Legal & Compliance in Pentesting (PenTest+) Quiz

1. Which of the following best describes 'scope creep' in penetration testing?

Testing systems beyond the agreed scope

Using outdated testing tools

Failing to document vulnerabilities

Extending the testing timeline

Submit

3. Which regulation requires organizations in certain industries to disclose security breaches within a specific timeframe?

GDPR and state breach notification laws

PCI-DSS only

HIPAA exclusively

ISO 27001 alone

4. True or False: Testing should continue if the client becomes unresponsive during the agreed testing window.

True

False

Submit

6. Which party is typically responsible for notifying affected individuals if a data breach is discovered during testing?

The penetration testing company

The client organization

The government regulator

The individual whose data was exposed

7. True or False: A penetration tester should document all testing activities, including failed attempts and system access times.

True

False

Submit

9. What is the primary benefit of obtaining cyber liability insurance as a penetration tester?

Covers legal costs and damages from authorized testing incidents

Allows testing without written client authorization

Eliminates all legal risks

Provides free penetration testing tools

10. A responsible disclosure timeline typically requires the tester to give the client how long to patch before public disclosure?

24 hours

30–90 days

6 months

1 year

11. What is the primary purpose of a Rules of Engagement (RoE) document in a penetration test?

Define authorized scope, methods, and legal boundaries

List all employees of the client organization

Document the tester's personal security certifications

Establish the penetration tester's hourly billing rate

12. True or False: A verbal agreement from a manager is sufficient authorization to begin penetration testing.

True

False

Submit

14. A penetration tester discovers data belonging to a third party during testing. What is the correct action?

Report it immediately to law enforcement

Notify the client and follow RoE procedures

Publish findings on a security blog

Delete the data to protect privacy

15. Which legal concept protects a penetration tester from liability when authorized testing causes temporary system downtime?

Indemnification clause

Non-repudiation

Right to audit

Whistleblower protection

16. True or False: Disclosure of vulnerabilities should occur immediately after discovery without waiting for client approval.

True

False

Submit

18. Which of the following is NOT typically included in a penetration testing contract?

Testing timeline and deadlines

Scope of systems to be tested

Penetration tester's personal home address

Liability limitations and insurance details

19. True or False: A penetration tester can test systems outside the agreed scope if they discover additional vulnerabilities.

True

False

Submit

Pentest Legal Quiz: Can You Master Scope, Consent & Disclosure?

1. Which of the following best describes 'scope creep' in penetration testing?

2.

What first name or nickname would you like us to use?

2. The process of obtaining explicit permission from an authorized representative before testing is called ____.

3. Which regulation requires organizations in certain industries to disclose security breaches within a specific timeframe?

4. True or False: Testing should continue if the client becomes unresponsive during the agreed testing window.

5. A contract clause that limits the tester's financial responsibility for damages is called ____.

6. Which party is typically responsible for notifying affected individuals if a data breach is discovered during testing?

7. True or False: A penetration tester should document all testing activities, including failed attempts and system access times.

8. The legal doctrine that shields researchers who responsibly disclose vulnerabilities from liability is called ____.

9. What is the primary benefit of obtaining cyber liability insurance as a penetration tester?

10. A responsible disclosure timeline typically requires the tester to give the client how long to patch before public disclosure?

11. What is the primary purpose of a Rules of Engagement (RoE) document in a penetration test?

12. True or False: A verbal agreement from a manager is sufficient authorization to begin penetration testing.

13. The legal responsibility a penetration tester assumes for damages caused during authorized testing is defined by ____.

14. A penetration tester discovers data belonging to a third party during testing. What is the correct action?

15. Which legal concept protects a penetration tester from liability when authorized testing causes temporary system downtime?

16. True or False: Disclosure of vulnerabilities should occur immediately after discovery without waiting for client approval.

17. What does NDA stand for in the context of penetration testing?

18. Which of the following is NOT typically included in a penetration testing contract?

19. True or False: A penetration tester can test systems outside the agreed scope if they discover additional vulnerabilities.

20. Written authorization from the client before starting a penetration test is a legal requirement known as ____.