SY0-701 Question 452
Single answerRules of engagementA company hires a third-party security firm to perform a penetration test against its public-facing web applications and a limited set of internal systems. During the kickoff call, the company's operations manager says, "Do whatever you need to find issues, but do not risk taking production systems offline." Midway through the engagement, a tester identifies a vulnerable service on a production server and wants to run an exploit that could cause the service to crash. Which action should the tester take FIRST?
- A
Run the exploit immediately because identifying the full impact of the vulnerability is the main goal of a penetration test
- B
Proceed only after reviewing the rules of engagement and obtaining explicit authorization for potentially disruptive testing
- C
Skip documenting the issue until after the test is complete so the client is not alarmed unnecessarily
- D
Ask the system administrator informally for verbal approval and continue if the administrator agrees
Show answer and explanation
Correct answer: B
Explanation
Rules of engagement are a core control for penetration testing and other authorized security assessments. They establish what systems are in scope, what methods are allowed, when testing may occur, who must be notified, and what actions require special approval. In this scenario, the key issue is not whether the vulnerability is real, but whether potentially disruptive exploitation is authorized. Best practice is to review the signed engagement documents, including the rules of engagement and statement of work, and use the documented escalation path before conducting any action that could affect availability. This aligns with common penetration testing governance practices and professional guidance emphasizing written authorization, scope control, and minimizing operational impact.
- A. Incorrect.
This is incorrect because penetration tests are constrained by scope, authorization, and safety requirements. Even if exploitation could demonstrate impact, testers must follow the agreed rules of engagement (RoE). If disruptive testing was restricted or not explicitly approved, running the exploit could violate the contract and cause unauthorized outage.
- B. Correct.
This is correct because the rules of engagement define scope, allowed techniques, timing, escalation paths, and restrictions such as avoiding denial-of-service conditions or production outages. When a test could disrupt production, the tester should confirm whether that action is permitted and obtain explicit authorization through the approved process before proceeding.
- C. Incorrect.
This is incorrect because findings and testing decisions should be documented throughout the engagement, especially when a potentially critical issue is discovered. Delaying documentation does not address the authorization problem and could create issues with evidence handling, communication, and reporting.
- D. Incorrect.
This is incorrect because informal verbal approval from a system administrator may not satisfy the contractual or legal authorization requirements of the engagement. Approval should follow the documented escalation and authorization path in the rules of engagement, statement of work, or similar engagement documents.