PT0-002 · Question #223
A penetration tester received a 16-bit network block that was scoped for an assessment. During the assessment, the tester realized no hosts were active in the provided block of IPs and reported this…
The correct answer is B. Update the ROE with new signatures. After a client provides updated IP addresses for an assessment due to an initial scope mismatch, the most appropriate next step for a penetration tester is to formally update the Rules of Engagement (ROE) to reflect the new scope.
Question
A penetration tester received a 16-bit network block that was scoped for an assessment. During the assessment, the tester realized no hosts were active in the provided block of IPs and reported this to the company. The company then provided an updated block of IPs to the tester. Which of the following would be the most appropriate NEXT step?
Options
- ATerminate the contract.
- BUpdate the ROE with new signatures.
- CScan the 8-bit block to map additional missed hosts.
- DContinue the assessment.
How the community answered
(31 responses)- A6% (2)
- B74% (23)
- C16% (5)
- D3% (1)
Why each option
After a client provides updated IP addresses for an assessment due to an initial scope mismatch, the most appropriate next step for a penetration tester is to formally update the Rules of Engagement (ROE) to reflect the new scope.
Terminating the contract is an extreme measure not warranted when the client is actively collaborating to provide correct scope information.
Any change to the scope of a penetration test, such as receiving new IP addresses, must be formally documented and updated within the Rules of Engagement (ROE) to ensure legal compliance and clear understanding between the tester and client.
An '8-bit block' (a /8 network) is significantly larger than the initial '16-bit block' (a /16 network), and scanning an arbitrarily larger block is unlikely to be the correct or most efficient next step when specific 'updated IPs' are provided.
While the assessment will continue, updating the ROE to reflect the new scope is a critical administrative and ethical step that precedes resuming technical assessment activities with the new targets.
Concept tested: Penetration testing scope and Rules of Engagement (ROE)
Source: https://www.nist.gov/document/nist-sp-800-115-technical-guide-information-security-testing-and-assessment
Topics
Community Discussion
No community discussion yet for this question.