I85PREP
⌘ K
PECB LPTP study materials
PECB LPTP study resources

PECB LPTP practice questions

One question at a time. Build your PECB LPTP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Penetration Testing Fundamentals

Under the PTES (Penetration Testing Execution Standard) structure, which phase immediately follows 'Intelligence Gathering' in the standard seven-phase flow?

  1. Pre-engagement Interactions
  2. Threat Modeling Correct answer.
  3. Reporting
  4. Vulnerability Analysis

Explanation

PTES orders its phases as pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. Threat modeling comes directly after intelligence gathering because the collected data must be mapped to plausible attack paths before vulnerabilities are enumerated.

Question 2Penetration Testing Fundamentals

A client asks a tester to assess only a public web application with no credentials and no internal network access. Which engagement type best describes this scope?

  1. White-box internal assessment
  2. Red team full-scope simulation
  3. Black-box external assessment Correct answer.
  4. Grey-box internal assessment

Explanation

A black-box external assessment provides no prior knowledge of the target and limits testing to externally reachable assets. The absence of credentials and internal access confirms the external, zero-knowledge nature of the scope.

Question 3Penetration Testing Fundamentals

Which document primarily defines what a penetration test is authorized to target, when testing may occur, and what actions are prohibited?

  1. Non-disclosure agreement
  2. Remediation plan
  3. Statement of work
  4. Rules of engagement Correct answer.

Explanation

The rules of engagement specify authorized targets, testing windows, prohibited techniques, and escalation contacts for the engagement. It is the operational document that bounds tester behavior during execution.

Question 4Penetration Testing Fundamentals

During a test, a tester discovers evidence of an active intrusion by a third party on the client's server. According to sound engagement practice, what should the tester do first?

  1. Continue testing to gather more evidence about the intruder
  2. Clean up the artifacts left by the third party
  3. Publish the finding to a public disclosure channel
  4. Notify the designated client contact per the escalation procedure Correct answer.

Explanation

Rules of engagement normally include an escalation path for critical or unexpected findings such as active compromise. The tester should stop and notify the agreed contact so the client can respond, rather than interfering with evidence or continuing blindly.

Question 5Penetration Testing Fundamentals

What distinguishes passive reconnaissance from active reconnaissance in a penetration test?

  1. Passive collection avoids direct interaction with target systems, while active collection sends traffic to them Correct answer.
  2. Passive reconnaissance requires credentials, while active reconnaissance never uses them
  3. Passive reconnaissance only uses social media, while active reconnaissance only uses port scanning
  4. Passive reconnaissance is illegal without a warrant, while active reconnaissance is always permitted

Explanation

Passive reconnaissance gathers information from third-party sources such as registries and search engines without touching target infrastructure. Active reconnaissance sends packets or requests directly to the target, which is more detectable and must be covered by the scope.

Question 6Penetration Testing Fundamentals

A tester wants to enumerate subdomains of a target without sending any queries to the target's own name servers. Which data source is most appropriate?

  1. An SNMP walk of the target's routers
  2. A brute-force DNS query loop against the target resolver
  3. Certificate transparency logs Correct answer.
  4. A zone transfer request to the authoritative server

Explanation

Certificate transparency logs are public records of issued certificates and can reveal subdomains without any traffic to the target. Zone transfers and resolver queries both contact target-controlled infrastructure, making them active techniques.

Question 7Penetration Testing Fundamentals

Which technique is a classic example of an active host-discovery method on an internal network?

  1. Reviewing WHOIS registration records
  2. ARP request sweep of the local subnet Correct answer.
  3. Querying a public certificate transparency log
  4. Searching job postings for technology names

Explanation

An ARP sweep sends frames onto the local segment to identify live hosts, which is direct interaction with the network. The other options draw on third-party public sources and never touch the target environment.

Question 8Penetration Testing Fundamentals

A tester runs a TCP connect scan rather than a SYN scan. What is the primary trade-off?

