PenTest+ Planning & Scoping 2

Question 1

A penetration tester receives a statement of work that prohibits testing production systems during business hours. What type of constraint is this?

Accepted Answer

Environmental constraint

Answer

Environmental constraints define operational boundaries such as time windows, system availability, and business impact limitations.

Question 2

Which document formally authorizes a penetration tester to perform security assessments and protects them from legal liability?

Accepted Answer

Rules of engagement

Answer

The rules of engagement (ROE) document formally authorizes testing activities and defines boundaries, providing legal protection for the tester.

Question 3

A client wants a penetration test but is concerned about sensitive data exposure during the test. Which scoping consideration addresses this?

Accepted Answer

Establishing data handling procedures

Answer

Data handling procedures ensure that sensitive information encountered during testing is protected, stored securely, and not improperly disclosed.

Question 4

When scoping a penetration test for a company that uses AWS infrastructure, what is the most important additional step compared to testing on-premises systems?

Accepted Answer

Obtain written permission from AWS

Answer

Cloud providers like AWS have their own penetration testing policies and require customers to obtain permission before testing cloud-hosted resources.

Question 5

A penetration tester discovers a critical zero-day vulnerability during an engagement. What should they do first according to rules of engagement best practices?

Accepted Answer

Notify the client through the agreed-upon communication channel

Answer

The rules of engagement typically define escalation procedures for critical findings; notifying the client through agreed channels ensures proper handling.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Planning & Scoping 2