eJPT Planning and Scoping 4 — Questions and Answers
Question 1: A penetration tester discovers a critical Remote Code Execution vulnerability during business hours. Per the Rules of Engagement, all critical findings must be immediately reported. What should the tester do?
- Continue testing to find more vulnerabilities before reporting
- Immediately notify the client's designated contact per the agreed escalation procedure (Correct answer)
- Post the finding to the final report and wait until the engagement ends
- Attempt to exploit the vulnerability further to demonstrate full impact
Correct answer: Immediately notify the client's designated contact per the agreed escalation procedure
Critical findings with immediate business risk must be escalated to the client right away, as defined in the Rules of Engagement.
Question 2: What is the significance of an NDA (Non-Disclosure Agreement) in a penetration testing engagement?
- It grants legal permission to conduct the penetration test
- It prohibits the tester from disclosing confidential client information discovered during the engagement (Correct answer)
- It defines the payment terms for the engagement
- It specifies which tools the tester is allowed to use
Correct answer: It prohibits the tester from disclosing confidential client information discovered during the engagement
An NDA protects the client by legally preventing the tester from disclosing sensitive information discovered during the assessment.
Question 3: Which of the following is the MOST important consideration when determining whether to include production systems in the scope of a penetration test?
- Whether the systems are running the latest patches
- The potential business impact if testing causes downtime or data corruption (Correct answer)
- Whether the systems have backups configured
- The number of users accessing the systems daily
Correct answer: The potential business impact if testing causes downtime or data corruption
Production systems carry the highest risk during testing because disruption can cause real business impact, making careful scoping and timing critical.
Question 4: A client requests a penetration test but does not want the IT team informed. What type of engagement is this?
- Gray-box assessment
- Double-blind or blind test (Correct answer)
- White-box assessment
- Red team engagement with insider knowledge
Correct answer: Double-blind or blind test
A double-blind test means the internal IT/security team is not informed, testing their detection and response capabilities as well as finding vulnerabilities.
Question 5: Before beginning active scanning in a penetration test, what must a tester always verify?
- That all scanning tools are updated to the latest version
- That the target IP addresses or hostnames match those authorized in the scope document (Correct answer)
- That the client has disabled their firewall for the test
- That the tester has root access to the target systems
Correct answer: That the target IP addresses or hostnames match those authorized in the scope document
Verifying target addresses against the authorized scope prevents accidental testing of unauthorized systems, which could have legal consequences.
Question 6: What is 'scope creep' in a penetration testing engagement?
- When the tester finds more vulnerabilities than initially expected
- When testing activities expand beyond the originally agreed-upon boundaries without formal authorization (Correct answer)
- When the client requests additional reporting after the engagement
- When automated tools scan faster than planned
Correct answer: When testing activities expand beyond the originally agreed-upon boundaries without formal authorization
Scope creep occurs when the testing expands beyond agreed boundaries, which requires a formal change order or addendum to the contract.
Question 7: Which phase of a penetration test involves gathering information about the target without sending any packets to the target systems?
- Active reconnaissance
- Exploitation
- Passive reconnaissance (Correct answer)
- Post-exploitation
Correct answer: Passive reconnaissance
Passive reconnaissance collects information from public sources (OSINT) without directly interacting with the target systems.
eJPT Planning and Scoping 4
A penetration tester discovers a critical Remote Code Execution vulnerability during business hours.
Per the Rules of Engagement, all critical findings must be immediately reported.
What should the tester do?