  1. The scan is stealthier but cannot detect open ports
  2. The scan bypasses all firewall rules by design
  3. The scan works only against UDP services
  4. The full connection is easier to log and detect but requires no raw socket privileges Correct answer.

Explanation

A TCP connect scan completes the three-way handshake, so target applications and logs are more likely to record it. In exchange, it needs only ordinary socket privileges, unlike a raw-packet SYN scan.

Question 9Penetration Testing Fundamentals

Which Nmap scan type sends no packets that complete a TCP handshake and is often used to infer whether a port is filtered?

  1. FTP bounce scan
  2. TCP SYN scan Correct answer.
  3. TCP connect scan
  4. UDP scan

Explanation

A SYN scan sends a SYN and interprets the response, never completing the handshake. No response or an ICMP error helps classify a port as filtered, which is why it is favored for firewall-aware mapping.

Question 10Penetration Testing Fundamentals

A tester needs to identify the version of a service listening on an open port. Which Nmap capability is designed for this?

  1. Ping sweep
  2. Idle scan
  3. Traceroute
  4. Service and version detection Correct answer.

Explanation

Service and version detection probes open ports and matches responses against signatures to identify the product and version. This information feeds later vulnerability analysis and exploit selection.

Question 11Penetration Testing Fundamentals

Which activity is characteristic of vulnerability analysis rather than exploitation?

  1. Sending an exploit payload to obtain a shell
  2. Exfiltrating data from a database
  3. Escalating privileges on a compromised host
  4. Correlating discovered service versions with known vulnerability databases Correct answer.

Explanation

Vulnerability analysis maps identified services and configurations to known weaknesses and validates them without weaponizing them. Exploitation begins when a tester actually attempts to leverage a weakness to gain access or impact.

Question 12Penetration Testing Fundamentals

A scanner reports a critical vulnerability on a host, but manual verification shows the vulnerable component is not reachable from the tested network. How should the tester classify this finding?

  1. A false positive for the tested attack surface, reported with context Correct answer.
  2. A confirmed critical finding requiring immediate exploitation
  3. A post-exploitation privilege escalation
  4. A false negative that should be discarded

Explanation

Scanner output must be validated, and an unreachable component cannot be exploited from the tested position. Reporting it with context avoids inflating risk while still informing the client of the latent weakness.

Question 13Penetration Testing Fundamentals

What is the primary purpose of the exploitation phase in a penetration test?

  1. To document the rules of engagement
  2. To demonstrate practical impact by leveraging validated weaknesses under authorized scope Correct answer.
  3. To collect publicly available registration data
  4. To patch vulnerable systems before reporting

Explanation

Exploitation proves that validated weaknesses can actually be leveraged, providing evidence of business impact. It is performed only within the authorized scope and with safeguards agreed in advance.

Question 14Penetration Testing Fundamentals

A tester obtains a low-privilege shell on a Linux host and wants to identify a path to root. Which post-exploitation activity is most directly relevant?

  1. DNS zone transfer against the domain
  2. Subdomain brute forcing
  3. Local privilege escalation enumeration Correct answer.
  4. Password spraying against the corporate VPN

Explanation

After gaining a foothold, testers enumerate local misconfigurations such as SUID binaries, sudo rights, and cron jobs to find an escalation path. The other options are external or credential-based activities unrelated to escalating on the compromised host.

Question 15Penetration Testing Fundamentals

Which practice best preserves the integrity of evidence collected during a penetration test?

  1. Deleting tool output after each session to reduce clutter
  2. Relying on memory to reconstruct steps at report time
  3. Editing screenshots to remove sensitive data before storing originals
  4. Recording timestamps, commands, and hashes of captured artifacts Correct answer.

Explanation

Evidence integrity depends on a documented, reproducible chain that links commands, timestamps, and artifact hashes. Altering or discarding originals undermines the credibility of findings if they are later questioned.

Question 16Penetration Testing Fundamentals

Which element is essential in a penetration test report to allow the client to reproduce and remediate a finding?

