PenTest+ V2 Compliance Assessment Requirements

1. Which phase of penetration testing includes defining objectives and deliverables?

Planning and scoping

Reconnaissance

Exploitation

Reporting

2. What document should clearly outline testing restrictions, such as testing windows and excluded systems?

Rules of Engagement

System backup schedule

Employee handbook

Hardware inventory list

3. In penetration testing, what does 'white-box' testing assume about the tester's knowledge?

Full knowledge of internal systems and architecture

No prior knowledge of the target

Limited network access only

Physical access to servers

4. Which compliance requirement mandates annual security assessments for financial institutions?

SOX (Sarbanes-Oxley)

FERPA

COPPA

GLBA

5. What is the primary role of risk assessment in the planning phase?

To identify potential threats and vulnerabilities affecting business objectives

To determine employee salaries

To schedule maintenance windows

To order new equipment

6. During scoping, what does 'attack surface' refer to?

All potential entry points and exploitable vulnerabilities

The physical location of servers

The number of employees

The organization's annual budget

7. What is a critical element when defining testing constraints for compliance assessments?

Identifying systems that must not be tested

Eliminating all security controls

Removing access logs

Disabling firewalls

8. Which framework provides guidance on information security management systems?

ISO/IEC 27001

NIST SP 800-53

CIS Controls

OWASP Top 10

9. In compliance assessments, what is the significance of data classification?

It determines protection levels and testing priorities

It eliminates the need for encryption

It reduces audit costs

It automatically fixes vulnerabilities

10. What does a Statement of Work (SOW) document typically include?

Scope, timeline, deliverables, and cost

Only the final vulnerability list

Employee vacation schedules

Hardware specifications only

11. What is the primary purpose of defining the scope in a penetration test engagement?

To establish legal boundaries and authorized testing targets

To increase the duration of the assessment

To reduce the cost of testing

To exclude critical systems from testing

12. PCI-DSS compliance is primarily concerned with protecting which type of information?

Payment card data

Medical records

Student enrollment data

Employee contact information

13. What is the purpose of a kick-off meeting in the planning phase?

To align stakeholders on objectives, scope, and expectations

To deploy security patches

To conduct the final penetration test

To archive assessment reports

14. When defining testing constraints, which element specifies the timeframe for the assessment?

Testing window

Asset inventory

Vulnerability threshold

Risk tolerance level

15. HIPAA compliance requirements primarily protect which type of data?

Protected Health Information (PHI)

Payment card data

Trade secrets

Employee performance records

16. What is the primary benefit of obtaining written authorization before penetration testing?

Legal protection and liability mitigation

Guaranteed system access

Automatic vulnerability remediation

Elimination of all security risks

17. Which of the following is a key component of the scoping process?

Identifying in-scope and out-of-scope assets

Purchasing testing equipment

Hiring additional staff

Scheduling server maintenance

18. In the planning phase, what does a threat model help identify?

Potential vulnerabilities and attack vectors

Network bandwidth requirements

Employee training schedules

Hardware refresh cycles

19. What compliance framework emphasizes protecting personal data and privacy across EU member states?

GDPR

HIPAA

PCI-DSS

SOC 2

20. Which document formally authorizes a penetration test and defines authorized activities?

Rules of Engagement (RoE)

System Design Document

Network topology map

Incident response plan

PenTest+ V2 Compliance Based Assessment Requirements Quiz