312-50 Question 319
Single answer▪ Attack Authorization SchemesA consulting firm is preparing to perform a penetration test against a retail company's externally accessible systems. During the kickoff meeting, the client's IT manager verbally approves testing of the public web application and VPN gateway. However, the legal department has not yet signed the rules of engagement, and the cloud hosting provider has separate acceptable-use restrictions. The lead ethical hacker wants to avoid unauthorized activity and ensure the engagement is legally defensible. What should the tester do FIRST before launching any scans or exploitation attempts?
- A
Begin only with passive reconnaissance because it does not require formal authorization
- B
Proceed with testing because the client's IT manager has operational control over the target systems
- C
Obtain a signed written authorization defining scope, timing, targets, and limitations, and confirm any required third-party permissions
- D
Ask the SOC team to monitor for alerts during testing and start low-intensity vulnerability scans
Show answer and explanation
Correct answer: C
Explanation
Attack authorization schemes in ethical hacking are centered on explicit, documented permission before any assessment activity begins. In real engagements, verbal approval is not sufficient protection for the tester or the client. Best practice is to use a signed authorization letter and rules of engagement that define scope, objectives, permitted techniques, testing windows, communication paths, and liability boundaries. This is especially important when cloud platforms, ISPs, managed service providers, or other third parties are involved, because their acceptable-use policies may require additional approval or notification. CEH-aligned methodology emphasizes obtaining formal authorization before reconnaissance, scanning, or exploitation to ensure the test remains within legal and contractual boundaries. Industry best practices such as a Statement of Work, Rules of Engagement, and documented approvals support defensible, authorized testing.
- A. Incorrect.
Incorrect. Passive reconnaissance is generally less intrusive than active testing, but it can still create legal and contractual issues if performed without proper authorization. In CEH practice, the key principle is that all testing activity must be explicitly authorized and documented before execution, especially when third-party infrastructure or provider terms may apply.
- B. Incorrect.
Incorrect. Operational involvement from an IT manager is not a substitute for formal authorization. A common mistake is assuming technical ownership equals legal authority. In a professional engagement, authorization should come from an appropriately authorized representative and be documented in a signed agreement such as a rules of engagement or authorization to test.
- C. Correct.
Correct. The tester should first obtain formal written authorization that clearly defines in-scope assets, approved methods, time windows, points of contact, restrictions, and escalation procedures. Because the systems involve a cloud hosting provider, the team should also verify whether the provider requires prior notice or separate approval. This is the safest and most professionally appropriate step under attack authorization schemes.
- D. Incorrect.
Incorrect. Coordinating with the SOC is useful for safety and deconfliction, but it does not replace legal authorization. Starting even low-intensity scans before written approval and third-party clearance are in place could exceed permitted activity and expose both the tester and client to contractual or legal problems.