Q. For external or commercial testers, what might the budget for a penetration test include?

View solution

Q. Which framework provides a knowledgebase of adversary tactics and techniques, including details of mitigations, threat actor groups, and software?

View solution

Q. What does the Open Web Application Security Project (OWASP) provide guides for?

View solution

Q. Which penetration testing standard covers pre-engagement interactions, scoping, and details such as dealing with third parties?

View solution

Q. What does the MITRE ATT&CK Framework stand for?

View solution

Q. What should be considered when using dated penetration testing standards?

View solution

Q. Which penetration testing methodology guide covers analysis, metrics, workflows, human security, physical security, and wireless security but has not been updated since 2010?

View solution

Q. Which organization provides standards that include penetration testing as part of NIST special publication 800-115?

View solution

Q. What is the last update year for the Information Systems Security Assessment Framework (ISSAF)?

View solution

Q. What should modern penetration testers be aware of regarding the ISSAF?

View solution

Q. What is suggested for organizations and individual penetration testers regarding standards and techniques?

View solution

Q. What legal documents are important for penetration testers to understand before starting a penetration test?

View solution

Q. What is a document that defines the purpose of the work, what work will be done, what deliverables will be created, the timeline for the work, the price for the work, and any additional terms and conditions for a penetration test?

View solution

Q. What legal document helps enforce confidential relationships between two parties, outlining the parties, what information is considered confidential, how long the agreement lasts, when and how disclosure is acceptable, and how confidential information should be handled?

View solution

Q. What type of agreement asks an individual to agree not to take a job with a competitor or to directly compete with their employer in a future job, typically with a time-limited clause?

View solution

Q. What is an important consideration regarding data ownership after a penetration test ends?

View solution

Q. What is a crucial requirement for conducting penetration tests, whether conducted internally or as part of a contract between two parties?

View solution

Q. When conducting an internal penetration test, what should be ensured about the person approving the test?

View solution

Q. Why is indemnification language in the contract important for external penetration testers?

View solution

Q. Why might additional authorization be needed for penetration tests involving complex IT infrastructure?

View solution