PT0-002 Engagement Management Practice Test 2 — 15 Questions

Question 1

A penetration tester is hired to perform an assessment where the tester is provided with network diagrams, source code, and administrative credentials. Which type of penetration test is this?

Accepted Answer

White box. In a white box test, the tester has full knowledge of the environment, including credentials and documentation.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 2

Which document defines the IP ranges that are in scope, testing windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) is the formal document that defines the scope boundaries, including IP ranges, testing windows, and emergency stop criteria for a penetration test. It establishes the legal and procedural framework that both the tester and client must follow, ensuring all activities remain within agreed constraints. Without a signed RoE, any testing could be considered unauthorized, potentially leading to legal liability.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 3

A penetration tester is planning a social engineering engagement targeting employees of a client. The client requests that only non-managerial staff be tested. Which scoping consideration is most directly affected by this request?

Accepted Answer

Personnel scope. Personnel scope determines which individuals or groups are targeted in social engineering tests.

Answer

IP address range

Answer

Production vs. staging

Answer

Third-party services

Question 4

During a penetration test, the tester discovers evidence of an ongoing data breach that appears to involve criminal activity unrelated to the test scope. What is the tester's primary responsibility regarding this discovery?

Accepted Answer

Notify the client's emergency contact and follow the agreed-upon incident response procedures. The tester should follow the incident response plan and notify the client immediately, as handling criminal activity is a legal and ethical obligation.

Answer

Continue the test as planned and include the findings in the final report

Answer

Document the evidence and destroy it after the engagement to protect the client

Answer

Immediately stop testing and notify law enforcement without client approval

Question 5

A penetration tester is engaged to test a web application that uses a third-party payment gateway. The client has not obtained permission from the payment gateway provider. Which of the following is the best course of action?

Accepted Answer

Exclude the payment gateway from scope and notify the client that permission is required. Third-party services require explicit permission from the provider; testing without it could violate terms or laws. The tester should add the service as out-of-scope until permission is obtained.

Answer

Proceed with testing but use only passive techniques on the gateway

Answer

Test the gateway without informing the client to avoid delays

Answer

Include the payment gateway in scope because it is part of the application

Question 6

Which of the following penetration testing standards includes detailed guidelines for pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?

Accepted Answer

PTES. PTES (Penetration Testing Execution Standard) covers the entire testing lifecycle from pre-engagement to reporting.

Answer

OSSTMM

Answer

OWASP Testing Guide

Answer

NIST SP 800-115

Question 7

A company hires a penetration testing firm to simulate the tactics, techniques, and procedures of a real adversary. The engagement includes attempting to achieve specific objectives without being detected. This type of engagement is best described as:

Accepted Answer

Red team exercise. A red team exercise is an adversary simulation that aims to test detection and response capabilities.

Answer

Network penetration test

Answer

Web application penetration test

Answer

Social engineering engagement

Question 8

During pre-engagement, a client insists that the penetration testers sign a non-disclosure agreement (NDA). However, the client refuses to provide a 'get-out-of-jail' letter. What risk does this pose to the penetration testers?

Accepted Answer

Potential legal liability if the client or third parties perceive the testing as malicious. Without a 'get-out-of-jail' letter (also known as a authorization letter or testing waiver), the penetration testers have no documented legal authorization to perform the agreed-upon attacks. If the client or a third party (e.g., an ISP, law enforcement, or a security monitoring service) detects the test traffic and interprets it as malicious, the testers could face criminal charges or civil lawsuits for unauthorized access, even if the NDA is in place. The NDA only protects confidentiality, not the legality of the actions.

Answer

Increased risk of data breach

Answer

Higher likelihood of false positives

Answer

Inability to use certain tools

Question 9

A penetration tester is contracted to perform a grey box test of a company's internal network. The client provides a VPN account for remote access but does not disclose that the account has been used by a former employee. The tester connects and is immediately locked out. Which pre-engagement document should have addressed this scenario?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) should specify the accounts and credentials provided, including any limitations or known issues.

Answer

Emergency contact list

Answer

Data handling agreement

Answer

Statement of Work (SOW)

Question 10

Which of the following best describes the primary purpose of a 'get-out-of-jail' letter in a penetration testing engagement?

Accepted Answer

To authorize the tester to bypass security controls without legal repercussions. The get-out-of-jail letter provides legal authorization and protects the tester if their actions are detected as malicious.

Answer

To provide emergency contact information

Answer

To outline the rules of engagement

Answer

To ensure the tester does not steal data

Question 11

A penetration tester is scoping a web application penetration test. The client wants to include a third-party API that processes payments. Which TWO are appropriate considerations?

Accepted Answer

Obtain written permission from the third-party provider before testing. Testing a third-party API without explicit written permission violates legal and ethical boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). Penetration testers must obtain explicit authorization from the API provider to avoid liability and ensure the test is conducted within agreed-upon boundaries.

Answer

Assume the API is secure because it is a well-known provider

Answer

Test only the client's code and ignore the API entirely

Answer

Include the API in scope without permission because it is critical to the application

Question 12

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

Question 13

A company is planning a social engineering engagement. Which TWO items should be included in the pre-engagement documentation?

Accepted Answer

Emergency contact list. Pre-engagement documentation should include the rules of engagement (RoE) and emergency contacts to handle incidents during social engineering.

Answer

List of all employee passwords

Answer

Network topology diagrams

Answer

Source code of all applications

Question 14

A penetration tester is about to start an engagement. Which document outlines the IP ranges that are in scope, the testing window, and the emergency stop criteria?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) specify technical and procedural boundaries for the test.

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Answer

Get-out-of-jail letter

Question 15

During an external penetration test, the tester discovers that a critical web application is hosted on a third-party cloud provider. The SOW did not mention this provider. What should the tester do before proceeding with testing against that provider's infrastructure?

Accepted Answer

Obtain written authorization from the third-party provider. Testing third-party services requires explicit permission from the provider to avoid legal and contractual issues.

Answer

Scan only the IP addresses that resolve to the client's domain

Answer

Continue testing as long as the target is in scope

Answer

Ignore the web application and test only on-premises assets