  1. A list of every tool version installed on the tester's laptop
  2. A generic statement that the network is insecure
  3. The tester's travel expenses and scheduling notes
  4. A clear description of the issue with affected asset, evidence, and remediation guidance Correct answer.

Explanation

A useful finding entry ties the weakness to a specific asset, shows reproducible evidence, and explains how to fix it. This lets technical staff verify and remediate without guessing.

Question 17Penetration Testing Fundamentals

A client requests a risk rating for each finding. Which approach aligns with common penetration testing practice?

  1. Rate findings solely by the CVSS base score without context
  2. Rate every finding as critical to ensure attention
  3. Rate likelihood and impact together, considering the client's environment and existing controls Correct answer.
  4. Rate findings by the order in which they were discovered

Explanation

Effective risk rating combines likelihood and impact in the context of the client's environment and compensating controls. Contextualized ratings help the client prioritize remediation realistically.

Question 18Penetration Testing Fundamentals

What is the main difference between a vulnerability assessment and a penetration test?

  1. A vulnerability assessment targets only external systems, while a penetration test targets only internal systems
  2. A penetration test attempts to exploit and chain weaknesses, while a vulnerability assessment primarily identifies and lists them Correct answer.
  3. A penetration test avoids all automated tools, while a vulnerability assessment uses only automated tools
  4. A vulnerability assessment always requires exploitation, while a penetration test never does

Explanation

A vulnerability assessment enumerates and reports weaknesses, often largely through scanning and validation. A penetration test goes further by attempting exploitation and chaining to demonstrate real impact.

Question 19Penetration Testing Fundamentals

Which legal concept most directly authorizes a penetration tester to perform actions that would otherwise be unauthorized access?

  1. Written authorization from the asset owner defining scope Correct answer.
  2. An informal verbal agreement with a colleague
  3. The tester's professional certification
  4. A public bug bounty policy covering other domains

Explanation

Authorization to test comes from the asset owner in writing and defines exactly what may be tested. Without that documented permission, testing can constitute unauthorized access regardless of intent or credentials.

Question 20Penetration Testing Fundamentals

A tester plans to test a third-party cloud-hosted application owned by the client. What should be verified before testing begins?

  1. That the tester has a personal VPN subscription
  2. That the tester's scanner is the latest version
  3. That the cloud provider's testing policy permits the planned activity and the client has authority over the asset Correct answer.
  4. That the client's marketing team has approved the report layout

Explanation

Cloud providers often impose their own testing policies, and the client must have authority over the hosted asset. Confirming both prevents the tester from violating provider terms or testing assets the client does not control.

Question 21Penetration Testing Fundamentals

Which statement best describes the role of a 'get out of jail free' letter in an engagement?

  1. It authorizes testing of any system the tester encounters
  2. It replaces the need for rules of engagement
  3. It grants the tester immunity from all laws in every jurisdiction
  4. It documents authorization and contacts so the tester can verify legitimacy if questioned during testing Correct answer.

Explanation

An authorization letter identifies the tester, the engagement, and client contacts so that if activity is detected, the tester can prove permission. It supports the rules of engagement but does not override law or expand scope.

Question 22Penetration Testing Fundamentals

During an engagement, a tester identifies an exploitable weakness in an out-of-scope production server discovered through network pivoting. What is the appropriate action?

  1. Stop and report the observation to the client without exploiting the out-of-scope system Correct answer.
  2. Exploit it immediately to demonstrate maximum impact
  3. Ask a colleague to exploit it instead
  4. Ignore it entirely and omit it from the report

Explanation

Scope boundaries must be respected even when a weakness is tempting to exploit. The correct approach is to document the observation and notify the client so they can decide whether to expand scope formally.

Question 23Penetration Testing Fundamentals

Which factor most strongly influences the choice between a stealthy, slow scan and a fast, noisy scan?

  1. The number of tools installed on the testing host
  2. The tester's preferred color scheme for reports
  3. The size of the tester's monitor
  4. The client's detection capability and the agreed rules of engagement Correct answer.

Explanation

Detection capability and agreed rules determine whether stealth is required or whether speed and coverage are preferred. A blue team aware of the test may want noise, while a covert objective demands slower techniques.

