QuestionQ55

VerifiedPenetration Testing Scoping and Engagement Methodology

Fred owns a company named Skyfeit Ltd. and wants to assess the enterprise network for any vulnerabilities and loopholes. He hired a third-party penetration-testing team to test his organizational infrastructure. Fred briefed the team on his network infrastructure and supplied a set of IP addresses on which they may conduct tests. He strictly instructed them not to perform DDoS attacks or access the company’s domain servers.

He also told them they could conduct the penetration tests while regular employees are working because those employees have no knowledge of the activity. However, he required the team to ensure that business continuity is not interrupted. He further informed the penetration-testing team that they have only 1 month to perform the test and submit the report.

What type of penetration test did Fred ask the third-party penetration-testing team to perform?

Explanation

Unannounced testing is authorized and scoped by the engagement sponsor, but the broader employee population is not informed that the test is taking place. The testers may still receive target details, operational restrictions, and a reporting deadline; those rules of engagement do not make the activity announced to employees.

Community Discussion

No comments yet. Be the first to start the discussion!