PT0-002 Planning and Scoping — Timed 30 Questions

Question 1

A penetration tester is hired to assess the security of a company's internal network. The tester is given full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge of the target environment, including credentials and documentation.

Answer

Black box

Answer

Grey box

Answer

Red team

Question 2

During a pre-engagement meeting, the client states that no testing is allowed on the wireless network or on any cloud-based services hosted by third parties. Which part of the engagement documentation would specify these restrictions?

Accepted Answer

Rules of engagement (RoE). The rules of engagement (RoE) define the scope, including what is allowed and not allowed, such as restrictions on wireless and cloud services.

Answer

Get-out-of-jail letter

Answer

Statement of work (SOW)

Answer

Non-disclosure agreement (NDA)

Question 3

A penetration testing company is contracted to perform a social engineering engagement. The client requests that only employees in the finance department be targeted. Which scoping consideration is most relevant?

Accepted Answer

Personnel scope. Personnel scope defines which individuals or groups are in-scope for social engineering testing.

Answer

Rules of engagement

Answer

Production vs. staging environments

Answer

Third-party services

Question 4

A penetration tester discovers evidence of ongoing criminal activity, such as a data breach by an internal employee, during a white box penetration test. The client's legal team has not provided specific instructions on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and contact the client's emergency contact. The tester should immediately stop testing and inform the client's emergency contact to handle the criminal activity appropriately.

Answer

Notify law enforcement directly

Answer

Continue testing and document the evidence for later reporting

Answer

Ignore the activity and proceed as planned

Question 5

Which penetration testing standard provides a structured methodology for conducting penetration tests, including pre-engagement, reconnaissance, and reporting phases?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) covers the entire testing lifecycle.

Answer

NIST SP 800-115

Answer

OWASP Testing Guide

Answer

OSSTMM

Question 6

A company wants to simulate a real-world attack scenario where the penetration tester has no prior knowledge of the environment and must act as an external threat actor. However, the tester is allowed to use social engineering to gain initial access. Which type of engagement is most appropriate?

Accepted Answer

Red team exercise. A red team exercise is a full-scope adversary simulation that can include social engineering and black box testing.

Answer

Network penetration test

Answer

Wireless penetration test

Answer

Web application penetration test

Question 7

A penetration tester is conducting a grey box test on a web application. During the test, the tester discovers that the application is hosted on a cloud infrastructure that belongs to a third-party provider. The client did not mention this provider in the scope. What is the best course of action regarding testing this infrastructure?

Accepted Answer

Stop testing the cloud infrastructure and notify the client. Testing third-party infrastructure without permission is illegal and violates the rules of engagement. The tester should stop testing that part and inform the client.

Answer

Add the cloud provider to the scope without notifying the client

Answer

Continue testing because the application is owned by the client

Answer

Obtain verbal permission from the cloud provider and proceed

Question 8

Which legal framework in the United States prohibits unauthorized access to computer systems and is commonly referenced in penetration testing authorization documents?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary U.S. law against unauthorized computer access.

Answer

HIPAA

Answer

GLBA

Answer

SOX

Question 9

A penetration tester is preparing a deliverable for a client. Which of the following should be included in the final report?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A standard penetration testing report includes an executive summary, technical findings, and remediation guidance.

Answer

The tester's personal notes and observations

Answer

Only the technical findings

Answer

Only the executive summary

Question 10

A penetration tester is planning a test that involves scanning for vulnerabilities across a large IP range. The client has provided a list of IPs that are in-scope, but the tester notices that some IPs belong to a third-party company hosting a client application. What should the tester do?

Accepted Answer

Exclude the third-party IPs and notify the client. The tester must ensure that all in-scope IPs are authorized. If an IP belongs to a third party, the tester needs written permission from that provider before testing.

Answer

Assume the client has permission and scan all IPs

Answer

Scan the IPs because they are on the client's list

Answer

Scan only the third-party IPs that respond to ping

Question 11

A penetration tester is conducting a wireless penetration test. The client's rules of engagement state that testing must not disrupt production services. During the test, the tester's de-authentication attack causes the company's guest Wi-Fi to go offline. What should the tester do?

