PenTest+ Planning & Scoping 3 — Questions and Answers
Question 1: Which type of penetration test provides the tester with full knowledge of the internal network architecture, source code, and credentials?
- Black-box
- Gray-box
- White-box (Correct answer)
- Red team
Correct answer: White-box
White-box testing provides complete transparency including network diagrams, credentials, and source code, simulating an insider threat or detailed audit.
Question 2: A penetration test scope document lists '192.168.1.0/24' as an in-scope target. During testing, the tester discovers a pivot to 10.10.0.0/16. What should they do?
- Immediately test the 10.10.0.0/16 range since it was discovered organically
- Stop testing and notify the client before proceeding into out-of-scope systems (Correct answer)
- Document it but continue testing without notifying the client
- Add the range to the scope document independently
Correct answer: Stop testing and notify the client before proceeding into out-of-scope systems
Accessing out-of-scope systems without authorization violates the rules of engagement and potentially the law; client notification and approval are required first.
Question 3: What does a 'get-out-of-jail-free letter' represent in the context of a penetration testing engagement?
- A waiver releasing the client from paying for the engagement
- Written authorization proving the tester has permission to conduct the assessment (Correct answer)
- A document granting immunity from reporting vulnerabilities
- A legal agreement preventing the client from suing the tester
Correct answer: Written authorization proving the tester has permission to conduct the assessment
A get-out-of-jail-free letter is written authorization from the client that a tester can present to law enforcement if questioned during the engagement.
Question 4: Which scoping activity helps identify systems that should be excluded from testing to prevent business disruption?
- Asset discovery
- Target profiling
- Fragility assessment (Correct answer)
- Threat modeling
Correct answer: Fragility assessment
Fragility assessment identifies systems like legacy equipment, medical devices, or ICS components that could be damaged by testing, warranting exclusion.
Question 5: A company hires a penetration testing firm to assess compliance with PCI DSS. How does this regulatory requirement affect the scope of the engagement?
- It has no effect on the technical scope
- It mandates specific targets, methodologies, and reporting formats (Correct answer)
- It allows the tester to skip the rules of engagement
- It requires testing all company assets regardless of card data involvement
Correct answer: It mandates specific targets, methodologies, and reporting formats
Compliance-driven engagements like PCI DSS specify which systems must be tested, what methodologies to follow, and how findings must be documented and reported.
Question 6: When establishing communication protocols in the rules of engagement, what critical information should be agreed upon in advance?
- The tester's home address
- Emergency contact procedures if testing causes an outage (Correct answer)
- The client's marketing budget
- The tester's hourly rate
Correct answer: Emergency contact procedures if testing causes an outage
Pre-agreed emergency contacts and escalation procedures ensure rapid response if testing accidentally causes system outages or service disruptions.
Question 7: What is the key difference between a vulnerability assessment and a penetration test in terms of scope?
- Vulnerability assessments test more systems than penetration tests
- Penetration tests identify vulnerabilities while vulnerability assessments exploit them
- Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact (Correct answer)
- There is no meaningful difference in scope between the two
Correct answer: Vulnerability assessments identify weaknesses; penetration tests actively exploit them to demonstrate impact
Vulnerability assessments catalog potential weaknesses without exploitation, while penetration tests go further by actively exploiting vulnerabilities to demonstrate real-world impact.
PenTest+ Planning & Scoping 3
Which type of penetration test provides the tester with full knowledge of the internal network architecture, source code, and credentials?