PT0-002 Planning and Scoping — 10 Questions

Question 1

A penetration tester is hired to assess the security of a company's internal network. The tester is given full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge of the target environment, including credentials and documentation.

Answer

Black box

Answer

Grey box

Answer

Red team

Question 2

During a pre-engagement meeting, the client states that no testing is allowed on the wireless network or on any cloud-based services hosted by third parties. Which part of the engagement documentation would specify these restrictions?

Accepted Answer

Rules of engagement (RoE). The rules of engagement (RoE) define the scope, including what is allowed and not allowed, such as restrictions on wireless and cloud services.

Answer

Get-out-of-jail letter

Answer

Statement of work (SOW)

Answer

Non-disclosure agreement (NDA)

Question 3

A penetration testing company is contracted to perform a social engineering engagement. The client requests that only employees in the finance department be targeted. Which scoping consideration is most relevant?

Accepted Answer

Personnel scope. Personnel scope defines which individuals or groups are in-scope for social engineering testing.

Answer

Rules of engagement

Answer

Production vs. staging environments

Answer

Third-party services

Question 4

A penetration tester discovers evidence of ongoing criminal activity, such as a data breach by an internal employee, during a white box penetration test. The client's legal team has not provided specific instructions on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and contact the client's emergency contact. The tester should immediately stop testing and inform the client's emergency contact to handle the criminal activity appropriately.

Answer

Notify law enforcement directly

Answer

Continue testing and document the evidence for later reporting

Answer

Ignore the activity and proceed as planned

Question 5

Which penetration testing standard provides a structured methodology for conducting penetration tests, including pre-engagement, reconnaissance, and reporting phases?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) covers the entire testing lifecycle.

Answer

NIST SP 800-115

Answer

OWASP Testing Guide

Answer

OSSTMM

Question 6

A company wants to simulate a real-world attack scenario where the penetration tester has no prior knowledge of the environment and must act as an external threat actor. However, the tester is allowed to use social engineering to gain initial access. Which type of engagement is most appropriate?

Accepted Answer

Red team exercise. A red team exercise is a full-scope adversary simulation that can include social engineering and black box testing.

Answer

Network penetration test

Answer

Wireless penetration test

Answer

Web application penetration test

Question 7

A penetration tester is conducting a grey box test on a web application. During the test, the tester discovers that the application is hosted on a cloud infrastructure that belongs to a third-party provider. The client did not mention this provider in the scope. What is the best course of action regarding testing this infrastructure?

Accepted Answer

Stop testing the cloud infrastructure and notify the client. Testing third-party infrastructure without permission is illegal and violates the rules of engagement. The tester should stop testing that part and inform the client.

Answer

Add the cloud provider to the scope without notifying the client

Answer

Continue testing because the application is owned by the client

Answer

Obtain verbal permission from the cloud provider and proceed

Question 8

Which legal framework in the United States prohibits unauthorized access to computer systems and is commonly referenced in penetration testing authorization documents?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary U.S. law against unauthorized computer access.

Answer

HIPAA

Answer

GLBA

Answer

SOX

Question 9

A penetration tester is preparing a deliverable for a client. Which of the following should be included in the final report?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A standard penetration testing report includes an executive summary, technical findings, and remediation guidance.

Answer

The tester's personal notes and observations

Answer

Only the technical findings

Answer

Only the executive summary

Question 10

A penetration tester is planning a test that involves scanning for vulnerabilities across a large IP range. The client has provided a list of IPs that are in-scope, but the tester notices that some IPs belong to a third-party company hosting a client application. What should the tester do?

Accepted Answer

Exclude the third-party IPs and notify the client. The tester must ensure that all in-scope IPs are authorized. If an IP belongs to a third party, the tester needs written permission from that provider before testing.

Answer

Assume the client has permission and scan all IPs

Answer

Scan the IPs because they are on the client's list

Answer

Scan only the third-party IPs that respond to ping