PT0-002 Planning and Scoping Practice Test 4 — 15 Questions

Question 1

A client is planning a penetration test of their internal network but refuses to provide network diagrams or access to a staging environment. The tester is concerned about causing a denial of service (DoS) on critical systems. Which clause should be included in the rules of engagement to mitigate this risk?

Accepted Answer

A rate-limiting clause that restricts scan speed and concurrent connections.. Option C is correct because a rate-limiting clause directly addresses the risk of causing a denial of service (DoS) by controlling the speed and concurrency of the penetration test. By restricting scan rates (e.g., using tools like Nmap with `--max-rate` or `--min-hostgroup`) and limiting concurrent connections, the tester can prevent overwhelming critical systems, even without network diagrams or a staging environment. This clause mitigates the risk without requiring the client to provide additional information or shifting liability.

Answer

A clause requiring the client to provide a complete list of in-scope IP addresses.

Answer

A waiver stating that any service disruption is the client's responsibility.

Answer

An exclusion list for systems that should not be tested.

Question 2

A penetration test is being conducted for a healthcare organization subject to HIPAA. The tester is given access to a production system that contains electronic protected health information (ePHI). Which of the following should be included in the rules of engagement to ensure compliance?

Accepted Answer

A detailed data handling and destruction procedure within the rules of engagement.. Option C is correct because HIPAA requires covered entities to ensure the confidentiality, integrity, and availability of ePHI, which includes proper disposal of data after testing. A detailed data handling and destruction procedure within the rules of engagement (RoE) ensures that test data containing ePHI is securely wiped or destroyed in compliance with 45 CFR § 164.310(d)(2)(i) and NIST SP 800-88 guidelines. Without this clause, the tester might leave residual ePHI on production systems, violating HIPAA's security rule.

Answer

A clause requiring encryption of all test data at rest and in transit.

Answer

A business associate agreement (BAA) signed between the client and the testing firm.

Answer

A restriction to only test in non-production environments.

Question 3

A client wants to perform a penetration test on a new web application that is still in development. The application is not yet connected to the internet. Which of the following is the most appropriate scope for this test?

Accepted Answer

Web application vulnerability assessment. The application is not yet connected to the internet, so an external network penetration test (which targets internet-facing assets) is irrelevant. An internal network penetration test focuses on the internal LAN infrastructure, not the application itself. A web application vulnerability assessment is the correct scope because it directly examines the application's code, logic, and configurations for flaws such as SQL injection, XSS, and authentication bypasses, regardless of network connectivity.

Answer

External network penetration test

Answer

Internal network penetration test

Answer

Social engineering campaign

Question 4

A client wants a penetration test of their cloud infrastructure hosted on AWS. The client states that they want to test the security of their EC2 instances, S3 buckets, and IAM configurations. The client's security team is concerned about potential service disruption due to testing. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

A clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected.. Option B is correct because it directly addresses the client's concern about service disruption by establishing a clear threshold for denial-of-service (DoS) conditions and a mandatory stop action. In AWS, automated scanning or aggressive testing can inadvertently trigger Auto Scaling events, exhaust burst credits on EC2 instances, or saturate S3 request limits, leading to degraded performance. Defining what constitutes a DoS condition (e.g., CPU > 90%, network packet loss > 5%) ensures the tester can halt immediately, protecting the client's cloud infrastructure while still allowing effective security testing.

Answer

A clause that the tester will avoid using any automated scanning tools.

Answer

A requirement that the tester only performs manual testing and no tools.

Answer

A clause that the tester will test only during business hours.

Question 5

A client requests a penetration test of their production environment that includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A 'stop loss' condition that requires immediate termination of testing if system metrics exceed defined thresholds. Option B is correct because a 'stop loss' condition is a standard mechanism in Rules of Engagement (RoE) that defines specific system metrics (e.g., CPU utilization > 90%, memory usage > 80%, or transaction latency > 500ms) which, when exceeded, require immediate termination of testing. This directly addresses the client's concern about service disruptions in the production environment by providing a safety threshold that prevents the penetration test from causing performance degradation or outages in critical financial transaction systems.

Answer

The tester will only use passive reconnaissance techniques

Answer

Exclude all financial transaction systems from the scope of testing

Answer

The client must provide a service level agreement (SLA) to the tester

Question 6

A client wants a penetration test that simulates a disgruntled employee with access to the internal network but no administrative privileges. The client provides a standard user account on the domain. The tester discovers that the account has local administrator rights on a critical file server. Which step should the tester take according to typical Rules of Engagement?

Accepted Answer

Pause testing and inform the client of the unexpected privilege level for guidance. Option C is correct because the Rules of Engagement (RoE) require the tester to operate within the agreed scope and privilege level. Discovering that the provided standard user account has unexpected local administrator rights on a critical file server represents a scope change that could invalidate the test's assumptions and potentially cause unintended damage. The tester must pause and inform the client to obtain explicit guidance before proceeding with elevated privileges.

Answer

Continue testing with the elevated privileges because they were provided

Answer

Use the privileges to escalate to domain admin and test further

Answer

Revert to a lower-privileged account provided by the client

Question 7

A client wants to conduct a penetration test of their e-commerce website. They are concerned about impacting live transactions. Which clause should be included in the Rules of Engagement to address this?

Accepted Answer

Exclusion of network stress testing and availability testing.. Option A is correct because the client's primary concern is avoiding disruption to live transactions. A clause excluding network stress testing and availability testing (e.g., DoS attacks, resource exhaustion, or high-volume scanning) directly addresses this by prohibiting any action that could degrade performance or cause downtime. This is a standard Rules of Engagement (RoE) safeguard for production e-commerce environments where transaction integrity and uptime are critical.

