PenTest+ Planning & Scoping 4

Question 1

During scoping, a client requests a penetration test of their mobile banking application. Which additional consideration is unique to mobile application testing?

Accepted Answer

App store policies and device OS versions must be considered in scope definition

Answer

Mobile app testing scope must account for different OS versions (iOS/Android), device types, and app store distribution channels that affect the attack surface.

Question 2

A red team exercise differs from a standard penetration test primarily in that it:

Accepted Answer

Simulates a targeted, realistic adversary with defined objectives over an extended period

Answer

Red team exercises emulate advanced persistent threat actors pursuing specific objectives (e.g., data exfiltration) over weeks or months, unlike point-in-time penetration tests.

Question 3

Which of the following is a key reason to include third-party service providers in the scoping discussion of a penetration test?

Accepted Answer

Testing systems owned by third parties may require separate authorization

Answer

Third-party owned infrastructure (SaaS, cloud providers, MSPs) requires separate authorization from those providers before testing, even if the client uses the service.

Question 4

What is the purpose of defining 'success criteria' during the planning phase of a penetration test?

Accepted Answer

To establish measurable objectives that determine when the engagement goals are met

Answer

Success criteria provide clear, agreed-upon objectives (e.g., 'obtain domain admin credentials' or 'access PII database') so both parties know what constitutes a completed engagement.

Question 5

A penetration tester is asked to perform a physical security assessment as part of a broader engagement. Which additional authorization consideration applies?

Accepted Answer

Written permission specific to physical access attempts must be obtained

Answer

Physical penetration testing involves entering facilities or bypassing physical controls, which requires explicit written authorization separate from network testing permission.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Planning & Scoping 4