PT0-002 Router R1 Cannot Reach R3 Practice Questions

Explanation: Penetration testers must ensure that all relevant parties are aware of testing to avoid false alarms and legal issues. If the MSSP is not informed, they may treat test traffic as malicious and cause unnecessary incident response actions, potentially harming the relationship. The best practice is to include the MSSP in the scoping process or at minimum ensure that the client coordinates with them.

Explanation: The script uses hping3 to send a TCP SYN packet (-S flag) to port 22 on each IP in a subnet. It then checks for a SYN-ACK response (flags=SA) to determine if the port is open. This is a SYN scan, which is a common stealth scan technique because it does not complete the TCP handshake. Port 22 is typically SSH. So the script is scanning a /24 subnet for hosts with SSH port open. It is not a vulnerability scanner (no payload beyond SYN), not a ping sweep (uses TCP, not ICMP), and not a full connection scan (does not send ACK to complete handshake).

Explanation: NAC solutions can automatically block unknown devices. To prevent the tester's machine from being blocked, the best approach is to have the client whitelist the tester's MAC address or IP address in the NAC solution before testing begins. This ensures that the tester's activities are not disrupted and that the test can proceed smoothly. Not using the internal network would defeat the purpose of an internal test. The tester should not propose bypassing NAC as a goal of the test (that would be a scope creep), and asking the client to disable NAC globally would be overly disruptive and unrealistic.

Explanation: Because the APIs are critical and cannot tolerate downtime, the rules of engagement should specify that only non-intrusive scanning and testing techniques (e.g., passive analysis or carefully controlled requests) be used on the API endpoints to minimize risk of disruption. Excluding all endpoints would limit the test, and coordinating with vendors may be helpful but is secondary to defining the testing approach.

Explanation: For accurate segmentation testing, the tester needs a clear understanding of the network boundaries. A network segmentation diagram is crucial because it shows which systems are in the cardholder data environment (CDE) and which are out-of-scope. This allows the tester to attempt to reach the CDE from out-of-scope segments and verify that segmentation controls are effective. Simply having network access to both sets of systems (A) is insufficient without knowing boundaries. Agreeing not to scan out-of-scope IPs (C) might conflict with the need to test segmentation. Written authorization (D) is important but not the most specific requirement for segmentation testing.