CompTIA CompTIA PenTest+ PT0-002 Questions & Answers

• Question 281:

  The delivery of a penetration test within an organization requires defining specific parameters regarding the nature and types of exercises that can be conducted and when they can be conducted. Which of the following BEST identifies this concept?

  A. Statement of work

  B. Program scope

  C. Non-disclosure agreement

  D. Rules of engagement

  Correct Answer: D

  Rules of engagement (ROE) is a document that outlines the specific guidelines and limitations of a penetration test engagement. The document is agreed upon by both the penetration testing team and the client and sets expectations for how the test will be conducted, what systems are in scope, what types of attacks are allowed, and any other parameters that need to be defined. ROE helps to ensure that the engagement is conducted safely, ethically, and with minimal disruption to the client's operations.