GPEN Pen Test Planning Practice Question
You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)
⚠ Common exam trap
The trap here is focusing on technical controls or tool restrictions instead of the scheduling and communication mechanisms that directly prevent operational disruption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A list of emergency contacts for both the penetration testing team and the client's operations staff.
The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A clause allowing the tester to disable antivirus software on the mainframe during testing.
Why it's wrong here
Disabling antivirus on a production mainframe is highly risky and unlikely to be permitted. It does not address batch processing concerns and could introduce security vulnerabilities. The RoE should focus on scheduling and communication rather than disabling protective controls.
- ✗
A provision to use only automated scanning tools to minimize manual intervention.
Why it's wrong here
Automated scanning can still disrupt batch processing if run at the wrong time, and it may not be suitable for mainframe environments. The choice of tools does not mitigate the risk of interfering with scheduled jobs. The key is to control when testing occurs and ensure rapid communication, not to restrict tool usage.
- ✓
A list of emergency contacts for both the penetration testing team and the client's operations staff.
Why this is correct
Emergency contacts are essential for rapid communication if testing inadvertently affects batch processing. If a test causes an outage or performance degradation, both parties need to coordinate immediately to mitigate impact. The RoE should include names, phone numbers, and escalation procedures to ensure a swift response.
- ✓
A detailed schedule of allowed testing windows that avoid batch processing periods.
Why this is correct
Defining allowed testing windows is critical to prevent interference with batch jobs. Batch processing often runs during specific hours and consumes significant resources; testing during those times could cause delays or failures. The RoE should explicitly state when testing is permitted and when it must pause, ensuring the client's operations remain stable.
- ✗
A requirement that all testing be conducted from an external IP address.
Why it's wrong here
External testing may not be relevant or sufficient for a mainframe environment, and it does not directly address the risk of disrupting batch processing. The source of testing traffic is less important than when and how it is conducted. This requirement could even limit the effectiveness of the test if internal access is needed.
About these practice questions
This GPEN question is part of Courseiva's 298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.