Legal and Ethical Compliance PT0-003 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester is hired to test a client's systems. The client's authorization letter includes a clause that says the tester is not liable for any damages caused during the test. What should the tester do?

   • AReject the clause because it is unethical.
   • BIgnore the clause and proceed with the test.
   • CAccept the clause as it is, since it protects the tester.
   • DReview the clause with legal counsel to ensure it is valid and provides adequate protection.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A penetration tester is conducting an assessment for a client that processes credit card payments. Which regulation or standard is most likely to be relevant to the testing activities?

   • AHIPAA
   • BGDPR
   • CPCI DSS
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a mandatory reporting requirement that a penetration tester must comply with?

   • AReporting any discovered personal data breach to the relevant data protection authority.
   • BReporting all discovered vulnerabilities to the client in the final report.
   • CReporting the test results to the local police.
   • DReporting the tester's hourly billing to the client.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is hired to assess a company that operates in multiple countries, including countries with strict data protection laws. The tester is based in a country with less strict laws. During the test, the tester accesses personal data of individuals in a country with strict laws. What should the tester consider?

   • AThe tester should only test systems that do not contain personal data.
   • BThe tester's local laws apply, so no additional compliance is needed.
   • CThe tester should obtain a legal opinion from their own country's authorities.
   • DThe tester must comply with the data protection laws of the country where the data resides.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it critical for a penetration tester to obtain a signed authorization letter before starting any testing activities?

   • AIt guarantees the testing will be free of errors.
   • BIt provides legal protection for the tester and the client by documenting consent.
   • CIt is required to obtain a testing license from the government.
   • DIt ensures the tester has the necessary technical skills.
   Reveal Solution Discussion Select an answer first