PenTest+ V2 Target Asset Inventory and Selection

1. Which stakeholder should primarily validate the asset inventory and target selection?

IT security team

External auditors

Client project sponsor and technical leads

Penetration testers only

2. The final asset inventory and target selection should be documented in which engagement deliverable?

Executive summary report

Rules of engagement and scope document

Technical findings report

Invoice and billing statement

3. When prioritizing assets for testing, what role does regulatory compliance play?

It has no impact on selection

Compliance-critical systems must be prioritized in scope

It only applies to large enterprises

It reduces the asset inventory size

4. Which of these is NOT typically included in an asset inventory for penetration testing?

Operating systems and versions

Running services and applications

Employee personal phone numbers

Network segments and IP ranges

5. An asset inventory reveals duplicate systems with different names. What should the tester do?

Test all instances separately

Clarify with the client to eliminate confusion and reduce redundant testing

Exclude them from scope

Test only the oldest version

6. How should sensitive assets be handled when creating the scope document?

List them with full details in the public scope

Exclude them entirely from testing

Include with restricted access and separate authorization

Test them without client notification

7. Which approach best ensures all relevant assets are identified during inventory?

Relying solely on IT staff recollection

Network scanning combined with documentation review

Testing only visible systems

Asking end-users about their systems

8. When identifying assets, which systems are typically considered MOST critical?

Test and development environments

Employee workstations

Systems processing payment or healthcare data

Archived legacy systems

9. What is the relationship between asset inventory and scope creep during a penetration test?

They are unrelated

A well-defined inventory prevents undocumented systems from being added later

Inventory increases scope creep

Scope creep eliminates the need for inventory

10. A client's network includes cloud-hosted systems. How should these be handled in asset selection?

Exclude them automatically

Include only if client has cloud provider written approval

Test them without additional authorization

Include all cloud systems by default

11. Which document should be used to identify all systems, applications, and infrastructure within the target environment?

Asset inventory or CMDB

Incident response plan

Disaster recovery procedure

Business continuity policy

12. What information is typically needed to create an accurate asset inventory?

Only IP addresses and hostnames

System type, OS, applications, owner, and criticality

Employee names and departments only

Physical hardware serial numbers exclusively

13. During asset selection, which of these should be excluded from the scope without special approval?

Web applications

Third-party managed systems without client authorization

Internal databases

Email servers

14. What is the purpose of defining system boundaries during the scoping process?

To limit testing only to approved systems and networks

To identify all vendors

To calculate total testing costs

To determine tester skill requirements

15. Which type of asset should typically receive the highest priority in a penetration test scope?

Development servers

Internet-facing systems handling sensitive data

Non-critical internal tools

Legacy systems no longer in use

16. A client requests testing of production systems. What is the primary concern when scoping this request?

Testing will be too expensive

Production system downtime and business impact

Testers lack required credentials

The client's budget is insufficient

17. What does CMDB stand for in asset management?

Configuration Management Database

Client Management Data Backup

Critical Machine Database

Compliance Monitoring Data Broker

18. When selecting targets for a penetration test, which factor should be prioritized first?

Client budget constraints

Tester availability

Client business objectives and risk tolerance

Ease of exploitation

19. Which of the following is the BEST method to classify assets by criticality in a penetration test scope?

Physical location only

Age of the system

Business impact and data sensitivity

Number of users accessing the system

20. What is the primary purpose of creating an asset inventory during the scoping phase?

To establish baseline metrics for future audits

To identify all potential targets and understand network topology

To document all vendor relationships

To create a disaster recovery backup

PenTest+ V2 Target Asset Inventory and Selection Quiz