A consulting company is completing the ROE during scoping. Which of the following should be included in the ROE?

The correct answer is C. Testing restrictions. The Rules of Engagement (ROE) is a document that defines the specific boundaries, constraints, and authorizations for conducting a penetration test. Testing restrictions - such as which systems are in scope, prohibited techniques, testing windows (time of day), and off-limits…

Planning and Scoping

Question

Options

ACost of the assessment
BReport distribution
CTesting restrictions
DLiability

How the community answered

(32 responses)

A
6% (2)
B
3% (1)
C
91% (29)

Explanation

The Rules of Engagement (ROE) is a document that defines the specific boundaries, constraints, and authorizations for conducting a penetration test. Testing restrictions - such as which systems are in scope, prohibited techniques, testing windows (time of day), and off-limits targets - are the core content of the ROE. The cost of the assessment (A) belongs in the statement of work (SOW) or contract. Report distribution (B) is typically addressed in the final report plan or contract. Liability (D) is covered in the master services agreement (MSA) or legal contract, not the ROE.

Topics

#Rules of Engagement#Scoping#Engagement Planning#Penetration Testing

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice