Planning and Scoping PT0-003 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A penetration tester is engaged to test a government agency's network. The rules of engagement specify that the tester must not access any system classified as 'top secret.' During the test, the tester discovers that a web application under test connects to a database that contains 'top secret' information. The tester needs to test the web application for SQL injection. What is the most appropriate action?

   • ATest the web application but only use non-invasive techniques that do not interact with the database.
   • BTest the web application and include the 'top secret' database in the scope, since it is necessary for the test.
   • CStop testing and inform the client that the web application cannot be tested without accessing the 'top secret' database.
   • DTest the web application but avoid sending any SQL injection payloads that could return 'top secret' data.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is scoping an engagement for a university. The university wants to test its student information system, but the registrar's office has requested that the test not interfere with final exam grading. Which target selection approach is most appropriate?

   • AInclude the student information system in scope but exclude the grading module from testing.
   • BInclude the entire student information system in scope, including the grading module, to ensure a thorough test.
   • CTest only the network infrastructure, not the student information system, to avoid any risk.
   • DTest the student information system only after final exam grading is complete.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which document defines the boundaries of a penetration test, including the systems that may be targeted, the techniques that may be used, and the times when testing is permitted?

   • ARules of Engagement
   • BMemorandum of Understanding
   • CStatement of Work
   • DNon-Disclosure Agreement
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is planning an engagement for a transportation company. The company wants to test its ticketing system but cannot afford any disruption during peak travel times. Which testing window is most appropriate?

   • ADuring off-peak travel times, such as late night or early morning, when the ticketing system is less critical.
   • BDuring the weekdays, when the company's IT staff is available to respond to issues.
   • CDuring any time, as long as the tester uses non-destructive techniques.
   • DDuring peak travel times, to test the ticketing system under real-world conditions.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A penetration tester is defining the scope of an engagement. Which of the following should be included as a target?

   • AAll systems connected to the organization's network, including third-party hosted services
   • BSystems that are not owned by the organization but are accessible from the network
   • COnly the systems explicitly listed in the Rules of Engagement
   • DAny system that the tester discovers during the engagement
   Reveal Solution Discussion Select an answer first