PT0-002 · Question #59
A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against…
The correct answer is A. Ensure the client has signed the SOW. Before any penetration test begins - regardless of the environment - the client must have signed the Statement of Work (SOW). Without a signed SOW, the tester has no legal authorization to conduct any activities. Testing a hot site without written authorization exposes the…
Question
A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity. Which of the following is the MOST important action to take before starting this type of assessment?
Options
- AEnsure the client has signed the SOW.
- BVerify the client has granted network access to the hot site.
- CDetermine if the failover environment relies on resources not owned by the client.
- DEstablish communication and escalation procedures with the client.
How the community answered
(64 responses)- A84% (54)
- B8% (5)
- C3% (2)
- D5% (3)
Explanation
Before any penetration test begins - regardless of the environment - the client must have signed the Statement of Work (SOW). Without a signed SOW, the tester has no legal authorization to conduct any activities. Testing a hot site without written authorization exposes the tester to criminal liability. While option C (verifying third-party resource ownership) is an important scoping concern specific to hot sites, it is addressed during SOW creation. Legal authorization via a signed document is the prerequisite for everything else and must come first.
Topics
Community Discussion
No community discussion yet for this question.