712-50 Question 343
Single answerDesign, develop and implement a penetration testing program based on penetration testing methodology to ensure organizational securityA newly appointed CISO is establishing an enterprise penetration testing program for a global company that has on-premises systems, cloud-hosted applications, and several critical third-party integrations. Past tests were ad hoc, disrupted a production payment service, and produced inconsistent reports that business leaders could not use for risk decisions. The board has now asked for a repeatable program that improves assurance while minimizing operational and legal risk. Which action should the CISO take FIRST to design and implement an effective penetration testing program based on sound methodology?
- A
Define formal rules of engagement, scope boundaries, test objectives, authorization, communication paths, and retest criteria before scheduling any testing
- B
Purchase an advanced exploitation platform so internal teams can standardize tooling across infrastructure, applications, and cloud environments
- C
Begin with full-scope red team exercises against production to quickly identify high-impact weaknesses across the enterprise
- D
Outsource all penetration tests to a reputable vendor and require annual executive summaries as the primary program deliverable
Show answer and explanation
Correct answer: A
Explanation
The best first action is to establish the governance foundation for the penetration testing program: scope, authorization, objectives, rules of engagement, communications, testing constraints, and retest/reporting requirements. In practice, this aligns with widely recognized penetration testing methodologies and guidance such as NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment), the Penetration Testing Execution Standard (PTES), and OWASP testing guidance for application components. These sources emphasize planning and pre-engagement activities before discovery, exploitation, or post-exploitation work. For a CISO, the leadership task is not simply to run tests, but to create a repeatable, risk-based program that integrates legal approval, asset criticality, third-party coordination, production safeguards, standardized reporting, remediation validation, and executive-level risk visibility. Once governance is defined, the organization can choose appropriate internal or external resources, testing frequency, methodologies for different environments, and maturity-enhancing activities such as red teaming.
- A. Correct.
Correct. A penetration testing program must begin with governance and methodology, not tooling or test execution. Formal rules of engagement (ROE) establish scope, authorized targets, prohibited actions, escalation contacts, testing windows, evidence handling, legal approval, and success criteria. This is especially important in a complex environment with production sensitivity, cloud assets, and third-party integrations. Defining objectives and boundaries first creates a repeatable, risk-based program and directly addresses the prior disruption and inconsistent reporting.
- B. Incorrect.
Incorrect. Tool standardization can improve operational consistency, but it is not the first step in building a penetration testing program. Without defined scope, authorization, testing methodology, and reporting requirements, better tooling may simply automate poorly governed testing. This option reflects the common misconception that a penetration testing program is primarily a technology acquisition effort rather than a governed assurance process.
- C. Incorrect.
Incorrect. Full-scope red teaming against production may be appropriate for mature organizations with established controls, ROE, monitoring, and stakeholder alignment, but it is not the right first step for a newly formalized program, especially after prior outages. Red team exercises are objective-driven simulations and usually sit alongside, not instead of, a broader penetration testing program. Starting here would increase operational risk without first establishing governance and repeatable methodology.
- D. Incorrect.
Incorrect. External providers can be valuable, but outsourcing does not remove the need for internal governance, scoping, methodology, and reporting standards. Annual executive summaries alone are insufficient because the CISO needs actionable findings, severity criteria, remediation tracking, retest expectations, and trend reporting. This option reflects the misconception that vendor reputation can substitute for program design and management.