CISA · Question #189
When planning an internal penetration test, which of the following is the MOST important step prior to finalizing the scope of testing?
The correct answer is A. Obtaining management's consent to the testing scope in writing. Written authorization from management is the foundational prerequisite for any penetration test. Without it, testing could legally constitute unauthorized access - exposing testers and the organization to significant legal risk regardless of intent. Written consent also…
Question
When planning an internal penetration test, which of the following is the MOST important step prior to finalizing the scope of testing?
Options
- AObtaining management's consent to the testing scope in writing
- BAgreeing on systems to be excluded from the testing scope with the IT department
- CEnsuring the scope of penetration testing is restricted to the test environment
- DNotifying the IT security department regarding the testing scope
How the community answered
(26 responses)- A85% (22)
- B8% (2)
- C4% (1)
- D4% (1)
Explanation
Written authorization from management is the foundational prerequisite for any penetration test. Without it, testing could legally constitute unauthorized access - exposing testers and the organization to significant legal risk regardless of intent. Written consent also establishes accountability, defines boundaries, and protects all parties if systems are inadvertently impacted. Agreeing on exclusions with IT (B), restricting scope to test environments (C), and notifying the security department (D) are all important coordination steps, but they are subordinate to having formal management authorization in writing first.
Topics
Community Discussion
No community discussion yet for this question.