Sample questions
Pt Scoping Rules Of EngagementDifficulty 1
What is the main purpose of a Rules of Engagement (RoE) document before a penetration test begins?
- aTo define, in writing, what is authorized, what is out of scope, and how the test will be conducted.✓
- bTo list the invoice amount, payment schedule, and applicable late-payment penalties the client owes after the test finishes.
- cTo describe the exploit code the testers plan to run against the target systems.
- dTo replace the need for any written authorization from the client organization.
Explanation:The RoE is the written agreement that spells out authorized scope, testing boundaries, timing, and communication rules — it is the foundation that makes the engagement legal and predictable, not a billing document or a technical exploit plan.
Pt Scoping Rules Of EngagementDifficulty 1
Why does a penetration tester need a signed authorization letter (sometimes called a 'get out of jail free' letter) before starting any testing activity?
- aIt provides documented proof that the client authorized the testing, protecting the tester from claims of unauthorized access.✓
- bIt replaces the need to define which systems are in scope, since the letter alone covers everything.
- cIt is only a formality with no legal weight and can safely be skipped if the client trusts the tester, even when the systems involved process regulated financial or health data.
- dIt is required only when testing systems hosted outside the tester's home country.
Explanation:Without documented, signed authorization from someone with the legal authority to grant it, activity that looks identical to an attack (scanning, exploitation attempts) could otherwise be treated as unauthorized computer access. The letter is evidence of consent, not a scope definition by itself.
Pt Scoping Rules Of EngagementDifficulty 2
During a network penetration test, a tester notices a server that responds on the same subnet as the in-scope IP range, but its address is not listed in the signed scope document. What should the tester do?
- aQuietly skip mentioning it in the final report, since it was never part of the agreed engagement.
- bTest it anyway, since being on the same subnet as authorized targets implies it is also authorized, because network proximity is treated as equivalent to explicit written permission.
- cTreat the server as out of scope and raise it with the client point of contact before touching it further.✓
- dAssume the client forgot to list it and add it to the report as if it had been formally authorized.
Explanation:Only what is explicitly listed in the signed RoE is authorized. An unlisted host must not be tested; the correct action is to flag it to the client contact and get an explicit scope decision, not assume authorization or silently test or ignore it.
Pt Scoping Rules Of EngagementDifficulty 1
In an RoE document, what does the 'testing window' typically specify?
- aThe specific tools and exploit frameworks the tester is required to use during the engagement.
- bThe maximum number of vulnerabilities the tester is allowed to find and report.
- cThe list of employees who are personally responsible for every system in scope.
- dThe agreed dates and hours during which active testing activity is permitted to occur.✓
Explanation:The testing window defines when testing may happen — specific dates, hours, or blackout periods to avoid — so activity outside that window is not authorized, regardless of whether the target itself is in scope.
Pt Scoping Rules Of EngagementDifficulty 2
A client asks a pentest firm to test a web application, but the application is hosted on a third-party cloud provider's shared infrastructure. What must the RoE process confirm before testing begins?
- aNothing extra; the client's own authorization is always sufficient for any infrastructure they use.
- bThat the cloud provider's own policies allow this kind of testing, and separate provider authorization is obtained if required.✓
- cThat the cloud provider's marketing materials mention security as a feature of their platform.
- dThat the tester has personally used that specific cloud provider's service before in an unrelated project, since prior familiarity with the platform is treated as equivalent to a legal authorization check.
Explanation:Many cloud providers have their own testing policies (some require pre-notification or explicit permission for certain test types, like DoS-style load). The client authorizing the test does not automatically satisfy the infrastructure owner's separate requirements, so this must be checked and documented before testing.
Pt Scoping Rules Of EngagementDifficulty 2
Why do RoE documents usually require an emergency contact and an agreed communication channel for both the client and the testing team?
- aSo that the client can cancel the entire contract without notice at any point during testing.
- bSo that the testing team can advertise the engagement publicly once it starts, to build their portfolio, regardless of any confidentiality obligations the firm has toward the client.
- cSo that if testing causes an unexpected outage or issue, both sides can quickly reach each other and coordinate a response.✓
- dSo that the tester can bypass the RoE and test out-of-scope systems if the client is unreachable.
Explanation:Testing can occasionally trigger unintended effects (a crash, a false alarm to the SOC, a service disruption). A clear emergency contact and communication path lets both sides react quickly — pause testing, confirm what happened, and coordinate — rather than leaving either side guessing.