PT0-002 Engagement Management — 30 Questions

Question 1

A penetration tester is preparing a post-engagement deliverable. Which THREE of the following should be included in the final report? (Select THREE.)

Accepted Answer

Remediation guidance. The final penetration testing report should include an executive summary (C), which communicates the overall risk posture, key findings, and business impact in non-technical language for executives and stakeholders. It must also include technical findings and vulnerabilities (D), documenting each discovered issue with evidence, affected systems, CVSS or risk ratings, and reproduction details so technical teams can validate and fix them. Remediation guidance (A) is essential because it provides prioritized, actionable recommendations (e.g., patching, configuration hardening, compensating controls) that translate findings into risk reduction. A detailed log of every command executed (B) is not a standard report component—raw command history belongs in appendices or evidence files only if contractually required, and it is not one of the three required sections. The tester's hourly billing breakdown (E) is a commercial/invoicing matter and does not belong in the technical deliverable.

Answer

Detailed log of every command executed

Answer

Tester's hourly billing breakdown

Question 2

Which document defines the IP ranges that are in scope, testing windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) is the formal document that defines the scope boundaries, including IP ranges, testing windows, and emergency stop criteria for a penetration test. It establishes the legal and procedural framework that both the tester and client must follow, ensuring all activities remain within agreed constraints. Without a signed RoE, any testing could be considered unauthorized, potentially leading to legal liability.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 3

Which of the following best describes the primary purpose of a 'get-out-of-jail' letter in a penetration testing engagement?

Accepted Answer

To authorize the tester to bypass security controls without legal repercussions. The get-out-of-jail letter provides legal authorization and protects the tester if their actions are detected as malicious.

Answer

To provide emergency contact information

Answer

To outline the rules of engagement

Answer

To ensure the tester does not steal data

Question 4

A penetration tester is engaged to perform a social engineering assessment targeting the sales department. The RoE specifies that testing is allowed only during business hours. Which of the following actions would be most appropriate when planning the engagement?

Accepted Answer

Launch a vishing attack during normal business hours. Tailgating outside business hours would violate the RoE; the tester should design attacks that fit within the allowed times.

Answer

Deploy USB drop attacks at the office entrance over the weekend

Answer

Conduct a phishing campaign with emails sent at 2:00 AM

Answer

Perform a tailgating attempt at 7:00 PM after most employees have left

Question 5

Which document, often signed before a penetration test, protects the tester from legal liability if the tester's actions are perceived as malicious by third parties?

Accepted Answer

Get-out-of-jail letter. A get-out-of-jail letter (authorization letter) confirms that the tester has permission to conduct the test.

Answer

Statement of Work

Answer

Non-Disclosure Agreement

Answer

Rules of Engagement

Question 6

During a red team exercise, the tester successfully gains access to an internal server and finds evidence of ongoing criminal activity unrelated to the client. According to best practices for handling discovered criminal activity, what should the tester do first?

Accepted Answer

Contact the client's emergency contact as defined in the RoE. The tester should follow the incident response plan and contact emergency contacts; the RoE should specify procedures.

Answer

Immediately inform law enforcement

Answer

Cease all testing and delete the evidence

Answer

Continue testing and document the evidence for the final report

Question 7

A penetration tester is planning a red team exercise for a client. Which TWO of the following should be included in the rules of engagement (RoE)?

Accepted Answer

Testing windows (allowed times for testing). Option D (Testing windows) is correct because the rules of engagement must define exactly when the red team is authorized to perform testing, so the client can control impact on production systems and avoid disrupting business-critical hours. Option E (Emergency stop criteria) is correct because the RoE must specify the conditions and the process by which either party can immediately halt the engagement, including who to contact and how, to prevent unintended damage or escalation. Option A (The client's business goals) is not a required RoE element; business goals belong in the scoping or statement of work discussions, while the RoE focuses on authorization boundaries, constraints, and safety controls. Option B (The tester's background check information) is not part of the RoE; personnel vetting is handled separately in contracting or compliance documentation. Option C (The tester's hourly rate) is a commercial term belonging in the contract or statement of work, not in the rules of engagement.