Question 24Penetration Testing Fundamentals

What does the term 'attack surface' refer to in penetration testing?

  1. The physical perimeter fence around a data center
  2. The list of tools installed on the tester's machine
  3. The set of points where an attacker could interact with or exploit a system Correct answer.
  4. The final risk score in the report

Explanation

Attack surface describes all reachable entry points and exposures, such as services, interfaces, and user interactions. Mapping it helps testers and defenders focus effort on what is actually exposed.

Question 25Penetration Testing Fundamentals

A tester wants to validate a suspected SQL injection without causing data loss. Which approach best reflects safe exploitation practice?

  1. Drop the application's tables to prove the vulnerability exists
  2. Modify production records to test integrity
  3. Use a benign proof such as a boolean or time-based check that demonstrates the flaw without altering data Correct answer.
  4. Extract the entire customer database to be thorough

Explanation

Safe exploitation proves a vulnerability with minimal impact, for example through boolean or time-based inference. Destructive actions risk harm to the client and are not justified by the goal of demonstrating a flaw.

Question 26Penetration Testing Fundamentals

Which document defines the specific systems, networks, and techniques that a penetration tester is authorized to test?

  1. The non-disclosure agreement
  2. The statement of work
  3. The master service agreement
  4. The rules of engagement Correct answer.

Explanation

The rules of engagement (RoE) is the document that explicitly defines the scope, authorized targets, permitted techniques, time windows, and escalation contacts for a penetration test. It translates the contractual relationship into operational boundaries the tester must follow.

Question 27Penetration Testing Fundamentals

In penetration testing terminology, what distinguishes a 'threat' from a 'vulnerability'?

  1. A threat is a control failure, while a vulnerability is a missing control
  2. A threat is a potential cause of harm, while a vulnerability is a weakness that a threat could exploit Correct answer.
  3. A threat is a weakness in code, while a vulnerability is an attacker's motivation
  4. A threat is a verified exploit, while a vulnerability is an unverified suspicion

Explanation

A threat is any potential agent or event that could cause harm, such as an attacker, malware, or a natural event. A vulnerability is a weakness in a system that a threat actor could exploit; risk arises when a threat can act on a vulnerability.

Question 28Penetration Testing Fundamentals

A penetration tester is preparing an engagement and needs to decide between black-box, grey-box, and white-box testing. Which factor most directly determines this choice?

  1. The length of the testing window agreed in the rules of engagement
  2. The number of external IP addresses owned by the client
  3. The operating system installed on the tester's attack platform
  4. The amount of internal information provided to the tester before testing begins Correct answer.

Explanation

Black-box, grey-box, and white-box refer to the level of knowledge and access the tester receives before testing, such as source code, architecture diagrams, or credentials. The choice depends on what the client wants to simulate and how much information it is willing to share.

Question 29Penetration Testing Fundamentals

Which statement best describes the role of a scope document during a penetration test?

  1. It records the hourly rate and payment schedule for the engagement
  2. It lists the in-scope and out-of-scope assets and constrains where the tester may direct activity Correct answer.
  3. It describes the client's business continuity plan in the event of an outage
  4. It lists the vulnerabilities that the tester is expected to find during the engagement

Explanation

A scope document enumerates the systems, applications, and networks that are in scope and explicitly identifies what is out of scope. It is the operational boundary that prevents the tester from affecting unauthorized assets.

Question 30Penetration Testing Fundamentals

A tester is preparing to conduct a penetration test and wants to reduce the risk of disrupting production services. Which planning activity best addresses this concern?

  1. Running all tests during business hours so that support staff are available
  2. Using only automated scanners to reduce the number of manual actions
  3. Increasing the scan rate to finish the engagement more quickly
  4. Agreeing on testing windows, prohibited techniques, and rollback procedures with the client before testing Correct answer.

Explanation

Pre-engagement planning should establish testing windows, techniques that are prohibited because they are too disruptive, and rollback or recovery procedures. This reduces the chance that testing causes an outage and ensures both parties know how to respond if something goes wrong.

