PenTest+ V2 Scope Creep and Change Control

Submit

3. What is the primary benefit of documenting all scope decisions and change approvals?

To create unnecessary paperwork

To establish accountability and provide legal protection

To slow down the testing process

To prevent communication with stakeholders

4. True or False: Penetration testers should test systems beyond the stated scope if they believe it will improve security.

True

False

Submit

6. Which element should be clearly defined to prevent scope creep?

Specific IP ranges, domains, and systems included in testing

The tester's hourly rate

The client's financial budget only

The tester's personal schedule

7. True or False: Scope creep is beneficial because it allows testers to find more vulnerabilities and provide greater value.

True

False

Submit

9. Which of the following best describes the relationship between scope and project risk?

Larger scope always means higher risk

Scope defines what is tested; undefined scope increases project risk

Risk is unrelated to scope boundaries

Smaller scope always means lower cost

10. True or False: Testing production systems without explicit written scope approval is acceptable if the tester believes it is necessary.

True

False

11. What is the primary purpose of establishing clear scope boundaries in a penetration testing engagement?

To limit the tester's ability to find vulnerabilities

To define what systems, networks, and applications are included in testing

To reduce the cost of the engagement

To prevent the client from requesting additional tests

12. A tester discovers a critical vulnerability in a system marked as out-of-scope. What should the tester do?

Immediately exploit it to demonstrate impact

Document it and report it to the client for scope review

Ignore it and continue with in-scope testing

Perform additional testing without client approval

13. Which stakeholder role is typically responsible for approving scope changes during a penetration test?

The penetration tester

The project manager or client sponsor

The IT help desk

The network administrator

14. True or False: Scope boundaries should remain completely static throughout the entire engagement, regardless of findings.

True

False

Submit

16. A change control process in penetration testing should include which elements?

Verbal approval from any team member

Formal request, impact analysis, approval, and documentation

Only cost considerations

Client signature only

17. What is the most important reason to obtain written authorization before beginning a penetration test?

To protect the tester and organization from legal liability

To ensure the client pays the full invoice

To prevent competitors from learning about the test

To document the tester's experience level

18. True or False: A change request during an active penetration test should always be approved immediately to maximize testing coverage.

True

False

19. Which of the following is NOT a typical component of a penetration testing scope document?

Testing methodology and tools

In-scope and out-of-scope systems

Tester's personal background and certifications

Testing timeline and resource requirements

Submit

PenTest+ V2 Scope Creep and Change Control Quiz

1. Rules of engagement in penetration testing specify ____.

2.

What first name or nickname would you like us to use?

2. When a client requests testing of a system not in the original scope, the tester should first ____.

3. What is the primary benefit of documenting all scope decisions and change approvals?

4. True or False: Penetration testers should test systems beyond the stated scope if they believe it will improve security.

5. A scope change requires impact analysis to assess ____.

6. Which element should be clearly defined to prevent scope creep?

7. True or False: Scope creep is beneficial because it allows testers to find more vulnerabilities and provide greater value.

8. A client requests adding 50 new systems to testing mid-engagement. The tester should ____.

9. Which of the following best describes the relationship between scope and project risk?

10. True or False: Testing production systems without explicit written scope approval is acceptable if the tester believes it is necessary.

11. What is the primary purpose of establishing clear scope boundaries in a penetration testing engagement?

12. A tester discovers a critical vulnerability in a system marked as out-of-scope. What should the tester do?

13. Which stakeholder role is typically responsible for approving scope changes during a penetration test?

14. True or False: Scope boundaries should remain completely static throughout the entire engagement, regardless of findings.

15. Out-of-scope systems are those that ____.

16. A change control process in penetration testing should include which elements?

17. What is the most important reason to obtain written authorization before beginning a penetration test?

18. True or False: A change request during an active penetration test should always be approved immediately to maximize testing coverage.

19. Which of the following is NOT a typical component of a penetration testing scope document?

20. Scope creep in penetration testing refers to ____.