Answer

The client's business goals

Answer

The tester's background check information

Answer

The tester's hourly rate

Question 8

A penetration tester is conducting a social engineering engagement targeting the finance department. Which THREE of the following actions are most appropriate to include in the scope of the engagement?

Accepted Answer

Making pretext phone calls (vishing) to obtain sensitive information. Social engineering can include phishing, vishing, and USB drops. Physical tailgating may be included but requires careful planning; however, it is often in scope. The question asks for three appropriate actions. Common social engineering vectors: phishing, vishing, and physical intrusion (tailgating). USB drops are also common. But we need three. The best three: phishing, vishing, and tailgating. USB drops are also valid but tailgating is more direct. I'll include phishing, vishing, and tailgating. Explanation: These are typical social engineering techniques.

Answer

Exploiting a SQL injection vulnerability in the finance web app

Answer

Performing a vulnerability scan on the finance network

Question 9

A penetration tester is planning an engagement that includes testing a web application hosted on a third-party cloud provider. The client has provided credentials for the application but not for the underlying infrastructure. Which of the following should the tester do before proceeding?

Accepted Answer

Obtain written permission from the cloud provider. Third-party services require explicit permission from the provider to test; the tester must obtain written authorization.

Answer

Ignore the third-party aspect and test as usual

Answer

Ask the client to move the application to on-premises

Answer

Proceed with testing the application using the provided credentials

Question 10

After completing a penetration test, the tester must submit deliverables and then destroy all test artifacts. Which legal or ethical consideration primarily drives the requirement to destroy test artifacts?

Accepted Answer

The statement of work (SOW) and NDA. Data handling and destruction are required to protect client confidentiality and comply with privacy laws and contractual agreements.

Answer

Privacy laws such as GDPR or HIPAA

Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Vulnerability disclosure responsibilities

Question 11

A penetration tester has completed a web application test and is preparing the final deliverables. According to best practices, which THREE components should be included in the deliverables? (Select THREE.)

Accepted Answer

Detailed technical findings with evidence. Option B is correct because detailed technical findings with supporting evidence (such as HTTP requests/responses, screenshots, and reproduction steps) are the core of a penetration test report, allowing technical staff to understand, verify, and reproduce each vulnerability. Option C is correct because an executive summary translates the technical results into business risk language for management and other non-technical stakeholders, which is a standard deliverable component. Option D is correct because remediation guidance for each finding provides actionable, prioritized fixes so the client can actually reduce risk rather than just learn about it. Option A is not appropriate as a deliverable because raw scanner output is noisy, unvalidated, and lacks the analysis and context a professional report requires. Option E is not included because handing over the application's full source code is outside the scope of a penetration test deliverable and would typically constitute an unnecessary and risky disclosure.

Answer

Raw vulnerability scan output

Answer

Full source code of the application

Question 12

A penetration tester is contracted to perform a web application test for a company that hosts its application on a third-party cloud provider. The tester discovers a critical vulnerability that could allow access to other customers' data on the same cloud platform. Which legal consideration is MOST important for the tester to address?

Accepted Answer

Obtain a new get-out-of-jail letter for the cloud provider. When a penetration tester discovers a vulnerability that could affect other customers on a shared cloud platform, the tester's scope is limited to the target application. To legally test beyond scope (e.g., verify impact on other tenants), a new authorization, such as an updated get-out-of-jail letter covering the cloud provider, must be obtained. Notifying law enforcement is premature unless criminal activity is confirmed.

Answer

Exploit the vulnerability to demonstrate impact

Answer

Include the finding in the final report without further action

Answer

Notify law enforcement of the criminal activity

Question 13

A penetration testing company is scoping a social engineering engagement for a client. The client wants to test employee awareness of phishing attempts. Which of the following should be included in the scope?

