PT0-002 Engagement Management Practice Test 5 — 15 Questions

Question 1

Which of the following is the primary purpose of a get-out-of-jail letter?

Accepted Answer

To provide legal authorization for the tester to perform the test. A get-out-of-jail letter provides authorization and protects the tester from legal liability when performing authorized tests.

Answer

To outline the deliverables

Answer

To establish a communication plan

Answer

To define the rules of engagement

Question 2

A client requests a penetration test that includes testing of both internal network devices and a public-facing web application. The tester is provided with a VPN account for internal access but no credentials for the web application. Which type of penetration test is this?

Accepted Answer

Grey box. Grey box testing involves partial knowledge; the tester has internal network access but not web app credentials.

Answer

White box

Answer

Red team

Answer

Black box

Question 3

During a penetration test, the tester discovers evidence of an ongoing criminal activity, such as unauthorized data exfiltration by an insider. The client's legal team has not provided specific guidance on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and report the finding to the client immediately. The correct option is D: stop testing and report the finding to the client immediately. In penetration testing, when evidence of ongoing criminal activity such as unauthorized data exfiltration by an insider is discovered and the client's legal team has not provided specific guidance, the tester's first duty is to halt testing and notify the client so their legal counsel can decide how to proceed, preserving evidence and avoiding interference with a potential investigation. Continuing testing (A) risks destroying evidence or tipping off the insider, and contacting law enforcement directly (B) bypasses the client's authority and could violate the engagement contract or legal privilege. Ignoring the finding (C) is unethical and potentially illegal, as it conceals known criminal activity rather than escalating it through the proper client channel.

Answer

Continue testing to gather more evidence

Answer

Contact law enforcement directly

Answer

Ignore the finding as it is out of scope

Question 4

A penetration tester is preparing a proposal for a client. The client wants a test that includes a detailed technical report with remediation steps and an executive summary for management. Which standard or framework is most commonly used to structure the testing process from pre-engagement through post-engagement?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) provides a comprehensive framework covering all phases from pre-engagement to post-engagement.

Answer

OWASP Testing Guide

Answer

OSSTMM

Answer

NIST SP 800-115

Question 5

A penetration tester is scoping a network penetration test for a client that uses multiple third-party services. Which TWO of the following are correct actions regarding third-party services? (Select TWO.)

Accepted Answer

Exclude third-party services from testing unless explicitly authorized. Option D is correct because third-party services are owned and operated by external providers, so they must be excluded from the engagement scope unless the client has explicitly authorized testing of them, typically through contractual agreements or written consent. Option E is correct because testing a third-party provider's infrastructure without that provider's written permission is unauthorized access, so the tester must obtain explicit written authorization from each provider before any testing occurs. Option A is wrong because including all third-party services without restriction would authorize testing of systems the client does not own or control, creating legal and contractual violations. Option B is wrong because assuming third-party services are automatically out of scope is not a valid scoping decision; they may be in scope if proper authorization exists. Option C is wrong because testing a third-party service without informing the provider is unauthorized and unethical, regardless of the client's request.

Answer

Include all third-party services in scope without restriction

Answer

Assume that third-party services are out of scope

Answer

Test third-party services without informing the provider

Question 6

A penetration testing company is planning a social engineering engagement for a client. The engagement includes phishing and physical tailgating. Which THREE of the following should be clearly defined in the Rules of Engagement? (Select THREE.)

Accepted Answer

The conditions under which the test must be stopped immediately. RoE should address personnel scope, emergency stop conditions, and specific techniques allowed; vulnerabilities and deliverables are part of SOW.

Answer

The format of the final report

Answer

The specific vulnerabilities to be exploited

Question 7

A penetration tester is hired to assess the security of a company's internal network. The client provides the tester with full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge and credentials, which matches the scenario.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 8

During the pre-engagement phase, a penetration tester and the client agree on the specific IP ranges to be tested, testing windows, and what constitutes an emergency stop condition. Which document typically contains these details?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) document is specifically designed to define the scope, authorization, and constraints of a penetration test, including target IP ranges, testing windows, and emergency stop conditions. This ensures both the tester and client have a clear, legally binding agreement on how the test will be conducted, preventing misunderstandings or unauthorized actions.

