GPEN Pen Test Planning Practice Question
You are finalizing the Rules of Engagement (RoE) for a penetration test of a regional hospital network. The client's legal counsel requires that any testing activity be immediately suspended if a life-safety system is affected. Which element should you add to the RoE to satisfy this requirement?
⚠ Common exam trap
The trap here is assuming that restricting testing hours or adding legal language somehow provides the real-time halt authority that only a named emergency stop procedure delivers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A documented emergency stop procedure with named client contacts and a defined notification method.
An emergency stop procedure is the operational control that lets the hospital halt testing instantly when a life-safety system is at risk. It specifies authorized personnel, the notification channel, and the required acknowledgment, making the requirement enforceable and auditable. Scheduling limits, waivers, and reporting timelines all operate after or around the event rather than stopping it in real time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A liability waiver transferring all damages from the testing firm to the hospital.
Why it's wrong here
A liability waiver addresses financial responsibility after an incident, not the ability to stop testing the moment a life-safety system is touched. It is a legal instrument that shifts costs but gives no operational mechanism, contact list, or communication path, so it cannot satisfy counsel's demand for immediate suspension during active testing.
- ✗
A requirement that all findings be delivered in a written report within thirty days of testing.
Why it's wrong here
A reporting deadline governs post-engagement documentation and has no bearing on controlling activity while testers are on the network. It does nothing to prevent or halt impact to life-safety systems, provides no authority structure, and leaves the immediate-suspension requirement entirely unmet despite being a useful deliverable expectation.
- ✓
A documented emergency stop procedure with named client contacts and a defined notification method.
Why this is correct
An emergency stop procedure names the exact client personnel authorized to halt testing and defines how that order is communicated, which is what counsel needs to guarantee immediate suspension around life-safety systems. It converts an abstract requirement into an executable, auditable action with accountability, and it removes ambiguity about who can stop the engagement and how the tester must confirm the halt.
- ✗
An expanded scan window that limits intrusive testing to overnight hours only.
Why it's wrong here
Restricting testing to overnight hours reduces exposure to clinical staff, but it does not guarantee an immediate stop when a life-safety system is affected mid-scan. A time window is a scheduling control, not a kill switch, and it fails to identify who can order a halt or how that order is verified and acknowledged during the engagement.
About these practice questions
One of 298 original GPEN practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.