GPEN Pen Test Planning Practice Question
You are planning a penetration test for a client that has a hybrid cloud environment. The client's security team wants to ensure that the test does not violate the shared responsibility model of their cloud provider. Which of the following should you do FIRST to align the test with the cloud provider's policies?
⚠ Common exam trap
The trap here is assuming that client authorization alone is sufficient for cloud testing, overlooking the provider's separate policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the cloud provider's acceptable use policy and penetration testing guidelines.
The first step is to review the cloud provider's penetration testing policies. These policies define what is allowed, what requires notification, and what is strictly prohibited. Aligning with them ensures the test is both effective and compliant, avoiding disruption to the client's cloud services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a jump box in the cloud to conduct testing from within the provider's network.
Why it's wrong here
Deploying a jump box is a tactical step, not a planning step. Before taking any action, you must understand the cloud provider's testing policies. Otherwise, even internal testing could breach the shared responsibility model and result in sanctions.
- ✗
Assume that the client's authorization covers all cloud resources since they pay for the service.
Why it's wrong here
Paying for a cloud service does not grant the right to test the provider's infrastructure or even all aspects of the client's own environment. The shared responsibility model means the provider is responsible for some layers, and testing those may be prohibited. Assuming coverage can lead to policy violations.
- ✗
Obtain written authorization from the client's CEO to test all cloud-hosted assets.
Why it's wrong here
Client authorization is necessary but not sufficient. The cloud provider's policies also apply because the client does not own the underlying infrastructure. Without checking the provider's rules, you might perform tests that violate the terms of service, leading to account termination or other penalties.
- ✓
Review the cloud provider's acceptable use policy and penetration testing guidelines.
Why this is correct
Cloud providers like AWS, Azure, and GCP have specific policies regarding penetration testing. Reviewing these first ensures that your planned activities are permitted and that you follow any required notification or approval processes. Ignoring these policies could result in account suspension or legal action, even if the client authorized the test.
About these practice questions
Courseiva writes every GPEN question from scratch — 298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.