GPEN Penetration Testing Planning and Scoping Quiz

1. What should be documented regarding the testing timeline in the scope and rules of engagement?

Only the start date

Start date, end date, testing windows, and any blackout periods

The tester's availability only

Nothing—testing can occur anytime

Submit

3. What is a critical element to include when documenting the scope of a penetration test?

The tester's personal experience

Specific IP addresses, domains, and systems included and excluded

The client's financial information

Competitor analysis data

Submit

5. When scoping a penetration test, what should be clarified regarding social engineering tactics?

They should never be included

They can be used without restriction

Authorization level, target groups, and sensitive topics to avoid

Only email phishing is permitted

6. Which communication method is typically required to document approval and authorization for a penetration test?

Verbal approval from IT staff

Email approval from any manager

Signed contract or written rules of engagement

Text message confirmation

Submit

8. During scoping, what is the significance of identifying out-of-scope systems?

It allows the tester to ignore security issues completely

It prevents accidental testing and sets clear boundaries

It reduces the final report length

It guarantees no vulnerabilities exist there

9. Which testing technique is most appropriate for assessing an organization's incident response capabilities?

Black-box network penetration test

Red team exercise with advance notification

Unannounced red team simulating a real attack

Automated vulnerability scanning

Submit

11. Which document formally defines the boundaries, objectives, and authorized targets of a penetration test?

Rules of Engagement

Scope of Work

Risk Assessment Report

Security Policy

12. Which of the following is a valid reason to exclude a system from penetration testing scope?

The system owner is uncomfortable with testing

The system runs legacy software

Critical production systems where downtime cannot be tolerated

The system has never been tested before

Submit

14. A penetration tester discovers a critical vulnerability outside the defined scope. What is the appropriate action?

Immediately exploit it to prove impact

Document it and report to the client for scope revision

Ignore it since it's out of scope

Test it anyway to provide added value

15. When planning a penetration test, which activity should occur before technical testing begins?

Vulnerability scanning of all networks

Reconnaissance and information gathering

Stakeholder meetings and scope definition

Exploitation of discovered vulnerabilities

16. What is a key difference between a white-box and black-box penetration test in terms of scoping?

White-box provides target information; black-box assumes no prior knowledge

Black-box is always more expensive

White-box cannot test external systems

Black-box requires client approval for each step

17. Which stakeholder group must be informed about the penetration test to ensure business continuity during the engagement?

Only the IT security team

Only the CISO and C-level executives

IT, management, and operations teams as appropriate

All employees without exception

Submit

19. In penetration testing, rules of engagement typically cover which of the following?

Testing timeframes, authorized techniques, and escalation procedures

Network architecture diagrams only

Employee training schedules

Vendor contact information

20. What is the primary purpose of establishing a detailed scope before beginning a penetration test?

To reduce the cost of the engagement

To prevent unauthorized testing and manage legal liability

To ensure the tester has maximum access

To simplify reporting requirements

GPEN Penetration Testing Planning and Scoping Quiz

1. What should be documented regarding the testing timeline in the scope and rules of engagement?

2.

What first name or nickname would you like us to use?

2. Before commencing testing, the penetration tester should obtain written ______ to protect both parties from legal liability.

3. What is a critical element to include when documenting the scope of a penetration test?

4. The ______ is the person or team responsible for authorizing the penetration test and approving scope changes.

5. When scoping a penetration test, what should be clarified regarding social engineering tactics?

6. Which communication method is typically required to document approval and authorization for a penetration test?

7. A penetration test's ______ should clearly state the goals, such as testing defenses or validating security controls.

8. During scoping, what is the significance of identifying out-of-scope systems?

9. Which testing technique is most appropriate for assessing an organization's incident response capabilities?

10. A ______ meeting with stakeholders before testing helps ensure alignment on objectives and risk tolerance.

11. Which document formally defines the boundaries, objectives, and authorized targets of a penetration test?

12. Which of the following is a valid reason to exclude a system from penetration testing scope?

13. The ______ defines which systems, networks, and applications are included in the penetration test engagement.

14. A penetration tester discovers a critical vulnerability outside the defined scope. What is the appropriate action?

15. When planning a penetration test, which activity should occur before technical testing begins?

16. What is a key difference between a white-box and black-box penetration test in terms of scoping?

17. Which stakeholder group must be informed about the penetration test to ensure business continuity during the engagement?

18. A ______ is a formal written agreement that documents the client's authorization for penetration testing activities.

19. In penetration testing, rules of engagement typically cover which of the following?

20. What is the primary purpose of establishing a detailed scope before beginning a penetration test?