CREST CREST Legal, Compliance & Professional Standards

Question 1

Under the US Computer Fraud and Abuse Act (CFAA), what is the primary legal requirement before conducting a penetration test?

Accepted Answer

Obtaining written authorization from the system owner

Answer

The CFAA prohibits unauthorized access to computer systems, so written authorization from the system owner is legally required before any penetration testing.

Question 2

What document formally defines the scope, objectives, timeline, and legal permissions for a penetration test engagement?

Accepted Answer

Statement of Work (SoW) / Rules of Engagement

Answer

The Statement of Work and Rules of Engagement document outlines all authorized activities, IP ranges, test windows, and escalation contacts for a penetration test.

Question 3

Which CREST code of conduct principle requires members to report discovered vulnerabilities responsibly and not exploit them beyond what is authorized?

Accepted Answer

Ethical behavior and integrity

Answer

CREST's ethical behavior and integrity principle prohibits members from exploiting vulnerabilities beyond authorized scope or for personal gain.

Question 4

In the US, which regulation specifically governs the privacy and security of protected health information (PHI) in electronic form?

Accepted Answer

HIPAA/HITECH

Answer

HIPAA (Health Insurance Portability and Accountability Act) and the HITECH Act govern security and privacy requirements for electronic protected health information (ePHI).

Question 5

What is the purpose of a Non-Disclosure Agreement (NDA) in a CREST penetration testing engagement?

Accepted Answer

To protect confidential client information discovered during testing

Answer

An NDA ensures that sensitive client information, systems data, and vulnerabilities discovered during testing remain confidential and are not disclosed to unauthorized parties.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST CREST Legal, Compliance & Professional Standards