Question 31Penetration Testing Fundamentals

During an engagement, a tester discovers a serious vulnerability on a system that was not listed in the scope document but is owned by the client. What is the most appropriate action?

  1. Ignore the finding entirely because it falls outside the agreed scope
  2. Continue testing the system because the vulnerability is serious and the client owns it
  3. Exploit the vulnerability to demonstrate impact and include it in the final report
  4. Stop testing that system and report the discovery to the client contact for scope clarification Correct answer.

Explanation

The scope document defines what the tester is authorized to test, and ownership by the client does not automatically authorize testing. The tester should stop activity on the out-of-scope system and notify the client so that scope can be formally extended if desired.

Question 32Penetration Testing Fundamentals

Which activity is performed during the reconnaissance phase of a penetration test?

  1. Removing log entries to cover the tester's tracks
  2. Gathering publicly available information about the target organization and its infrastructure Correct answer.
  3. Escalating privileges on a compromised host
  4. Exploiting a buffer overflow to gain a remote shell

Explanation

Reconnaissance is the information-gathering phase that precedes active testing. It collects open-source and public data about the target, such as domains, IP ranges, employee information, and technologies in use, to inform later phases.

Question 33Penetration Testing Fundamentals

A tester wants to prioritize findings from a web application assessment. Which combination best reflects a standard approach to risk-based prioritization?

  1. The order in which the vulnerabilities were discovered
  2. The popularity of the programming language used by the application
  3. Likelihood of exploitation combined with potential business impact Correct answer.
  4. The number of lines of code in the affected module

Explanation

Risk-based prioritization typically combines the likelihood that a vulnerability will be exploited with the business impact if it is. This produces a rating that helps the client focus remediation on the issues that matter most.

Question 34Penetration Testing Fundamentals

Which statement best describes the difference between a vulnerability scan and a penetration test?

  1. A vulnerability scan produces a report, while a penetration test does not
  2. A vulnerability scan identifies potential weaknesses, while a penetration test attempts to exploit them to determine real impact Correct answer.
  3. A vulnerability scan is always performed externally, while a penetration test is always internal
  4. A vulnerability scan requires a signed contract, while a penetration test does not

Explanation

A vulnerability scan is primarily an automated identification of potential weaknesses. A penetration test goes further by attempting to exploit findings in a controlled manner to validate whether they are real and to demonstrate business impact.

Question 35Penetration Testing Fundamentals

A tester is reviewing a web application and notices that user-supplied input is reflected in the response without encoding. Which action best validates the finding safely?

  1. Submit a payload designed to steal other users' session cookies
  2. Delete application data to prove that the input is processed
  3. Craft a benign payload that demonstrates script execution in the tester's own browser session Correct answer.
  4. Deploy a persistent backdoor on the production server

Explanation

Safe validation uses a benign proof-of-concept that demonstrates the vulnerability without harming users or data. Testing in the tester's own session confirms the issue while avoiding theft of real credentials or destructive actions.

Question 36Penetration Testing Fundamentals

Why should a penetration tester maintain detailed notes and logs during an engagement?

  1. To satisfy the requirement that all testing be automated
  2. To reduce the number of vulnerabilities that need to be reported
  3. To support reproducibility of findings and provide evidence if activity is questioned Correct answer.
  4. To increase the speed of the testing tools being used

Explanation

Detailed notes and logs allow findings to be reproduced, support the accuracy of the final report, and provide evidence that activity was authorized if questions arise. They also help the client verify and remediate issues.

Question 37Penetration Testing Fundamentals

A tester is selecting tools for an engagement. Which consideration is most important when choosing between commercial and open-source tools?

  1. Whether the tool was developed in the same country as the client
  2. Whether the tool has the largest user community
  3. Whether the tool includes a graphical user interface
  4. Whether the tool is approved for use under the engagement's rules and licensing constraints Correct answer.

