PT0-002 Planning and Scoping Practice Test 3 — 15 Questions

Question 1

A client requests a penetration test of their network and provides a list of IP addresses. During scoping, the tester notices that several IP addresses belong to a major cloud service provider. What should the tester do FIRST before including those IP addresses in the test?

Accepted Answer

Ask the client to verify ownership and obtain written authorization from the cloud provider if needed. Option B is correct because testing cloud provider IP addresses without explicit authorization violates the cloud provider's terms of service and could be considered unauthorized access, potentially leading to legal action. The tester must first verify that the client actually owns those IPs (e.g., via ARIN WHOIS or cloud provider documentation) and obtain written authorization from the cloud provider, as the provider's shared infrastructure means the tester's traffic could impact other tenants. This aligns with the PT0-002 scoping requirement to confirm all targets are within the authorized boundary.

Answer

Proceed with testing since the client provided the IP addresses

Answer

Exclude the cloud IP addresses from the scope without further discussion

Answer

Perform a quick port scan to determine if the IPs are responsive before deciding

Question 2

A client wants a penetration test that includes social engineering attacks against employees. They request that the testing team not target the executive leadership team. What should be included in the rules of engagement to address this requirement?

Accepted Answer

A list of excluded users or groups, specifically the executive leadership team. Option A is correct because the rules of engagement (RoE) must explicitly define the scope and boundaries of the test. Including a list of excluded users or groups, specifically the executive leadership team, ensures that social engineering attacks are not directed at them, directly addressing the client's requirement. This is a standard scoping practice in penetration testing to prevent unintended consequences and maintain legal and ethical compliance.

Answer

The maximum number of phishing emails that can be sent

Answer

The time window for conducting social engineering activities

Answer

A description of the social engineering techniques that will be used

Question 3

A penetration testing firm is contracted to perform an external test of a company's web applications. During the scoping meeting, the client mentions that they use a CDN and WAF provided by a third party. The client wants the test to accurately reflect the security of their backend servers behind these protections. What should the tester recommend?

Accepted Answer

Obtain the backend server IPs from the client and test them directly. Option B is correct because the client wants the test to accurately reflect the security of their backend servers behind the CDN and WAF. By obtaining the backend server IPs directly, the tester can bypass the third-party protections and assess the actual security posture of the origin servers, which is the true target of the external test. This approach ensures that vulnerabilities not mitigated by the CDN/WAF are identified, aligning with the client's goal of evaluating backend security.

Answer

Test the CDN and WAF as part of the scope

Answer

Include a plan to bypass the WAF in the rules of engagement

Answer

Only test the public-facing URLs as they are

Question 4

A penetration tester is performing reconnaissance on a target domain. The tester queries the public DNS records and finds an SPF record that includes an 'include' mechanism pointing to a third-party email service. Which technique can the tester use to potentially discover more subdomains or internal infrastructure?

Accepted Answer

Query the TXT records of the third-party domain. The SPF record's 'include' mechanism points to a third-party email service, which itself may have SPF or other TXT records that reveal additional domains or subdomains used for email infrastructure. By querying the TXT records of the third-party domain, the tester can discover these included domains, potentially expanding the attack surface. This technique leverages the recursive nature of SPF includes to map out related infrastructure.

Answer

Perform a DNS zone transfer

Answer

Enumerate MX records for the third-party

Answer

Use Google dorks to find exposed email addresses

Question 5

During the scoping phase of a penetration test, a client wants to test a third-party API that is integral to their web application. However, they do not have permission from the third-party provider. Which of the following should the tester do first?

Accepted Answer

Exclude the third-party API from the scope and document the limitation. Option B is correct because testing a third-party API without explicit permission from the provider violates legal and ethical boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must first document this limitation in the scope to ensure the client understands the risk and to maintain the test's legality. Proceeding without permission could lead to liability for both the tester and the client.

Answer

Proceed with testing the API but restrict the test to read-only operations

Answer

Contact the third-party provider directly to obtain permission

Answer

Include the API in the scope and note the legal risks in the report

Question 6

A client requests a penetration test of their internal network. During scoping, the tester learns that the client uses a managed security service provider (MSSP) that monitors all network traffic. The client does not want the MSSP to be informed about the test. What is the most appropriate action for the tester to take?

