Scope and written authorisation for a penetration test

Tip: Choose Save as PDF in the print dialog to download. Use A4 paper size.

Scope and written authorisation for a penetration test

Name:
Date:
Class:
A

Quick Questions

Shade in the A or B circle for each question.

1. A penetration tester wants to start scanning a company's servers. What must they have first?
A A verbal OK from any employee
B Written permission from the system owner
2. Which statement about the scope of a penetration test is correct?
A It lists the systems, methods and time window the tester may use
B It lets the tester try anything once they are inside the network
3. A tester's written permission covers only the company's web server. They also probe the payroll database server. What is this?
A Good practice, because it finds more weaknesses
B Testing outside scope, which is illegal
4. What do the rules of engagement set out?
A How and when the testing may be done, such as allowed methods and test times
B Which hacking tools are the most popular with testers
5. The written authorisation allows testing only between 10 pm and 2 am on Saturday. When may the tester run the tests?
A Only between 10 pm and 2 am on Saturday
B Any time that week, as long as the target is in scope
B

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left columnRight column
1scope: 10.0.5.0/24, web-server-1 AThe target is outside the agreed scope. Testing it without authorisation is illegal, even if it is close to the approved systems.
2window: 22 Jun, 1am to 5am BLists the exact systems the tester is allowed to test. Anything not listed is off limits.
3Rules of engagement say which methods a tester may use, and which are banned. CSets the time window in which testing is permitted. Testing outside these hours is not authorised.
4Testing is only legal while it stays inside the written authorisation. If a target is outside it, the tester must stop. DPermission must be written and signed by the system owner. A verbal OK is not reliable proof of authorisation.
5permission: verbal OK from a manager Eallow: port scan | deny: DoS attack
6target: 10.0.9.7 # not in scope, test anyway Fif target not in scope: stop_test()
C

Definitions

written authorisation
D

Fill in the Blanks

Complete each line of code by filling in the missing parts.

1.
scope ← ["10.0.0.5", "shop.test"] IF target NOT IN _____ THEN STOP
2.
IF signedAuthorisation = _____ THEN STOP
3.
IF now < startTime __ now > endTime THEN STOP
4.
allowedMethods ← ["port scan", "web test"] IF method NOT IN ______________ THEN STOP
5.
IF target IN scope THEN RUN test ____ STOP
E

Spot the Error

Shade in the letter of the line that contains an error.

Question 1
A IF signedPermit = FALSE THEN
B RUN test(scopeList)
C ELSE
D STOP
Question 2
A target <- 10.0.0.5
B scope <- [10.0.0.5, 10.0.0.6]
C IF target IN scope THEN
D scan(10.0.0.9)
Question 3
A start <- 900
B end <- 1700
C IF now >= start OR now <= end
D RUN test()
Question 4
A owner <- "Acme Ltd"
B signedBy <- tester
C IF signedBy = owner THEN
D RUN test()
Question 5
A IF target NOT IN scope THEN
B OUTPUT "Out of scope"
C RUN test(target)

Answer Key

Scope and written authorisation for a penetration test
Section A: Quick Questions
Q1
B — Written permission from the system owner
Q2
A — It lists the systems, methods and time window the tester may use
Q3
B — Testing outside scope, which is illegal
Q4
A — How and when the testing may be done, such as allowed methods and test times
Q5
A — Only between 10 pm and 2 am on Saturday
Section B: Match the Pairs
Q1
scope: 10.0.5.0/24, web-server-1 → Lists the exact systems the tester is allowed to test. Anything not listed is off limits.
Q2
window: 22 Jun, 1am to 5am → Sets the time window in which testing is permitted. Testing outside these hours is not authorised.
Q3
Rules of engagement say which methods a tester may use, and which are banned. → allow: port scan | deny: DoS attack
Q4
Testing is only legal while it stays inside the written authorisation. If a target is outside it, the tester must stop. → if target not in scope: stop_test()
Q5
permission: verbal OK from a manager → Permission must be written and signed by the system owner. A verbal OK is not reliable proof of authorisation.
Q6
target: 10.0.9.7 # not in scope, test anyway → The target is outside the agreed scope. Testing it without authorisation is illegal, even if it is close to the approved systems.
Section C: Definitions
Q1
written authorisation — Written permission from the system owner that sets the scope: which systems, methods and time window a tester may use. Testing outside it is illegal.
Section D: Fill in the Blanks
Q1
scope ← ["10.0.0.5", "shop.test"] IF target NOT IN scope THEN STOP
Q2
IF signedAuthorisation = FALSE THEN STOP
Q3
IF now < startTime OR now > endTime THEN STOP
Q4
allowedMethods ← ["port scan", "web test"] IF method NOT IN allowedMethods THEN STOP
Q5
IF target IN scope THEN RUN test ELSE STOP
Section E: Spot the Error
Q1
A — The test must only run when signed written permission exists. The condition should be signedPermit = TRUE, otherwise the tester would test without authorisation.
Q2
D — 10.0.0.9 is not in the scope list, so scanning it is testing outside scope. The line should scan only the checked host: scan(target).
Q3
C — The time window needs both limits to be met, so the condition must use AND. With OR it is always true and would allow testing outside the authorised hours.
Q4
B — Authorisation must be signed by the system owner. A tester cannot approve their own test. It should be signedBy <- owner.
Q5
C — A target outside the agreed scope must not be tested, because that is illegal. The tester should STOP instead of running the test.