712-50 Question 345
Single answerIdentify different vulnerabilities associated with information systems and legal issues involved in penetration testingA newly appointed CISO authorizes an external firm to perform a penetration test of the company's customer-facing environment before a major product launch. During scoping, the provider proposes testing the production web application, cloud-hosted APIs, and the public IP range used by a third-party payment gateway integrated into the application. The statement of work only says "external penetration test of internet-facing systems" and does not define testing windows, excluded assets, data handling requirements, or authorization from third parties. Which action should the CISO take FIRST to reduce both technical and legal risk while still enabling an effective assessment?
- A
Approve the test immediately because internet-facing systems are implicitly in scope and production testing provides the most realistic results
- B
Require a revised rules-of-engagement document that explicitly defines in-scope assets, excludes third-party systems unless written authorization is obtained, specifies testing methods and windows, and addresses handling of sensitive data and discovered vulnerabilities
- C
Instruct the provider to avoid exploitation and perform only automated vulnerability scanning so that legal authorization is less important
- D
Ask the internal infrastructure team to monitor for outages during testing and proceed, since operational oversight is the primary control needed for production penetration tests
Show answer and explanation
Correct answer: B
Explanation
The best first action is to formalize authorization and scope through a detailed rules-of-engagement document before testing starts. From a vulnerability-management perspective, production web applications and APIs may contain issues such as injection flaws, broken access control, authentication weaknesses, insecure configurations, exposed secrets, and API authorization errors. However, identifying these vulnerabilities through penetration testing must be balanced with legal and operational controls. A third-party payment gateway is a major red flag because the organization may integrate with it without owning the infrastructure; testing it without explicit written permission can breach contracts, acceptable use policies, and laws governing unauthorized access. Best practice is to define scope precisely, verify asset ownership, obtain written authorization from all relevant parties, document permitted techniques and timing, establish emergency contacts and stop conditions, and set requirements for protecting any sensitive data encountered. This approach aligns with widely accepted penetration testing governance practices reflected in documents such as NIST SP 800-115 on technical security testing and assessment, as well as common rules-of-engagement frameworks used by professional testing firms.
- A. Incorrect.
This is incorrect because public exposure does not create legal permission to test. Internet-facing assets may include systems owned or managed by third parties, and testing them without explicit authorization can create contractual, civil, regulatory, and potentially criminal issues depending on jurisdiction. Proceeding without clear scope and rules of engagement also increases the chance of service disruption, data exposure, or impact on production systems.
- B. Correct.
This is correct because the immediate governance need is to establish explicit authorization and testing boundaries before any activity begins. A proper rules-of-engagement or authorization package should identify exact targets, ownership, testing limitations, approved techniques, time windows, points of contact, incident escalation procedures, and data handling requirements. It should also address third-party hosted or managed services, since those often require separate written approval under contracts and acceptable use terms. This action reduces legal exposure while improving the quality and defensibility of the assessment.
- C. Incorrect.
This is incorrect because limiting work to scanning does not remove the need for authorization. Vulnerability scanning can still affect availability, trigger defensive controls, violate cloud or provider terms, and interact with systems not owned by the organization. It also does not solve the scoping problem around the third-party payment gateway. The misconception is that less intrusive testing is automatically legally safe; in practice, permission and scope remain essential.
- D. Incorrect.
This is incorrect because operational monitoring is useful but secondary. Monitoring helps detect and respond to adverse effects, but it does not address the core legal and governance deficiencies: undefined scope, lack of third-party authorization, unspecified testing windows, and no agreement on sensitive data handling. The misconception is prioritizing operational readiness over lawful authority and clear engagement terms.