Accepted Answer

Advise the client to inform the MSSP about the scheduled test and coordinate a maintenance window or exclusion list. Option C is correct because failing to inform the MSSP could trigger automated incident response actions (e.g., IPS blocking, SIEM alerting, or even network isolation) that disrupt the test and potentially cause false-positive security incidents. Coordinating a maintenance window or exclusion list ensures the MSSP's monitoring tools (like Snort, Suricata, or proprietary NDR) do not interfere with legitimate test traffic, preserving both test integrity and the client's operational security.

Answer

Proceed with the test without informing the MSSP, as the client has requested confidentiality

Answer

Include a clause in the rules of engagement that holds the tester harmless for any disruptions caused by the MSSP's monitoring

Answer

Perform the test only after hours to minimize the chance of the MSSP detecting the test activity

Question 7

A penetration tester is contracted to perform a test of a company's critical web application that handles financial transactions. The client requires that testing must not degrade the application's performance for live users. Which of the following scoping controls would best address this requirement?

Accepted Answer

Implement rate limiting in the testing tools and schedule the test during a maintenance window with low traffic. Option B is correct because rate limiting and scheduling during a maintenance window directly prevent performance degradation for live users. Rate limiting controls the request rate (e.g., limiting to 10 requests per second) to avoid overwhelming the application, while a maintenance window ensures minimal user impact. This approach balances active testing needs with the client's requirement to preserve live user experience.

Answer

Require the use of only passive reconnaissance techniques and exclude all active scanning

Answer

Include a clause that the client must monitor application performance and halt the test if degradation is observed

Answer

Test only from a single IP address and use low-packet-rate tools to avoid overwhelming the application

Question 8

A client requires a penetration test of their web application that uses Single Sign-On (SSO) with a third-party identity provider. The client is concerned that testing could lock out real user accounts and disrupt operations. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

Provide test accounts that are excluded from lockout policies. Option B is correct because providing test accounts that are excluded from lockout policies allows the penetration tester to thoroughly assess the SSO authentication mechanism—including the SAML or OIDC flows—without risking the lockout of real user accounts. This directly addresses the client's operational concern while still enabling comprehensive testing of the identity provider integration.

Answer

Prohibit all testing of the authentication mechanism

Answer

Only perform testing during business hours

Answer

Require the tester to use only passive reconnaissance techniques

Question 9

A client has a critical web application that cannot be tested in the production environment due to availability requirements. A staging environment exists that exactly mirrors production, but it uses different IP addresses, domain names, and a subset of data. The staging environment is isolated from production networks. Which scoping element is most important to include in the rules of engagement to ensure a valid test?

Accepted Answer

Explicitly define the staging environment as the target scope. Option A is correct because the staging environment is an exact mirror of production but uses different IP addresses, domain names, and a subset of data. Explicitly defining the staging environment as the target scope ensures the tester focuses all activities on the authorized systems, preventing any accidental impact on production. This scoping element is critical for a valid test because it aligns the test with the client's availability requirements while still allowing comprehensive security testing on a representative environment.

Answer

Require the tester to use non-disruptive testing techniques only

Answer

Include the production IP ranges in the scope 'just in case'

Answer

Specify that the test must be performed from the internet only

Question 10

A client engages a penetration testing firm to evaluate the security of their internal network. During the scoping meeting, the client states that they use a network access control (NAC) solution that might block the tester's machine if it is connected to the internal network without prior authorization. Which of the following should be included in the rules of engagement to address this potential issue?

Accepted Answer

Add a clause requiring the client to whitelist the tester's MAC address in the NAC policy before testing.. Option D is correct because whitelisting the tester's MAC address in the NAC policy allows the tester's machine to connect to the internal network without being blocked, while keeping the NAC solution active for other devices. This approach preserves the real-world security posture of the client's environment and ensures the tester can perform internal network assessments as scoped. It is a standard practice in penetration testing to request MAC address whitelisting to avoid false positives from NAC enforcement.

Answer

Include a requirement that the client disables NAC during the testing window.

Answer

State that the tester will not connect to the internal network and will only test externally.

Answer

Specify that the tester will bypass NAC as part of the test objectives.

Question 11

A client wants to conduct a penetration test of their web application, but they are concerned about potential service disruption. They request that the tester avoid using any techniques that could cause the application to crash or become unresponsive. Which of the following should the tester include in the rules of engagement to address this requirement?

