eJPT Planning and Scoping 2

Question 1

A client asks you to test their web application but explicitly excludes the database server from scope. During testing, you discover a SQL injection that likely affects the database. What should you do?

Accepted Answer

Document the finding and immediately notify the client about the out-of-scope risk

Answer

When you discover a vulnerability that affects out-of-scope systems, you must stop and notify the client so they can decide how to proceed.

Question 2

What is the primary purpose of defining Rules of Engagement (RoE) in a penetration testing engagement?

Accepted Answer

To outline the legal, technical, and operational boundaries for the test

Answer

Rules of Engagement define the boundaries, permissions, and constraints under which the penetration test will be conducted.

Question 3

During scoping, a client wants to include a third-party SaaS platform they use. What must you verify before including it?

Accepted Answer

That the client has written authorization from the third-party vendor to test their platform

Answer

Third-party systems require explicit written authorization from their owners before they can be included in a penetration test scope.

Question 4

Which document type formally authorizes a penetration tester to perform activities that would otherwise be considered illegal?

Accepted Answer

Get-Out-of-Jail-Free letter / Authorization letter

Answer

A get-out-of-jail letter or authorization letter provides documented proof that the tester is legally authorized to conduct the engagement.

Question 5

What does 'threat modeling' during the planning phase of a pentest primarily help identify?

Accepted Answer

The likely attackers, their motivations, and the most relevant attack scenarios for the target

Answer

Threat modeling helps prioritize testing efforts by identifying realistic adversaries and the attack paths most relevant to the organization.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Planning and Scoping 2