Explanation

Tool selection must respect the rules of engagement, licensing terms, and any client restrictions. A tool that is effective but not approved or licensed for the engagement can create legal and contractual problems.

Question 38Penetration Testing Fundamentals

A tester has completed an engagement and is preparing the report. Which element is most important to include so the client can reproduce and verify a finding?

  1. The exact request and response or command output that demonstrates the issue Correct answer.
  2. The tester's opinion of the client's security culture
  3. A list of all tools installed on the tester's laptop
  4. The total number of hours spent on the engagement

Explanation

Reproducibility requires the specific evidence that triggered the finding, such as the request and response pair or command output. This allows the client's team to confirm the issue and verify that remediation resolves it.

Question 39Penetration Testing Fundamentals

A tester is planning an engagement and must decide how to handle a client request to test a production system during peak business hours. Which response best reflects professional practice?

  1. Test only after the engagement ends to avoid disrupting users
  2. Discuss the risks and agree on safeguards, such as limiting intrusive tests or scheduling them outside peak hours Correct answer.
  3. Proceed with all planned tests because the client requested it
  4. Refuse the engagement because production testing is never acceptable

Explanation

Professional practice involves discussing the risks of testing production during peak hours and agreeing on safeguards, such as limiting intrusive techniques or rescheduling. The tester balances the client's goals with the need to avoid disruption.

Question 40Penetration Testing Fundamentals

A tester finds that a client's web application uses a third-party authentication provider. Which action is most appropriate before testing the authentication flow?

  1. Test the provider because it is part of the client's login process
  2. Assume the provider is out of scope and skip authentication testing entirely
  3. Verify that the third-party provider is included in the authorized scope or obtain written permission Correct answer.
  4. Report the provider as a vulnerability without testing it

Explanation

Third-party services are separate legal entities and are not automatically in scope just because the client integrates them. The tester must verify that the provider is authorized or obtain written permission before directing tests at it.

Question 41Penetration Testing Planning and Scoping

During penetration test scoping, which document is signed by an authorized representative of the client to grant legal permission to test specified systems within defined dates?

  1. Authorization letter Correct answer.
  2. Statement of work
  3. Non-disclosure agreement
  4. Rules of engagement

Explanation

An authorization letter (or letter of authorization) is the formal, signed permission from a client representative that establishes legal authority to conduct testing on named targets during a specified window. It protects the tester from claims of unauthorized access. The rules of engagement describe how testing proceeds, while the SOW and NDA address commercial terms and confidentiality.

Question 42Penetration Testing Planning and Scoping

A client asks the tester to begin active exploitation the same day the engagement starts because of a tight deadline. What is the most appropriate scoping response?

  1. Confirm written authorization and signed rules of engagement exist before any active testing Correct answer.
  2. Begin with exploitation but limit it to low-risk payloads
  3. Ask a colleague to verbally confirm the client approved the work
  4. Start exploitation immediately and document authorization afterwards

Explanation

Active testing must not begin until written authorization and agreed rules of engagement are in place, because the tester otherwise risks acting without legal cover. Scoping discipline requires confirming the signed documents and test window before any intrusive action. Verbal approval or retroactive documentation does not substitute for prior written authorization.

Question 43Penetration Testing Planning and Scoping

Which element of the rules of engagement specifies the individuals who may be contacted and the escalation path when a critical finding or incident occurs during testing?

  1. Emergency contact and escalation procedure Correct answer.
  2. Deliverable schedule
  3. Target list
  4. Testing methodology

Explanation

The rules of engagement should define emergency contacts and an escalation path so that critical findings, outages, or suspected real incidents reach the right people quickly. This protects both the client's operations and the tester's legal position. Target lists, methodology, and deliverables are separate scoping elements.

Question 44Penetration Testing Planning and Scoping

A penetration testing engagement's scope document lists only IP addresses. Which additional identifier should the tester request to reduce ambiguity about which systems are in scope?