Accepted Answer

Stop testing and follow the emergency stop procedure. According to the RoE, the tester must stop testing if there is an emergency or disruption. The tester should follow the emergency stop procedure and contact the client.

Answer

Ignore the issue and complete the test

Answer

Reduce the intensity of the attack

Answer

Continue testing because guest Wi-Fi is not critical

Question 12

Which of the following is the primary purpose of a get-out-of-jail letter in a penetration testing engagement?

Accepted Answer

To authorize the tester to perform testing activities and avoid prosecution. The get-out-of-jail letter provides legal authorization for the tester to perform activities that might otherwise be considered illegal, such as scanning or exploitation.

Answer

To protect the client from legal liability

Answer

To document emergency contacts

Answer

To outline the scope of the test

Question 13

A penetration testing company is scoping a test for a client. The client wants to ensure that testing does not impact production systems. Which TWO of the following are appropriate scoping considerations? (Select TWO.)

Accepted Answer

Testing on a staging environment. Testing on a staging environment is correct because it isolates the penetration test from production systems, ensuring no risk of data corruption, service disruption, or unintended exposure of sensitive production data. Staging environments replicate production configurations and data sets, allowing the tester to identify vulnerabilities without impacting live operations.

Answer

Including all third-party services

Answer

Allowing unlimited testing hours

Answer

Testing all IP addresses in the organization

Question 14

A penetration tester is preparing a post-engagement deliverable. Which THREE of the following should be included in the final report? (Select THREE.)

Accepted Answer

Remediation guidance. Remediation guidance (A) is a required component of a penetration testing final report because it provides actionable steps to fix identified vulnerabilities. Without remediation guidance, the report would lack practical value for the client's security team, as they need clear instructions on how to mitigate risks. This aligns with PT0-002 objectives for post-engagement deliverables.

Answer

Detailed log of every command executed

Answer

Tester's hourly billing breakdown

Question 15

Which TWO of the following are types of penetration testing based on the level of knowledge provided to the tester? (Select TWO.)

Accepted Answer

Black box. Black box and white box are two common types based on knowledge level; grey box is the third.

Answer

Social engineering

Answer

Network penetration test

Answer

Red team

Question 16

A penetration tester is hired to perform an assessment where the tester is provided with network diagrams, source code, and administrative credentials. Which type of penetration test is this?

Accepted Answer

White box. In a white box test, the tester has full knowledge of the environment, including credentials and documentation.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 17

Which document defines the IP ranges that are in scope, testing windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) is the formal document that defines the scope boundaries, including IP ranges, testing windows, and emergency stop criteria for a penetration test. It establishes the legal and procedural framework that both the tester and client must follow, ensuring all activities remain within agreed constraints. Without a signed RoE, any testing could be considered unauthorized, potentially leading to legal liability.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 18

A penetration tester is planning a social engineering engagement targeting employees of a client. The client requests that only non-managerial staff be tested. Which scoping consideration is most directly affected by this request?

Accepted Answer

Personnel scope. Personnel scope determines which individuals or groups are targeted in social engineering tests.

Answer

IP address range

Answer

Production vs. staging

Answer

Third-party services

Question 19

During a penetration test, the tester discovers evidence of an ongoing data breach that appears to involve criminal activity unrelated to the test scope. What is the tester's primary responsibility regarding this discovery?

Accepted Answer

Notify the client's emergency contact and follow the agreed-upon incident response procedures. The tester should follow the incident response plan and notify the client immediately, as handling criminal activity is a legal and ethical obligation.

Answer

Continue the test as planned and include the findings in the final report

Answer

Document the evidence and destroy it after the engagement to protect the client

Answer

Immediately stop testing and notify law enforcement without client approval

Question 20

A penetration tester is engaged to test a web application that uses a third-party payment gateway. The client has not obtained permission from the payment gateway provider. Which of the following is the best course of action?

Accepted Answer

Exclude the payment gateway from scope and notify the client that permission is required. Third-party services require explicit permission from the provider; testing without it could violate terms or laws. The tester should add the service as out-of-scope until permission is obtained.

Answer

Proceed with testing but use only passive techniques on the gateway

Answer

Test the gateway without informing the client to avoid delays

Answer

Include the payment gateway in scope because it is part of the application