GPEN Pen Test Planning Practice Question
A client asks for an 'unannounced' penetration test to test their incident response team. What is the most important preparatory step before commencing this exercise?
⚠ Common exam trap
Candidates often prioritize notifying the IT department or security staff, forgetting that the ultimate authority to stop a potentially disruptive test must rest with executive leadership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain written authorization from a senior executive who can stop the test.
An unannounced test simulates a real-world breach, but it carries significant risk to business operations if the responders block legitimate internal traffic or if the testers are arrested by physical security. Ensuring that at least one senior decision-maker, such as the CISO, is aware of the test is vital. This provides a 'safe harbor' and a mechanism to immediately stop the test if it causes unintended consequences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure that the entire IT staff is informed of the test dates.
Why it's wrong here
Informing the entire IT staff defeats the purpose of an unannounced test, which is designed to assess the readiness of the response team under stress. If everyone knows, the realism of the simulation is compromised, and the team will not act as they would during a real incident.
- ✓
Obtain written authorization from a senior executive who can stop the test.
Why this is correct
Obtaining written authorization from a senior executive is a mandatory safety precaution for unannounced testing. It ensures that there is a senior point of contact who understands the nature of the activity and has the authority to intervene if the testing activity causes unexpected or critical system issues.
- ✗
Launch the test during a holiday weekend to minimize user disruption.
Why it's wrong here
Launching a test during a holiday weekend does not solve the risk of an unannounced test. The primary concern is not user disruption, but rather the potential for incident responders to react to the attack as if it were a genuine threat, potentially causing unnecessary service downtime.
- ✗
Use only low-impact passive scanning to avoid triggering alarms.
Why it's wrong here
The goal of an unannounced test is to trigger the incident response team. Using only passive scanning will not trigger the alerts necessary to assess the team's response capabilities. The test must be active and realistic to provide the intended value for the client's incident response training.
About these practice questions
One of 298 original GPEN practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.