Answer

Out-of-scope systems list.

Answer

In-scope IP addresses.

Answer

Authorization for testing.

Question 8

A client wants a penetration test that simulates an external threat actor with no prior access. The client provides a list of public IP ranges and domain names. Which type of test is this?

Accepted Answer

External black-box test.. This is an external black-box test because the client provides only public IP ranges and domain names, simulating an external threat actor with no prior access. The tester has no internal knowledge or credentials, which defines a black-box approach, and the scope is limited to external-facing assets, making it external.

Answer

Internal white-box test.

Answer

Gray-box test.

Answer

Red team exercise.

Question 9

A client wants a penetration test of their internal network. They are concerned about causing any disruption to the production systems. The tester should include which of the following in the rules of engagement to address this concern?

Accepted Answer

A clear definition of the testing window and contact information for emergency stop. Option B is correct because a clearly defined testing window with emergency stop contact information directly addresses the client's concern about production disruption. This ensures the tester can immediately halt activities if any instability is detected, aligning with the principle of minimizing operational impact during a penetration test.

Answer

A list of all tools that will be used during the test

Answer

A requirement for the client to disable their antivirus software

Answer

A statement that the tester will not be liable for any damages

Question 10

A client requests a penetration test of a new mobile application that is still in development and only accessible on a test server behind the corporate VPN. The tester should include which of the following in the scope?

Accepted Answer

Only the test server and the mobile application client. Option B is correct because the scope of a penetration test for an application still in development should be limited to the test server and the mobile application client. This ensures the assessment focuses on the application's security posture without including production systems that are not yet live or the corporate VPN infrastructure, which is typically out of scope unless explicitly requested. The tester should only evaluate the components directly relevant to the application's functionality and security during development.

Answer

The production servers hosting the app when it goes live

Answer

The corporate VPN infrastructure

Answer

All third-party APIs used by the application

Question 11

A client requests a penetration test of their production environment, which includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A scope that limits testing to off-peak hours and includes a rollback plan for any changes. Option C is correct because it directly addresses the client's concern about service disruptions by limiting testing to off-peak hours and including a rollback plan. This ensures that any changes made during the test can be reversed quickly, minimizing the risk to critical financial transaction systems. The Rules of Engagement (RoE) must balance thorough testing with operational stability, and this scope provision achieves that.

Answer

A detailed schedule of every attack method to be used

Answer

A clause stating that testing will stop immediately if any service degradation is detected

Answer

A list of all tools and versions that will be used during the test

Question 12

A company wants to test the security of their internet-facing web application without impacting production servers or user data. The tester must be authorized to attempt authentication bypass and SQL injection. Which item is most critical to include in the scope definition to ensure the test is focused and lawful?

Accepted Answer

A list of target URLs and IP addresses of the web application. Option B is correct because the scope definition must explicitly list target URLs and IP addresses to establish legal authorization boundaries and prevent unintended access to production systems. Without precise targets, the tester could inadvertently impact non-authorized systems, violating the rules of engagement and potentially causing data breaches or service disruption.

Answer

A list of user accounts with credentials for authenticated testing

Answer

A detailed testing schedule and hours of operation

Answer

The testing methodology and tools to be used

Question 13

Before starting a penetration test, the tester receives permission to test only two public IP ranges and is told not to perform denial-of-service testing. Which two documents or artefacts are most important to confirm before testing begins? (Choose 2.)

Accepted Answer

Written authorization to test the specified targets.. Written authorization (A) is the foundational legal document that explicitly grants the tester permission to test the specified public IP ranges, protecting against claims of unauthorized access under laws like the Computer Fraud and Abuse Act. The rules of engagement (B) define the scope boundaries, including the prohibition of denial-of-service testing, which is critical to avoid service disruption and legal liability. Without these two documents, the tester lacks both legal authority and operational constraints, making them the most important artefacts before testing begins.

Answer

A list of exploit payloads from a public GitHub repository.

Answer

A screenshot of the company home page.

Question 14

A penetration testing firm is hired to assess a mobile banking application. The client wants to test both Android and iOS versions, but only the production environment. Which of the following is the MOST important scoping consideration to include in the rules of engagement?

Accepted Answer

Requiring jailbroken/rooted devices for testing. Requiring jailbroken or rooted devices is the most important scoping consideration because mobile banking applications often implement runtime integrity checks (e.g., MagiskHide, Frida detection) that prevent the app from running on compromised devices. Without explicit authorization to bypass these controls, the penetration tester cannot perform deep dynamic analysis, such as hooking API calls or inspecting encrypted local storage, which is essential for a thorough security assessment of the production environment.

Answer

Specifying the number of concurrent users during testing

Answer

Defining the test window to avoid peak hours

Answer

Excluding the backend API from testing

Question 15

A penetration tester is asked to perform a test that focuses on identifying vulnerabilities in a company's external web application without providing any internal credentials. The tester has been given a signed agreement that lists the IP range and URLs. Which of the following scoping considerations is MOST directly addressed by the agreement?

Accepted Answer

Type of testing (black box vs white box). The signed agreement explicitly defines the IP range and URLs for testing, which directly informs the type of testing. Since no internal credentials are provided, this is a black box test, where the tester has no prior knowledge of the internal system. The agreement's scope (IPs and URLs) is the primary factor that determines the testing approach, making 'Type of testing (black box vs white box)' the most directly addressed scoping consideration.

Answer

Time constraints for the test

Answer

Rules of engagement regarding social engineering

Answer

Data handling procedures