PT0-002 Engagement Management Practice Test 3 — 15 Questions

Question 1

A penetration tester is engaged to perform a social engineering assessment targeting the sales department. The RoE specifies that testing is allowed only during business hours. Which of the following actions would be most appropriate when planning the engagement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch a vishing attack during normal business hours. Tailgating outside business hours would violate the RoE; the tester should design attacks that fit within the allowed times.

Answer

Deploy USB drop attacks at the office entrance over the weekend

Answer

Conduct a phishing campaign with emails sent at 2:00 AM

Answer

Perform a tailgating attempt at 7:00 PM after most employees have left

Question 2

Which document, often signed before a penetration test, protects the tester from legal liability if the tester's actions are perceived as malicious by third parties?

Accepted Answer

Get-out-of-jail letter. A get-out-of-jail letter (authorization letter) confirms that the tester has permission to conduct the test.

Answer

Statement of Work

Answer

Non-Disclosure Agreement

Answer

Rules of Engagement

Question 3

A penetration tester is planning a web application test. The client wants to minimize risk to production data. Which environment should the tester recommend for testing?

Accepted Answer

Staging environment with anonymized data. Testing in a staging environment reduces the risk of impacting live data and systems.

Answer

Development environment with live data

Answer

Production environment with a read-only database

Answer

Production environment with full access

Question 4

Which legal framework in the United States makes it a crime to access a computer system without authorization, and is a key consideration when obtaining permission for penetration testing?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary US law against unauthorized access.

Answer

SOX

Answer

HIPAA

Answer

GDPR

Question 5

Which of the following best describes the purpose of a vulnerability disclosure policy in the context of a penetration test?

Accepted Answer

To establish a process for reporting discovered vulnerabilities to the client and possibly to the public. A vulnerability disclosure policy outlines how vulnerabilities found during testing will be reported and remediated.

Answer

To list the assets that are out of scope

Answer

To define the rules of engagement for the test

Answer

To provide legal protection to the tester

Question 6

Which penetration testing standard provides a methodology that includes pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) is the only standard among the options that explicitly defines a full penetration testing methodology with the phases listed: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. PTES provides a structured, seven-phase framework designed specifically for penetration testers, making it the correct choice for this question.

Answer

OSSTMM

Answer

NIST SP 800-115

Answer

OWASP Testing Guide

Question 7

A penetration tester is scoping a test for a client that uses a SaaS application for customer relationship management. The client wants the tester to assess the application's security. What is the most important consideration regarding this SaaS application?

Accepted Answer

The tester should obtain explicit permission from the SaaS provider before testing. The tester must ensure that the SaaS provider's terms of service allow security testing and that permission is obtained.

Answer

The application is hosted on the cloud, so it is automatically in scope

Answer

The tester should only test the client's configuration of the SaaS application

Answer

The tester can test the application as long as the client provides administrative credentials

Question 8

Which of the following is typically included in the final deliverables of a penetration test?

Accepted Answer

Executive summary, technical findings, and remediation guidance. Standard deliverables include an executive summary, technical findings, and remediation guidance.

Answer

A list of all employee passwords

Answer

Network diagrams of the client's internal network

Answer

A copy of all data extracted during the test

Question 9

A penetration tester is planning a red team exercise for a client. Which TWO of the following should be included in the rules of engagement (RoE)?

Accepted Answer

Testing windows (allowed times for testing). Testing windows define the specific times during which penetration testing activities are permitted, ensuring that testing does not disrupt critical business operations. This is a standard component of the Rules of Engagement (RoE) as outlined in the PT0-002 exam objectives for planning and scoping.

Answer

The client's business goals

Answer

The tester's background check information

Answer

The tester's hourly rate

Question 10

A penetration tester is conducting a social engineering engagement targeting the finance department. Which THREE of the following actions are most appropriate to include in the scope of the engagement?

Accepted Answer

Making pretext phone calls (vishing) to obtain sensitive information. Social engineering can include phishing, vishing, and USB drops. Physical tailgating may be included but requires careful planning; however, it is often in scope. The question asks for three appropriate actions. Common social engineering vectors: phishing, vishing, and physical intrusion (tailgating). USB drops are also common. But we need three. The best three: phishing, vishing, and tailgating. USB drops are also valid but tailgating is more direct. I'll include phishing, vishing, and tailgating. Explanation: These are typical social engineering techniques.

Answer

Exploiting a SQL injection vulnerability in the finance web app

Answer

Performing a vulnerability scan on the finance network

Question 11

After completing a penetration test, the tester must handle test artifacts appropriately. Which TWO of the following are best practices for data handling and destruction?

Accepted Answer

Securely delete all test data after the engagement is complete. Best practices include securely erasing test data and returning any client data to the client.

Answer

Keep all test data indefinitely for future reference

Answer

Store test data in an unencrypted archive on the tester's laptop

Answer

Share test data with other clients for benchmarking

Question 12

A penetration tester is hired to perform a test with no prior knowledge of the target environment. The tester is given only the company name and must gather all necessary information from public sources. Which type of penetration test is this?

Accepted Answer

Black box. In a black box test, the tester has no prior knowledge or credentials, simulating an external attacker.

Answer

Grey box

Answer

Red team

Answer

White box

Question 13

During the pre-engagement phase, which document defines the IP ranges, test windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) document specifies technical constraints like IP ranges, timing, and stop conditions.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 14

A penetration tester is planning an engagement that includes testing a web application hosted on a third-party cloud provider. The client has provided credentials for the application but not for the underlying infrastructure. Which of the following should the tester do before proceeding?

Accepted Answer

Obtain written permission from the cloud provider. Third-party services require explicit permission from the provider to test; the tester must obtain written authorization.

Answer

Ignore the third-party aspect and test as usual

Answer

Ask the client to move the application to on-premises

Answer

Proceed with testing the application using the provided credentials

Question 15

The penetration tester identifies that a web application is hosted on a server that also contains sensitive customer data unrelated to the test. The SOW clearly states that only the web application is in scope. The tester accidentally accesses the customer data. What should the tester do immediately?

Accepted Answer

Report the incident to the client and stop testing. If out-of-scope data is accessed, the tester should stop, report, and follow the incident response plan without further investigation.

Answer

Delete the data and continue as planned

Answer

Continue testing and ignore the data

Answer

Analyze the data to find vulnerabilities