  1. The employees' email addresses
  2. Hostnames and asset ownership records Correct answer.
  3. The client's marketing domain names
  4. The physical office floor plan

Explanation

IP addresses alone can be ambiguous because of dynamic allocation, shared hosting, and NAT, so hostnames and asset ownership records help confirm exactly which systems belong to the client and are authorized. This prevents testing systems owned by third parties or out-of-scope business units. The other items do not resolve target ownership.

Question 45Penetration Testing Planning and Scoping

What is the primary purpose of defining exclusion lists during penetration test scoping?

  1. To describe the reporting format for the final deliverable
  2. To record findings that were remediated before the test
  3. To identify systems that must not be tested because of fragility or legal constraints Correct answer.
  4. To list the tools the tester is permitted to use

Explanation

Exclusion lists name assets that must be avoided, typically because they are fragile, life-critical, third-party owned, or legally restricted. Explicitly documenting them prevents accidental disruption and out-of-scope testing. Tool lists, remediation records, and reporting formats serve different scoping purposes.

Question 46Penetration Testing Planning and Scoping

Which statement best describes the purpose of a penetration testing statement of work?

  1. It records the technical vulnerabilities discovered during testing
  2. It legally authorizes the tester to attack any client-owned system
  3. It lists the emergency contacts for incident escalation
  4. It defines the services, deliverables, timeline, and commercial terms of the engagement Correct answer.

Explanation

The statement of work captures what services will be delivered, the schedule, and commercial terms, forming the contractual basis of the engagement. It does not by itself grant legal authorization to attack systems, nor does it record findings or escalation contacts. Those belong to the authorization letter, report, and rules of engagement respectively.

Question 47Penetration Testing Planning and Scoping

A tester is planning an external penetration test and needs to determine which systems the client actually owns. Which scoping activity most directly supports this?

  1. Interviewing the client's marketing team about branding
  2. Conducting asset discovery with client validation of ownership Correct answer.
  3. Requesting the client's source code repository
  4. Reviewing the client's incident response plan

Explanation

Asset discovery combined with client validation establishes which discovered hosts genuinely belong to the client, preventing testing of third-party or shared infrastructure. Ownership validation is essential for legal and operational safety. Incident response plans, source code, and branding interviews do not resolve asset ownership.

Question 48Penetration Testing Planning and Scoping

Which scoping artifact typically states the agreed testing window and the maximum acceptable impact on production systems?

  1. Remediation plan
  2. Vulnerability scan output
  3. Penetration test report
  4. Rules of engagement Correct answer.

Explanation

The rules of engagement record operational constraints such as permitted testing hours and the acceptable level of impact on production. These limits guide the tester's technique selection and protect availability. Reports, scan output, and remediation plans are produced later or serve different purposes.

Question 49Penetration Testing Planning and Scoping

During scoping, the client states that a production payment gateway must remain available at all times. How should the tester incorporate this into the plan?

  1. Exclude the gateway from intrusive testing or restrict it to non-disruptive checks agreed in the rules of engagement Correct answer.
  2. Ignore the constraint because availability is the client's responsibility
  3. Test the gateway first to confirm the scope is accurate
  4. Test the gateway during peak hours to maximize realism

Explanation

Availability-critical systems should be excluded from intrusive testing or limited to agreed non-disruptive checks, and this constraint must be documented in the rules of engagement. Respecting availability requirements is a core scoping obligation. Testing during peak hours or without constraints risks outage and violates the agreement.

Question 50Penetration Testing Planning and Scoping

A penetration tester is asked to assess a cloud-hosted application. The cloud provider's acceptable use policy prohibits certain intrusive tests without prior approval. What is the correct scoping action?

  1. Proceed because the client owns the application
  2. Assume the provider permits all tests by default
  3. Obtain the client's confirmation that provider approval has been secured or restrict testing accordingly Correct answer.
  4. Conduct the tests and notify the provider afterwards

Explanation

When infrastructure is hosted by a third party, the provider's policies may impose additional restrictions, so the tester must confirm that required approvals exist or adjust the scope to comply. The client's ownership of the application does not override the provider's terms. Proceeding without approval or notifying afterwards exposes both parties to policy violations.