Planning and Scoping PT0-003 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester is planning an engagement for a retail company that runs a major online sale every month. The company wants to test its e-commerce platform but cannot afford any downtime during the sale. Which testing window is most appropriate?

   • ADuring the sale, to test the platform under peak load conditions.
   • BThe week immediately before the monthly sale, to identify and fix vulnerabilities before the sale.
   • CAny time, as long as the tester uses non-destructive techniques.
   • DThe week immediately following the monthly sale, when traffic is lower and the platform is stable.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is planning an engagement for a utility company. The company wants to test its SCADA systems but cannot afford any disruption to the power grid. Which testing window is most appropriate?

   • ADuring scheduled maintenance windows, when the SCADA systems are already offline or isolated.
   • BDuring off-peak hours, such as late night, when demand is lower.
   • CAny time, as long as the tester uses non-destructive techniques.
   • DDuring peak demand hours, to test the SCADA systems under real-world conditions.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A penetration tester is contracted to test a financial institution's internal network. The rules of engagement state that testing is allowed only between 10 PM and 2 AM on weekdays. During the test, the tester discovers a critical vulnerability in a legacy application that is only accessible during business hours. The client's IT team is available only during business hours. What should the tester do?

   • ASkip the legacy application and report it as untested, since the rules of engagement do not allow testing it.
   • BTest the legacy application during business hours without informing the client, since the vulnerability is critical.
   • CStop the test and request a change to the rules of engagement to allow testing during business hours.
   • DContinue testing the legacy application during the allowed window, even if it means accessing it outside business hours.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester is engaged to test a financial institution's trading platform. The rules of engagement specify that testing is allowed only between 1 AM and 5 AM on Saturdays. The tester discovers that a critical vulnerability in the trading engine can only be tested during market hours when the system is under load. The client's security team is available only during market hours. What should the tester do?

   • ASkip the vulnerability and report it as untested, since the rules of engagement do not allow testing it.
   • BStop testing and request a change to the rules of engagement to allow testing during market hours.
   • CTest the vulnerability during market hours without informing the client, since it is critical.
   • DTest the vulnerability during the allowed window, even if it means the results are not fully accurate.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is scoping an engagement for a regional bank. The bank's compliance team insists that all customer-facing web applications be tested, but the production database servers must not be touched under any circumstances. The tester needs to validate a SQL injection finding in a web application that connects to a production database. Which action is most appropriate?

   • AProceed with testing the web application but exclude the database from the final report to avoid mentioning the out-of-scope interaction.
   • BRequest a staging environment that mirrors the production web application and database, and test the vulnerability there.
   • CTest the web application in production but only use read-only queries to validate the SQL injection without modifying data.
   • DTest the web application in production and include the database server in scope to fully validate the finding.
   Reveal Solution Discussion Select an answer first