eJPT Planning and Scoping 2 — Questions and Answers
Question 1: A client asks you to test their web application but explicitly excludes the database server from scope. During testing, you discover a SQL injection that likely affects the database. What should you do?
- Exploit the SQL injection to demonstrate its severity
- Document the finding and immediately notify the client about the out-of-scope risk (Correct answer)
- Ignore it since the database is out of scope
- Pivot to the database server to gather evidence
Correct answer: Document the finding and immediately notify the client about the out-of-scope risk
When you discover a vulnerability that affects out-of-scope systems, you must stop and notify the client so they can decide how to proceed.
Question 2: What is the primary purpose of defining Rules of Engagement (RoE) in a penetration testing engagement?
- To establish billing rates for the engagement
- To outline the legal, technical, and operational boundaries for the test (Correct answer)
- To specify which vulnerabilities are most important to find
- To determine the reporting format
Correct answer: To outline the legal, technical, and operational boundaries for the test
Rules of Engagement define the boundaries, permissions, and constraints under which the penetration test will be conducted.
Question 3: During scoping, a client wants to include a third-party SaaS platform they use. What must you verify before including it?
- That the SaaS platform uses the latest software versions
- That the client has written authorization from the third-party vendor to test their platform (Correct answer)
- That the SaaS platform has known vulnerabilities
- That the platform is hosted on-premises
Correct answer: That the client has written authorization from the third-party vendor to test their platform
Third-party systems require explicit written authorization from their owners before they can be included in a penetration test scope.
Question 4: Which document type formally authorizes a penetration tester to perform activities that would otherwise be considered illegal?
- Non-Disclosure Agreement (NDA)
- Statement of Work (SOW)
- Get-Out-of-Jail-Free letter / Authorization letter (Correct answer)
- Penetration Testing Report
Correct answer: Get-Out-of-Jail-Free letter / Authorization letter
A get-out-of-jail letter or authorization letter provides documented proof that the tester is legally authorized to conduct the engagement.
Question 5: What does 'threat modeling' during the planning phase of a pentest primarily help identify?
- The most profitable attack vectors to include in the report
- The likely attackers, their motivations, and the most relevant attack scenarios for the target (Correct answer)
- The specific tools to use during exploitation
- The total cost of the engagement
Correct answer: The likely attackers, their motivations, and the most relevant attack scenarios for the target
Threat modeling helps prioritize testing efforts by identifying realistic adversaries and the attack paths most relevant to the organization.
Question 6: A penetration tester is conducting a black-box assessment. Which of the following BEST describes this approach?
- The tester has full knowledge of the target environment including source code and architecture
- The tester has partial knowledge such as IP ranges but no credentials
- The tester simulates an external attacker with no prior knowledge of the target (Correct answer)
- The tester works alongside the internal security team with full system access
Correct answer: The tester simulates an external attacker with no prior knowledge of the target
Black-box testing simulates an external attacker who has no prior knowledge of the target environment.
Question 7: When establishing scope, why is it important to specify the exact IP ranges and domain names in writing?
- To help the tester prioritize which systems to attack first
- To prevent accidental testing of systems outside the authorized scope and protect the tester legally (Correct answer)
- To ensure the client pays for all systems tested
- To allow the tester to use automated tools without restriction
Correct answer: To prevent accidental testing of systems outside the authorized scope and protect the tester legally
Precisely defined scope in writing protects both the client and tester by clearly establishing which systems are authorized for testing.
eJPT Planning and Scoping 2
A client asks you to test their web application but explicitly excludes the database server from scope.
During testing, you discover a SQL injection that likely affects the database.
What should you do?