Planning & Scoping Flashcards

A penetration tester is hired by a subsidiary company. The parent company's systems are reachable from the subsidiary's network. Can the tester legally test the parent company's systems?

Answer: No, unless the parent company has also provided written authorization

Authorization to test must come from the entity that owns or is responsible for the systems; reachability from an authorized network does not constitute permission.

Which element of the master service agreement (MSA) is most directly relevant to managing liability during a penetration test?

Answer: Limitation of liability clauses

Limitation of liability clauses cap the financial exposure of both parties in the event that testing causes unintended damage or service disruption.

During scoping, the client mentions their environment includes operational technology (OT) and SCADA systems. What is the primary concern?

Answer: These systems may be safety-critical and could be permanently damaged by standard testing tools

OT/SCADA systems control physical processes and can be irreparably damaged by standard penetration testing tools, requiring specialized methodologies and extreme caution.

What is the significance of specifying IP address ranges versus domain names in a penetration test scope document?

Answer: IP ranges are more precise but domain names may resolve to shared hosting affecting third parties

Domain names may resolve to shared infrastructure used by multiple organizations, so testing based on IP ranges prevents inadvertent testing of third-party systems sharing the same host.

A client requests a 'purple team' exercise rather than a traditional penetration test. How does this affect the planning and scoping phase?

Answer: Scope must include collaboration protocols defining how red and blue teams will share information in real time

Purple team exercises require scoping to define information-sharing protocols, collaboration checkpoints, and how the red team's techniques will be communicated to the blue team for training purposes.

Why might a penetration tester recommend a phased approach when the client wants to test a very large environment?

Answer: To focus resources on highest-risk areas first and maintain manageable scope within each phase

Phased testing allows methodical coverage of large environments by prioritizing critical assets, keeping each phase's scope manageable, and allowing findings to inform subsequent phases.

Which of the following best describes the concept of 'threat modeling' during the planning phase of a penetration test?

Answer: Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization

Threat modeling during planning identifies who might attack the organization, their capabilities, and which attack paths are most realistic, helping focus the penetration test on relevant scenarios.