CREST CREST Legal, Compliance & Professional Standards

Question 1

Under the US Computer Fraud and Abuse Act (CFAA), what is the primary legal requirement before conducting a penetration test?

Accepted Answer

Obtaining written authorization from the system owner

Answer

Filing a report with the FBI

Answer

Registering with a government agency

Answer

Completing a CREST certification

Question 2

What document formally defines the scope, objectives, timeline, and legal permissions for a penetration test engagement?

Accepted Answer

Statement of Work (SoW) / Rules of Engagement

Answer

NDA

Answer

Vulnerability disclosure policy

Answer

Security audit report

Question 3

Which CREST code of conduct principle requires members to report discovered vulnerabilities responsibly and not exploit them beyond what is authorized?

Accepted Answer

Ethical behavior and integrity

Answer

Commercial competence

Answer

Technical knowledge

Answer

Financial accountability

Question 4

In the US, which regulation specifically governs the privacy and security of protected health information (PHI) in electronic form?

Accepted Answer

HIPAA/HITECH

Answer

SOX

Answer

GLBA

Answer

FERPA

Question 5

What is the purpose of a Non-Disclosure Agreement (NDA) in a CREST penetration testing engagement?

Accepted Answer

To protect confidential client information discovered during testing

Answer

To legally authorize testing activities

Answer

To define the payment terms

Answer

To register the engagement with CREST

Question 6

Which US federal law requires financial institutions to implement safeguards to protect customer information and notify customers of privacy practices?

Accepted Answer

GLBA (Gramm-Leach-Bliley Act)

Answer

SOX

Answer

FERPA

Answer

CAN-SPAM Act