Q. What legal documents are important for penetration testers to understand before starting a penetration test?

View solution

Q. What is a document that defines the purpose of the work, what work will be done, what deliverables will be created, the timeline for the work, the price for the work, and any additional terms and conditions for a penetration test?

View solution

Q. What legal document helps enforce confidential relationships between two parties, outlining the parties, what information is considered confidential, how long the agreement lasts, when and how disclosure is acceptable, and how confidential information should be handled?

View solution

Q. What type of agreement asks an individual to agree not to take a job with a competitor or to directly compete with their employer in a future job, typically with a time-limited clause?

View solution

Q. What is an important consideration regarding data ownership after a penetration test ends?

View solution

Q. What is a crucial requirement for conducting penetration tests, whether conducted internally or as part of a contract between two parties?

View solution

Q. When conducting an internal penetration test, what should be ensured about the person approving the test?

View solution

Q. Why is indemnification language in the contract important for external penetration testers?

View solution

Q. Why might additional authorization be needed for penetration tests involving complex IT infrastructure?

View solution

Q. What is important for penetration testers to understand regarding laws and regulations when conducting tests internationally?

View solution

Q. What are examples of laws and regulations that have compliance requirements for covered organizations?

View solution

Q. What does the PCI DSS standard define regarding a cardholder data environment (CDE) penetration test?

View solution

Q. What is the General Data Protection Regulation (GDPR)?

View solution

Q. According to GDPR, what are individuals' rights regarding their personal information?

View solution

Q. Why can compliance-based assessments be challenging?

View solution

Q. What is the Gramm–Leach–Bliley Act (GLBA) primarily concerned with?

View solution

Q. What does SOX (Sarbanes–Oxley Act) set standards for?

View solution

Q. What is the primary focus of FIPS 140-2?

View solution

Q. What recommendation does NIST provide regarding penetration testing in the context of HIPAA?

View solution

Q. What is the purpose of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) requirement for a risk analysis?

View solution