PenTest+ Planning & Scoping 5

Question 1

A penetration tester is hired by a subsidiary company. The parent company's systems are reachable from the subsidiary's network. Can the tester legally test the parent company's systems?

Accepted Answer

No, unless the parent company has also provided written authorization

Answer

Authorization to test must come from the entity that owns or is responsible for the systems; reachability from an authorized network does not constitute permission.

Question 2

Which element of the master service agreement (MSA) is most directly relevant to managing liability during a penetration test?

Accepted Answer

Limitation of liability clauses

Answer

Limitation of liability clauses cap the financial exposure of both parties in the event that testing causes unintended damage or service disruption.

Question 3

During scoping, the client mentions their environment includes operational technology (OT) and SCADA systems. What is the primary concern?

Accepted Answer

These systems may be safety-critical and could be permanently damaged by standard testing tools

Answer

OT/SCADA systems control physical processes and can be irreparably damaged by standard penetration testing tools, requiring specialized methodologies and extreme caution.

Question 4

What is the significance of specifying IP address ranges versus domain names in a penetration test scope document?

Accepted Answer

IP ranges are more precise but domain names may resolve to shared hosting affecting third parties

Answer

Domain names may resolve to shared infrastructure used by multiple organizations, so testing based on IP ranges prevents inadvertent testing of third-party systems sharing the same host.

Question 5

A client requests a 'purple team' exercise rather than a traditional penetration test. How does this affect the planning and scoping phase?

Accepted Answer

Scope must include collaboration protocols defining how red and blue teams will share information in real time

Answer

Purple team exercises require scoping to define information-sharing protocols, collaboration checkpoints, and how the red team's techniques will be communicated to the blue team for training purposes.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Planning & Scoping 5