PT0-002 Engagement Management Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are types of penetration testing based on the level of knowledge provided to the tester? (Select TWO.)

Accepted Answer

Black box. Black box and white box are two common types based on knowledge level; grey box is the third.

Answer

Social engineering

Answer

Network penetration test

Answer

Red team

Question 2

A penetration tester is hired to perform an assessment where the tester is provided with network diagrams, source code, and administrative credentials. Which type of penetration test is this?

Accepted Answer

White box. In a white box test, the tester has full knowledge of the environment, including credentials and documentation.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 3

A penetration tester is planning a social engineering engagement targeting employees of a client. The client requests that only non-managerial staff be tested. Which scoping consideration is most directly affected by this request?

Accepted Answer

Personnel scope. Personnel scope determines which individuals or groups are targeted in social engineering tests.

Answer

IP address range

Answer

Production vs. staging

Answer

Third-party services

Question 4

During a penetration test, the tester discovers evidence of an ongoing data breach that appears to involve criminal activity unrelated to the test scope. What is the tester's primary responsibility regarding this discovery?

Accepted Answer

Notify the client's emergency contact and follow the agreed-upon incident response procedures. The tester should follow the incident response plan and notify the client immediately, as handling criminal activity is a legal and ethical obligation.

Answer

Continue the test as planned and include the findings in the final report

Answer

Document the evidence and destroy it after the engagement to protect the client

Answer

Immediately stop testing and notify law enforcement without client approval

Question 5

A penetration tester is engaged to test a web application that uses a third-party payment gateway. The client has not obtained permission from the payment gateway provider. Which of the following is the best course of action?

Accepted Answer

Exclude the payment gateway from scope and notify the client that permission is required. Third-party services require explicit permission from the provider; testing without it could violate terms or laws. The tester should add the service as out-of-scope until permission is obtained.

Answer

Proceed with testing but use only passive techniques on the gateway

Answer

Test the gateway without informing the client to avoid delays

Answer

Include the payment gateway in scope because it is part of the application

Question 6

Which of the following penetration testing standards includes detailed guidelines for pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?

Accepted Answer

PTES. PTES (Penetration Testing Execution Standard) covers the entire testing lifecycle from pre-engagement to reporting.

Answer

OSSTMM

Answer

OWASP Testing Guide

Answer

NIST SP 800-115

Question 7

A company hires a penetration testing firm to simulate the tactics, techniques, and procedures of a real adversary. The engagement includes attempting to achieve specific objectives without being detected. This type of engagement is best described as:

Accepted Answer

Red team exercise. A red team exercise is an adversary simulation that aims to test detection and response capabilities.

Answer

Network penetration test

Answer

Web application penetration test

Answer

Social engineering engagement

Question 8

During pre-engagement, a client insists that the penetration testers sign a non-disclosure agreement (NDA). However, the client refuses to provide a 'get-out-of-jail' letter. What risk does this pose to the penetration testers?

Accepted Answer

Potential legal liability if the client or third parties perceive the testing as malicious. Without a 'get-out-of-jail' letter (also known as a authorization letter or testing waiver), the penetration testers have no documented legal authorization to perform the agreed-upon attacks. If the client or a third party (e.g., an ISP, law enforcement, or a security monitoring service) detects the test traffic and interprets it as malicious, the testers could face criminal charges or civil lawsuits for unauthorized access, even if the NDA is in place. The NDA only protects confidentiality, not the legality of the actions.

Answer

Increased risk of data breach

Answer

Higher likelihood of false positives

Answer

Inability to use certain tools

Question 9

A penetration tester is contracted to perform a grey box test of a company's internal network. The client provides a VPN account for remote access but does not disclose that the account has been used by a former employee. The tester connects and is immediately locked out. Which pre-engagement document should have addressed this scenario?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) should specify the accounts and credentials provided, including any limitations or known issues.

Answer

Emergency contact list

Answer

Data handling agreement

Answer

Statement of Work (SOW)

Question 10

After completing a penetration test, the tester must deliver a report. According to standard practices, which of the following is a required component of the deliverables?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A typical penetration test report includes an executive summary, technical findings, and remediation guidance.

Answer

Remediation guidance and a list of all tested IPs

Answer

Only technical findings and proof-of-concept code

Answer

Executive summary and raw data logs

Question 11

A penetration tester is performing a wireless penetration test. The RoE states that testing is only allowed between 8 PM and 6 AM. At 7:30 PM, the tester begins active scanning. At 8:15 PM, a client employee calls emergency contact to report suspicious activity. According to the RoE, which of the following is the most likely reason for the call?

Accepted Answer

The tester started testing outside the agreed time window. The RoE explicitly restricts testing to 8 PM – 6 AM, but the tester began active scanning at 7:30 PM — 30 minutes before the allowed window. Active scanning generates detectable wireless traffic (probe requests, deauth frames, association attempts) that a client employee could notice and report. The call at 8:15 PM is most likely a delayed report of the activity that started at 7:30 PM, outside the agreed window.

Answer

The tester used an unauthorized tool

Answer

The tester targeted an out-of-scope access point

Answer

The tester exceeded the allowed signal strength

Question 12

A penetration tester is scoping a web application penetration test. The client wants to include a third-party API that processes payments. Which TWO are appropriate considerations?

Accepted Answer

Obtain written permission from the third-party provider before testing. Option C is correct because testing a third-party payment API without the provider's explicit written authorization is unauthorized access, regardless of the client's ownership of the application; the tester must obtain permission from the API provider (or verify the client has it) before sending any test traffic to that API. Option E is correct because if the provider does not grant permission, the API must be formally documented as out-of-scope in the rules of engagement and scope statement, so the tester avoids any unauthorized testing while still delivering a clear, defensible report. Option A is wrong because assuming a well-known provider is secure is an unfounded trust assumption that ignores the need for verification and authorization. Option B is wrong because ignoring the API entirely may leave critical integration risks (authentication, data flow, error handling) untested and unassessed. Option D is wrong because criticality to the application never overrides the legal and ethical requirement for explicit permission before testing third-party systems.

Answer

Assume the API is secure because it is a well-known provider

Answer

Test only the client's code and ignore the API entirely

Answer

Include the API in scope without permission because it is critical to the application

Question 13

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

Question 14

A company is planning a social engineering engagement. Which TWO items should be included in the pre-engagement documentation?

Accepted Answer

Emergency contact list. Pre-engagement documentation should include the rules of engagement (RoE) and emergency contacts to handle incidents during social engineering.

Answer

List of all employee passwords

Answer

Network topology diagrams

Answer

Source code of all applications

Question 15

Which type of penetration test provides the tester with full knowledge of the target environment, including network diagrams, source code, and administrative credentials?

Accepted Answer

White box. A white box penetration test gives the tester full knowledge of the target, including network diagrams, source code, and administrative credentials. This full-disclosure approach lets the tester focus on finding vulnerabilities efficiently rather than spending time on reconnaissance.

Answer

Grey box

Answer

Black box

Answer

Red team