Accepted Answer

A defined subset of employees agreed upon in advance. Social engineering engagements require explicit, pre-agreed boundaries to ensure legal and ethical compliance. Including a defined subset of employees allows the client to control risk, avoid disrupting critical operations, and obtain informed consent, which is essential for a valid penetration test scope.

Answer

All employees including the CEO

Answer

External contractors only

Answer

Only non-technical staff

Question 14

After completing a penetration test, the tester is required to provide deliverables that include an executive summary, technical findings, and remediation guidance. However, the client also requests that all test artifacts, such as captured credentials and sample data, be securely destroyed after the report is delivered. Which standard or framework emphasizes the importance of data handling and destruction of test artifacts?

Accepted Answer

NIST SP 800-115. NIST SP 800-115 includes guidelines for handling and destroying test data to maintain confidentiality and integrity.

Answer

OSSTMM

Answer

OWASP Testing Guide

Answer

PTES

Question 15

During a social engineering engagement, a tester plans to use phishing emails targeting employees. Which TWO of the following should be included in the rules of engagement?

Accepted Answer

The timeframe during which phishing emails will be sent. RoE should specify communication methods and measures to avoid harm, such as not targeting specific individuals or providing opt-out.

Answer

The exact wording of phishing emails

Answer

The tester's personal email address for replies

Answer

The email addresses of employees to be targeted

Question 16

A penetration tester is preparing to conduct an internal network assessment for a client. The client's legal team asks what document will protect the tester from prosecution if the tester accidentally accesses a system outside the agreed scope due to a typo in the target IP range. Which document should the tester reference?

Accepted Answer

The get-out-of-jail letter. The get-out-of-jail letter is the legal document that explicitly authorizes the penetration tester to perform testing activities and protects them from prosecution if they accidentally access systems outside the agreed scope. It is signed by an authorized representative of the client and serves as proof of permission. The MSA, SOW, and NDA do not provide this specific legal protection.

Answer

The Statement of Work (SOW)

Answer

The Master Service Agreement (MSA)

Answer

The non-disclosure agreement (NDA)

Question 17

A penetration tester is reviewing the rules of engagement (RoE) for a upcoming web application test. The RoE states that the tester must not perform any denial-of-service (DoS) attacks and must limit testing to the production environment during off-peak hours. The tester identifies a critical SQL injection vulnerability that could be exploited to extract data. Which of the following actions should the tester take to comply with the RoE while demonstrating the vulnerability?

Accepted Answer

Use a time-based blind SQL injection payload to measure response delays without extracting data. The tester should use a time-based blind SQL injection payload to demonstrate the vulnerability without extracting data or causing a DoS. This method complies with the RoE by avoiding data exfiltration and operational disruption. It provides sufficient proof of the vulnerability while respecting the client's constraints. Other methods like extracting data or launching DoS attacks would violate the RoE.

Answer

Perform a UNION-based SQL injection to retrieve the database schema and table names

Answer

Exploit the SQL injection to extract a small sample of data to prove the vulnerability

Answer

Launch a DoS attack against the web server to demonstrate the impact of the SQL injection

Question 18

A penetration tester is hired to assess the security of a company's internal network. The tester is given full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge of the target environment, including credentials and documentation.

Answer

Black box

Answer

Grey box

Answer

Red team

Question 19

During a pre-engagement meeting, the client states that no testing is allowed on the wireless network or on any cloud-based services hosted by third parties. Which part of the engagement documentation would specify these restrictions?

Accepted Answer

Rules of engagement (RoE). The rules of engagement (RoE) define the scope, including what is allowed and not allowed, such as restrictions on wireless and cloud services.

Answer

Get-out-of-jail letter

Answer

Statement of work (SOW)

Answer

Non-disclosure agreement (NDA)

Question 20

A penetration testing company is contracted to perform a social engineering engagement. The client requests that only employees in the finance department be targeted. Which scoping consideration is most relevant?

Accepted Answer

Personnel scope. Personnel scope defines which individuals or groups are in-scope for social engineering testing.

Answer

Rules of engagement

Answer

Production vs. staging environments

Answer

Third-party services