Ethics, Legal Frameworks, and Compliance
This domain tests whether you can keep an engagement lawful and ethical before, during, and after testing. CPEH-style questions often present a tempting action-scanning a related domain, using leaked credentials, or retaining client data-and ask what a professional should do.
Core rules and concepts
- Authorization must be written, specific, and signed by someone with authority. It defines targets, time windows, techniques, data handling, and emergency contacts.
- Scope is both technical and legal: IP ranges, domains, cloud accounts, subsidiaries, and third-party providers are separate unless explicitly included.
- Rules of engagement cover testing hours, denial-of-service limits, social engineering approval, and stop conditions.
- Compliance obligations may include GDPR, HIPAA, PCI DSS, SOX, or contractual NDAs; they affect what data you may access, store, and report.
- Preserve evidence with chain-of-custody notes, hashes, timestamps, and secure storage; disclose findings responsibly.
Worked example
A client authorizes testing of example.com but mentions a newly acquired subsidiary. You find a certificate for subsidiary.example.com. Because the subsidiary is a separate legal entity and is not listed in the authorization, do not scan or exploit it. Document the discovery, notify the client contact, and request a written scope amendment. If approved, update the rules of engagement before touching the host. The reasoning: discovering a name is reconnaissance, but interacting with it is testing.
Traps
Verbal approval is not enough. Publicly accessible does not mean authorized. Do not assume a parent company's permission covers acquisitions. Avoid collecting real personal data when a proof-of-concept suffices, and never test after the window closes.