A Repeatable, Measurable Penetration Testing Process
Domain 1 tests whether you can run an engagement the way a mature consultancy does: the same phases in the same order, evidence another tester could reproduce, and results a client can measure. The exam rewards documented decisions - scope, rules of engagement, and metrics defined before testing starts - over a lucky single find.
Phase gates and the rules of engagement
Every engagement moves through pre-engagement, reconnaissance, scanning and enumeration, vulnerability analysis, exploitation, post-exploitation, reporting, and retest. Nothing crosses a gate without written authorization. The rules of engagement (RoE) must name in-scope CIDRs, domains and applications, explicitly excluded hosts, permitted test windows, authorized source IPs, an emergency-stop contact, allowed technique classes (no denial of service, no social engineering unless separately authorized), and data handling plus retention rules. Reference frameworks - NIST SP 800-115, PTES, OSSTMM - are cited so the client can audit your process rather than trust it.
Making the work measurable
Choose metrics before the first packet: asset coverage, service coverage, verified versus theoretical findings, findings per asset, time to detect on the blue-team side if detection testing is in scope, and time-to-remediation on retest. Score consistently with CVSS v3.1 or v4.0, state the version and the vector string, and say whether environmental metrics were applied. Re-scan with identical tool configuration and timestamps so quarterly comparisons mean something.
Worked example
An engagement covers 40 external IPs and 1,200 discovered services. The tester defines coverage as services receiving at least one manual check. The scanner fingerprints 900 services; 300 of those are CDN-shared and excluded by the RoE, leaving 600 testable. Coverage is 600/1,200 = 50%, and the report states the gap and why it exists. One SQL injection scores CVSS 9.8 base; the environmental score drops to 8.1 because the database holds only public marketing content. The justification is written down, so the next tester reaches the same rating.
Traps that cost marks
- Scope creep: testing a sibling domain because it resolved to the same IP.
- Ratings with no vector string or CVSS version, which cannot be reproduced.
- Calling scanner output a verified finding without a manual confirmation step.
- No defined retest criteria, so remediation cannot be measured.
- Reporting only the successful attack and omitting the failed hypotheses that shaped the plan.