Planning & Scoping Flashcards

During scoping, a client requests a penetration test of their mobile banking application. Which additional consideration is unique to mobile application testing?

Answer: App store policies and device OS versions must be considered in scope definition

Mobile app testing scope must account for different OS versions (iOS/Android), device types, and app store distribution channels that affect the attack surface.

A red team exercise differs from a standard penetration test primarily in that it:

Answer: Simulates a targeted, realistic adversary with defined objectives over an extended period

Red team exercises emulate advanced persistent threat actors pursuing specific objectives (e.g., data exfiltration) over weeks or months, unlike point-in-time penetration tests.

Which of the following is a key reason to include third-party service providers in the scoping discussion of a penetration test?

Answer: Testing systems owned by third parties may require separate authorization

Third-party owned infrastructure (SaaS, cloud providers, MSPs) requires separate authorization from those providers before testing, even if the client uses the service.

What is the purpose of defining 'success criteria' during the planning phase of a penetration test?

Answer: To establish measurable objectives that determine when the engagement goals are met

Success criteria provide clear, agreed-upon objectives (e.g., 'obtain domain admin credentials' or 'access PII database') so both parties know what constitutes a completed engagement.

A penetration tester is asked to perform a physical security assessment as part of a broader engagement. Which additional authorization consideration applies?

Answer: Written permission specific to physical access attempts must be obtained

Physical penetration testing involves entering facilities or bypassing physical controls, which requires explicit written authorization separate from network testing permission.

When assessing scope for a web application penetration test, why is it important to identify the application's technology stack in advance?

Answer: Different technologies have unique vulnerabilities and require specific testing methodologies

Understanding the technology stack (e.g., PHP, Java, .NET, frameworks) helps identify relevant vulnerability classes and ensures appropriate testing tools and techniques are included in scope.

What is 'scope creep' in the context of a penetration testing engagement, and why is it problematic?

Answer: Unauthorized expansion of testing beyond the agreed boundaries

Scope creep occurs when testing expands beyond documented boundaries without authorization, creating legal exposure and potentially impacting systems the client did not intend to include.