Answer

Non-Disclosure Agreement (NDA)

Answer

Get-out-of-jail letter

Answer

Statement of Work (SOW)

Question 9

Which penetration testing standard provides a step-by-step methodology from pre-engagement through post-engagement activities, including intelligence gathering, vulnerability analysis, and exploitation?

Accepted Answer

PTES. PTES (Penetration Testing Execution Standard) covers the entire lifecycle of a penetration test.

Answer

OSSTMM

Answer

OWASP Testing Guide

Answer

NIST SP 800-115

Question 10

A penetration tester is planning a red team exercise for a client. The client insists that the testing should not disrupt production systems and only target a replicated staging environment. However, the tester believes that testing the production environment is necessary for realistic adversary simulation. What is the MOST appropriate course of action?

Accepted Answer

Negotiate with the client to include some production systems, explaining the value, and document agreed scope. Option A is correct because the tester should negotiate and document any scope changes with the client, ensuring mutual agreement and authorization before including production systems. This respects the client's risk tolerance while addressing the tester's realism concerns through formal change control. Option B is wrong because testing production without explicit authorization is unethical and potentially illegal. Option C is wrong because canceling is premature when the scope can be renegotiated. Option D is wrong because extrapolating staging results to production is unreliable and does not provide a valid assessment of the production environment.

Answer

Proceed with testing the production environment despite the client's request to ensure realism

Answer

Cancel the engagement because the scope is too restrictive

Answer

Test the staging environment and then extrapolate results to production

Question 11

A penetration testing firm is scoping a network penetration test for a client. The client has provided a list of IP ranges and subnets. Which TWO of the following should the tester consider when defining the scope?

Accepted Answer

Identify any third-party hosted services within the provided IP ranges and obtain explicit permission. Scoping must distinguish in-scope vs out-of-scope assets and address third-party services that require permission.

Answer

All IP addresses owned by the client are in scope

Answer

Test all IP addresses regardless of ownership to ensure complete coverage

Answer

Include all subnets that are routable from the internet

Question 12

A penetration tester is preparing for a web application penetration test. The client application is hosted on a cloud platform that serves multiple tenants. Which THREE of the following are critical legal and scoping considerations?

Accepted Answer

Understand how the client's data privacy policies affect handling of any discovered data. Legal considerations include authorization from the cloud provider, handling sensitive data, and defining permissible testing methods.

Answer

Include a clause in the SOW that the tester is not liable for any data exposure

Answer

Test all tenant data to ensure comprehensive coverage

Question 13

Which TWO of the following are typical deliverables of a penetration test?

Accepted Answer

Technical findings and remediation guidance. Standard deliverables include an executive summary for management and technical findings for remediation.

Answer

User credentials for all accounts

Answer

Source code of the tested application

Answer

Video recording of the testing process

Question 14

A penetration tester discovers evidence of an ongoing criminal activity (e.g., data exfiltration by an insider) during a test. According to best practices and legal considerations, which THREE actions should the tester take?

Accepted Answer

Preserve all evidence and document findings for law enforcement. When discovering criminal activity, the tester should stop testing, notify the client contact, and preserve evidence for investigation.

Answer

Publicly disclose the finding on a vulnerability disclosure platform

Answer

Continue testing to gather more evidence

Question 15

In a red team exercise, the team wants to simulate a realistic adversary. Which TWO of the following are typically included in the scope of a red team engagement compared to a standard penetration test?

Accepted Answer

Physical security testing (e.g., tailgating, lock picking). Red team exercises often include physical and social engineering attacks, and may attempt to remain undetected for longer periods.

Answer

Extensive vulnerability scanning of all in-scope systems

Answer

Comprehensive compliance verification against standards

Answer

Detailed reporting of all vulnerabilities found