Planning & Scoping Flashcards

A penetration tester receives a statement of work that prohibits testing production systems during business hours. What type of constraint is this?

Answer: Environmental constraint

Environmental constraints define operational boundaries such as time windows, system availability, and business impact limitations.

Which document formally authorizes a penetration tester to perform security assessments and protects them from legal liability?

Answer: Rules of engagement

The rules of engagement (ROE) document formally authorizes testing activities and defines boundaries, providing legal protection for the tester.

A client wants a penetration test but is concerned about sensitive data exposure during the test. Which scoping consideration addresses this?

Answer: Establishing data handling procedures

Data handling procedures ensure that sensitive information encountered during testing is protected, stored securely, and not improperly disclosed.

When scoping a penetration test for a company that uses AWS infrastructure, what is the most important additional step compared to testing on-premises systems?

Answer: Obtain written permission from AWS

Cloud providers like AWS have their own penetration testing policies and require customers to obtain permission before testing cloud-hosted resources.

A penetration tester discovers a critical zero-day vulnerability during an engagement. What should they do first according to rules of engagement best practices?

Answer: Notify the client through the agreed-upon communication channel

The rules of engagement typically define escalation procedures for critical findings; notifying the client through agreed channels ensures proper handling.

What is the primary purpose of defining the target audience in a penetration test report?

Answer: To tailor technical depth and language to the reader's expertise

Understanding the target audience allows the report to be written at an appropriate technical level, making findings actionable for executives or technical staff.

During pre-engagement scoping, a client states 'test everything.' What should the penetration tester do?

Answer: Require the client to define a specific, documented scope

Vague scope definitions create legal and operational risk; the tester must work with the client to document specific targets, boundaries, and exclusions.