraints.

Answer

Non-Disclosure Agreement (NDA)

Answer

Penetration Testing Report

Answer

Scope of Work (SOW)

Question 18

A client hires a penetration testing firm to assess a web application. The client uses a third-party content delivery network (CDN) for static assets and explicitly wants to exclude the CDN infrastructure from testing. In which document should this restriction be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally document restrictions such as excluding the CDN infrastructure from testing. The ROE defines the scope, boundaries, and specific constraints for the penetration test, including which IP ranges, domains, or systems are off-limits. This ensures the testing team does not inadvertently target the third-party CDN, which could violate contractual agreements or cause unintended disruptions.

Answer

Statement of Work (SOW)

Answer

Non-Disclosure Agreement (NDA)

Answer

Master Services Agreement (MSA)

Question 19

A penetration testing firm has been hired to test the internal network of a large enterprise. During the scoping meeting, the client states that they want to include all IP ranges, including those used by the HR department's sensitive systems. The tester should recommend which of the following to minimize business impact and avoid disruption?

Accepted Answer

Perform the test during off-peak hours and provide prior notification. Option B is correct because performing the test during off-peak hours and providing prior notification minimizes business impact by reducing the likelihood of disrupting critical HR operations during normal business hours. This approach aligns with the scoping requirement to include all IP ranges while allowing the client to prepare for potential service interruptions, such as those caused by active scanning techniques like TCP SYN scans or service enumeration. Prior notification ensures that HR staff can take precautions, such as backing up sensitive data or pausing batch jobs, thereby avoiding data corruption or system unavailability.

Answer

Exclude the HR department's IP range from the test

Answer

Use only passive reconnaissance techniques on the HR systems

Answer

Include the HR systems but require written authorization from HR management

Question 20

A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?

Accepted Answer

The tester must use only non-intrusive scanning techniques on the APIs.. Option A is correct because the client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.

Answer

The tester must exclude all API endpoints from testing.

Answer

The tester must coordinate testing schedules with the API vendors.

Answer

The tester must provide a list of all API calls to be made prior to testing.