PenTest+ level · Domain 1.0 Engagement Management · 13% of the mapped exam

1.1 Summarize pre-engagement activities.

32 topics · 4 quiz questions

Penetration testing is only legal and useful when scope, permission and rules are agreed in writing before any testing starts. Most pentest disasters are scoping failures.

Scope definition

Regulations, frameworks, and standards: Requirements that shape the test, such as PCI DSS requiring segmentation testing or privacy laws limiting data handling.
Privacy: How personal data encountered during testing is protected, minimised and reported.
Security: How the tester protects client data, findings and access during the engagement.
Rules of engagement: The agreed do's and don'ts: what, when, how and who to call.
Exclusions: Systems, techniques or times that are out of bounds (e.g. no denial of service, no production database writes).
Test cases: Specific scenarios the client wants tested, such as "can a standard user reach payroll data?"
Escalation process: Who to contact and how if the tester finds a critical issue, evidence of a real attacker or causes an outage.
Testing window: Approved dates and hours for testing activity.
Target selection: Exactly which assets are in scope.
Classless Inter-Domain Routing (CIDR) ranges: In-scope network ranges such as 203.0.113.0/24; verify ownership before testing.
Domains: In-scope domain names and whether subdomains are included.
Internet Protocol (IP) addresses: Specific in-scope hosts.
Uniform Resource Locator (URL): Specific in-scope web applications or paths.

Agreement types

Agreement types: The contracts that make testing lawful and define obligations.
Non-disclosure agreement (NDA): Keeps client information and findings confidential.
Master service agreement (MSA): Umbrella terms for an ongoing relationship; individual tests are added under it.
Statement of work (SoW): Defines this engagement: scope, deliverables, timeline and cost.
Terms of service (ToS): Third-party platform terms (cloud providers, SaaS) that may restrict what can be tested.

Shared responsibility model

Hosting provider responsibilities: The provider secures the underlying platform; testing it usually requires its own permission or is prohibited.
Customer responsibilities: What the client configures and owns, which is what you can normally test.
Penetration tester responsibilities: Stay in scope, protect data, report accurately and avoid harm.
Third-party responsibilities: Vendors hosting in-scope assets must authorise testing of their systems.

Legal and ethical considerations

Authorization letters: Signed permission from someone with authority over the targets, often called the "get out of jail free" letter. Carry it during physical tests.
Mandatory reporting requirements: Some findings (e.g. evidence of a breach, illegal content) may legally require reporting to the client or authorities.
Risk to the penetration tester: Legal and physical risk if scope or authorisation is unclear, especially in physical and social engineering tests.

Assessment types

Web: Testing web applications.
Network: Testing internal or external networks and hosts.
Mobile: Testing mobile apps and their back ends.
Cloud: Testing cloud configurations, identities and workloads within provider rules.
Application programming interface (API): Testing API authentication, authorisation and input handling.
Application: Testing thick-client or other applications.
Wireless: Testing Wi-Fi and other wireless networks.

Check your understanding

Loading quiz…

1.2 next >

Original CoreQ Academy material, mapped to objective 1.1 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.