Accepted Answer

Include a clause that prohibits denial-of-service attacks and rate-limits all automated tools.. Option B is correct because it directly addresses the client's concern by prohibiting denial-of-service attacks and implementing rate-limiting on automated tools. Rate-limiting prevents overwhelming the web application with requests, which could cause resource exhaustion or unresponsiveness, while the prohibition on DoS ensures no intentional disruption occurs. This aligns with the rules of engagement (RoE) requirement to scope the test safely.

Answer

Specify that the tester will only use ACK scans and never send data payloads.

Answer

State that the tester will not use any automated tools and will perform only manual testing.

Answer

Do not include any specific limitation; the tester assumes responsibility for any outages.

Question 12

A client is subject to PCI DSS compliance and requests a penetration test. The client's network has a mix of in-scope systems (cardholder data environment) and out-of-scope systems. During scoping, the tester recommends a specific approach to ensure accurate segmentation testing. Which of the following is the most important consideration for the rules of engagement?

Accepted Answer

The tester must be provided with a diagram of the network segmentation. For accurate segmentation testing under PCI DSS, the tester must verify that the segmentation controls (e.g., firewalls, VLANs, ACLs) effectively isolate the cardholder data environment (CDE) from out-of-scope systems. A network diagram is essential because it documents the expected segmentation boundaries, IP ranges, and traffic flows, allowing the tester to design targeted tests (e.g., using traceroute, nm scans, or firewall rule validation) to confirm that no unauthorized paths exist between segments. Without this diagram, the tester cannot determine which systems should be reachable and which should be blocked, making segmentation validation unreliable.

Answer

The tester must have network access to both in-scope and out-of-scope systems

Answer

The tester must agree not to scan any out-of-scope IP addresses

Answer

The tester must obtain written authorization from the client's security team

Question 13

A penetration tester is engaged to perform a red team exercise for a large enterprise. The client wants the test to simulate a realistic attack from an external threat actor. Which of the following scoping elements is most important to include in the rules of engagement?

Accepted Answer

The time window for the test. In a red team exercise simulating an external threat actor, the rules of engagement must define the time window for testing to ensure the test aligns with operational constraints and minimizes business disruption. This scoping element is critical because it sets legal and logistical boundaries, such as avoiding peak business hours or maintenance windows, which is a core requirement for realistic yet safe adversarial simulation.

Answer

A list of all IP addresses to be scanned

Answer

The amount of data to be exfiltrated

Answer

The specific vulnerabilities to be exploited

Question 14

A client wants to test a mobile app that uses certificate pinning. The penetration tester needs to perform dynamic analysis of the app's network traffic. Which of the following should be included in the rules of engagement to enable this testing?

Accepted Answer

Include a provision to install a custom CA certificate on a rooted/jailbroken device.. Certificate pinning in mobile apps rejects any proxy or interception certificate that is not the expected pinned certificate. Installing a custom CA certificate on a rooted/jailbroken device allows the tester to bypass the pinning by injecting a trusted root CA that the proxy (e.g., Burp Suite) uses to sign its certificates, enabling decryption of HTTPS traffic for dynamic analysis.

Answer

Request the app's source code for static analysis instead of dynamic analysis.

Answer

Use a proxy tool like Burp Suite without any modification to the device.

Answer

Obtain a list of API endpoints from the developer and test them manually.

Question 15

A client is planning a penetration test of their AWS cloud environment. They will provide the tester with an IAM user account with limited permissions. Which of the following scoping restrictions is most important to include in the rules of engagement to avoid unexpected costs?

Accepted Answer

The tester must not create any new AWS resources that incur costs.. Option A is correct because creating new AWS resources (e.g., EC2 instances, RDS databases, Lambda functions) can incur direct costs under the tester's IAM user account, even with limited permissions. The rules of engagement must explicitly prohibit resource creation to prevent unexpected billing, as AWS charges for resources provisioned regardless of the test's purpose. This scoping restriction aligns with the principle of cost containment in penetration testing engagements.

Answer

The tester must use only premium AWS services for testing.

Answer

The tester must request permission from AWS Support before each test.

Answer

The tester must avoid testing in the us-east-1 region due to higher costs.