Planning and Scoping PT0-003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During the planning phase of a penetration test, which factor is most important when selecting specific targets to include in the scope?

   • AThe targets are the most recently deployed systems
   • BThe targets are the systems with the highest number of known vulnerabilities
   • CThe targets are the most technically challenging systems
   • DThe targets are owned by the organization and are critical to its operations
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester is planning an engagement for a hospital that operates 24/7. The hospital's IT director wants to minimize disruption to patient care. Which testing window is most appropriate?

   • AWeekdays from 9 AM to 5 PM, when the IT staff is fully available to respond to issues.
   • BAny time, as long as the tester provides a 24-hour notice before starting the test.
   • CWeekday evenings from 6 PM to 10 PM, when most administrative staff have left but clinical operations continue.
   • DWeekends from 2 AM to 6 AM, when clinical activity is at its lowest and the impact of any disruption is minimized.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A penetration tester is engaged to test a bank's online banking platform. The rules of engagement specify that testing is allowed only between 2 AM and 4 AM on Sundays. The tester discovers that a critical vulnerability in the authentication system can only be tested during business hours when the system is under load. The bank's security team is available only during business hours. What should the tester do?

   • AStop testing and request a change to the rules of engagement to allow testing during business hours.
   • BTest the vulnerability during the allowed window, even if it means the results are not fully accurate.
   • CSkip the vulnerability and report it as untested, since the rules of engagement do not allow testing it.
   • DTest the vulnerability during business hours without informing the bank, since it is critical.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When scheduling a penetration test, which time frame is generally preferred to minimize disruption to normal business operations?

   • ADuring peak business hours
   • BDuring off-peak hours
   • CDuring an internal audit
   • DDuring a major product launch
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A penetration tester is engaged to test a healthcare provider's network. The rules of engagement specify that the tester must not access any system that stores protected health information (PHI). During reconnaissance, the tester discovers that a web application under test connects to a database that contains PHI. The tester needs to test the web application for SQL injection. What is the most appropriate action?

   • AStop testing and inform the client that the web application cannot be tested without accessing the PHI database.
   • BTest the web application but only use non-invasive techniques that do not interact with the database.
   • CTest the web application and include the PHI database in the scope, since it is necessary for the test.
   • DTest the web application but avoid sending any SQL injection payloads that could return PHI from the database.
   Reveal Solution Discussion Select an answer first