Legal and Ethical Compliance PT0-003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A penetration tester is about to begin an engagement. Which document formally grants the tester permission to perform the authorized testing activities and defines the scope and boundaries of the engagement?

   • AVulnerability assessment report
   • BAuthorization letter
   • CNon-disclosure agreement
   • DRules of Engagement
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A penetration tester is planning an engagement for a healthcare organization in the United States. Which regulation must the tester ensure the testing activities comply with?

   • ASOX
   • BPCI DSS
   • CHIPAA
   • DFERPA
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is conducting an assessment for a government agency. During the test, the tester discovers a vulnerability that could be exploited to access classified information. What is the tester's responsibility?

   • AReport the vulnerability only in the final report to the agency.
   • BContinue testing to see if the vulnerability can be exploited further before reporting.
   • CImmediately report the vulnerability to the agency's designated security contact.
   • DContact the media to expose the vulnerability.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is hired to perform a social engineering assessment for a client. The authorization letter includes permission to conduct phishing campaigns against employees. During the campaign, the tester accidentally sends a phishing email to a third-party vendor's email address that was not in the authorized list. What should the tester do?

   • AImmediately stop the campaign and inform the client about the accidental email, then work to mitigate any potential impact.
   • BSend a follow-up email to the vendor explaining the situation and apologizing.
   • CDelete the email from the vendor's inbox if possible and continue the campaign.
   • DIgnore the mistake and continue the campaign, as it was an accident.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration tester is conducting an assessment for a client. During the test, the tester discovers that the client's network is being actively exploited by an external attacker. The authorization letter does not specify procedures for this situation. What should the tester do?

   • AImmediately stop testing and notify the client's incident response team.
   • BContinue the test to gather more information about the attacker's activities.
   • CDocument the attacker's activities and include them in the final report.
   • DTry to block the attacker's activities using the tester's own tools.
   Reveal Solution Discussion Select an answer first