PenTest+ Scoping Quiz: Can You Plan The Engagement?

1. What is the significance of defining 'in-scope' versus 'out-of-scope' assets during planning?

It prevents unauthorized testing and ensures legal and contractual compliance

It has no real impact on the engagement

It only matters for billing purposes

It allows the tester to ignore security risks outside the scope

2. In Planning & Scoping (PenTest+), what is a 'constraint' in the context of engagement planning?

A limitation or restriction that affects how the test can be conducted

A type of vulnerability found on servers

A mandatory security control that must be bypassed

A payment schedule for the engagement

3. A client requests that certain vulnerability classes be tested while explicitly excluding others. What should the tester do?

Document the inclusions and exclusions in the RoE and scope agreement

Test all vulnerability classes regardless of client restrictions

Assume the client doesn't understand security and test everything

Refuse the engagement because the scope is too restrictive

4. What is the typical content of a 'kick-off meeting' during the planning phase of an engagement?

Review scope, objectives, timeline, RoE, and establish communication channels

Immediately begin technical testing without discussion

Discuss the tester's personal background and experience

Finalize the invoice and payment terms only

5. During scoping, the client mentions critical systems that must remain operational. How should the tester respond?

Document these systems, adjust testing methods, and plan for minimal downtime

Ignore the concern and test aggressively regardless

Exclude all critical systems from testing entirely

Recommend the client shut down systems to maximize test effectiveness

6. What is the primary reason for obtaining written authorization before a penetration test?

To provide legal protection and ensure all stakeholders approve the engagement

To impress the client with formal documentation

To avoid paying taxes on the engagement

To make the test more difficult for the tester

7. Which document typically outlines the specific objectives and success criteria for a penetration test?

Statement of Work (SOW) or engagement charter

Employee handbook

General company policies

Marketing brochure

8. A tester discovers that the client's scoping document conflicts with the rules of engagement. What should they do?

Contact the client immediately to clarify and resolve the conflict in writing

Follow the RoE and ignore the scoping document

Follow the scoping document and ignore the RoE

Proceed with testing based on their own interpretation

9. What is a 'test window' in penetration testing scoping?

The agreed-upon timeframe during which testing activities can occur

A literal window in the client's office

The period after testing when vulnerabilities must be fixed

A software tool used to schedule security assessments

10. During scoping, which stakeholder input is most critical to understand business impact tolerance?

IT leadership and business unit owners

Only the IT help desk staff

Exclusively external security vendors

Random employees throughout the organization

11. What is the primary purpose of a scoping document in a penetration test engagement?

Define boundaries, objectives, and authorized testing areas

List all security vulnerabilities found during testing

Provide a marketing summary to advertise the test

Document the tester's personal credentials and certifications

12. A client requests social engineering testing as part of the engagement. What must the tester ensure during scoping?

Written authorization and clear limits on targets and techniques

Verbal approval only to maintain confidentiality

No documentation so the organization is fully surprised

Permission to test all employees without informing leadership

13. Which type of testing engagement typically requires the most detailed scoping to minimize business disruption?

Live penetration test on production systems

Code review of legacy applications

Passive vulnerability scanning

Documentation audit

14. What should a penetration tester do if the client's scope definition is ambiguous or unclear?

Ask clarifying questions and document the client's responses in writing

Assume the broadest possible interpretation of the scope

Proceed with testing and resolve ambiguities later in the report

Test all systems in the organization regardless of the vague scope

15. During scoping, a client mentions their network includes IoT devices but wants them excluded from testing. How should the tester respond?

Document the exclusion in the scope and RoE, then test only authorized systems

Test the IoT devices anyway because they pose security risks

Refuse the engagement if any systems are excluded

Test IoT devices secretly without updating the RoE

16. What is the purpose of a pre-engagement checklist in penetration testing?

Ensure all legal, technical, and logistical requirements are met before testing

Create a list of vulnerabilities to look for during testing

Determine the tester's hourly billing rate

Schedule social media announcements about the engagement

17. Which of the following is a critical element of client communication during scoping?

Establishing clear expectations and obtaining written authorization

Avoiding all contact with the client until the test is complete

Promising a 100% vulnerability discovery rate

Keeping the scope vague to maximize testing flexibility

18. What is a key difference between a black-box and white-box penetration test during the scoping phase?

Black-box provides no prior information; white-box provides system details

Black-box is always more expensive than white-box

White-box testing is illegal in most jurisdictions

Black-box and white-box have no meaningful differences

19. A penetration test scope explicitly excludes the production database server. What should the tester do if they discover a vulnerability on that server?

Document it and report it without exploiting it

Immediately exploit and patch the vulnerability

Ignore it completely and omit from the report

Test it anyway since it's a security risk

20. Which element should be explicitly included in the rules of engagement (RoE)?

Prohibited testing methods and out-of-scope systems

The tester's preferred lunch schedule

A list of all company employees

The client's historical financial records

PenTest+ Scoping Quiz: Can You Plan the Engagement?