Legal and Ethical Compliance PT0-003 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is hired by a company to test its network. The company has a strict policy that all testing must be performed from a specific IP address. The authorization letter includes this IP address. However, during the test, the tester's VPN connection drops, and the tester reconnects using a different IP address. What should the tester do?

   • AContinue testing but note the IP change in the final report.
   • BReconfigure the VPN to use the original IP address and continue testing.
   • CContinue testing from the new IP address, as the authorization letter is for the company, not the IP.
   • DStop testing and inform the client about the IP change, requesting approval to continue from the new IP.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is hired to assess a healthcare organization's patient portal. The organization is subject to HIPAA. The tester has a signed authorization letter but the letter does not mention HIPAA compliance. What should the tester do to ensure regulatory adherence?

   • AAsk the organization to update the authorization letter to include a HIPAA compliance clause.
   • BProceed with the test as usual, since the authorization letter is sufficient.
   • CRefuse to conduct the test until the organization provides a HIPAA-specific authorization letter.
   • DEnsure that the testing methodology and handling of any discovered data comply with HIPAA requirements, such as protecting PHI and reporting breaches.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is hired to test a company's cloud infrastructure. The company uses a cloud provider that has specific terms of service regarding penetration testing. What should the tester do?

   • AConduct the test only on the client's own infrastructure, not the cloud provider's.
   • BAsk the client to sign a waiver that releases the tester from any liability related to the cloud provider's terms.
   • CReview the cloud provider's penetration testing policy and ensure the test complies with it.
   • DIgnore the cloud provider's terms of service because the client has authorized the test.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A penetration tester is about to start an engagement with a new client. The client has provided a signed authorization letter, but the tester notices that the letter does not include the names of the testers who will be performing the work. What should the tester do?

   • AHave each tester sign the authorization letter before starting.
   • BAsk the client to update the authorization letter to include the names of all testers involved.
   • CProceed with the test, as the authorization letter is for the company, not individuals.
   • DStart the test and add the names later if needed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is conducting an assessment for a financial institution. During the test, the tester discovers evidence of an ongoing data breach that involves customer financial records. The authorization letter does not mention any specific reporting requirements for such discoveries. What should the tester do first?

   • AStop testing and immediately notify the client's designated point of contact about the breach evidence.
   • BImmediately contact law enforcement to report the breach.
   • CDocument the finding in the final report and do not mention it until the report is delivered.
   • DContinue testing to gather more evidence before reporting, to provide a comprehensive report.
   Reveal Solution Discussion Select an answer first