PenTest+ exam prep: engagement planning and scoping
You put a penetration test on solid ground before it starts with legal authorisation, scope, rules of engagement and contracts, and plan risk and communication.
Level 301 · 13 lessons · 12 practice labs
Lessons
Authorisation and the legal frame
- Authorisation and the law: no test without written permission
- Scope and rules of engagement: what, when, how
- Contract documents: confidentiality, statement of work, service agreement
- Testing methodologies and public frameworks
- Short task: write rules of engagement for a web application test
Planning and ethics
- Threat modelling and test objectives
- Test types: black, grey and white box; internal and external
- Professional conduct: stopping and reporting when you find signs of a crime
- Testing production safely: managing the risk of outages
- Short task: complete a test plan with risk and communication steps
Preparation
- Setting up the test environment: tools, note-taking and logging
- Communication plan, escalation and emergency contacts
- Capstone: prepare a complete pre-engagement pack for a client
Practice labs
- Separate in-scope and out-of-scope assets: You compare Erguvan Eczanesi's asset list with the contract text and write in-scope and out-of-scope addresses to two files.
- Complete the missing clauses in rules of engagement: You add test hours, prohibited techniques and a stop condition to a draft rules-of-engagement document.
- Handle a scope change that comes up mid-test: You prepare a change record with written approval, a risk note and an updated scope table for a subnet the client wants added mid-test.
- Find what is missing in an authorisation letter: You review three sample authorisation letters and mark the ones invalid for signing authority, date range or target list.
- Build the permission chain for a third-party hosted target: For an application hosted at a cloud provider you determine whose written permission is needed and fill in a permission tracking table.
- Report a suspected crime found during a test: You record in a memo the stop, log and notify-legal steps for suspicious content met during an authorised test, without investigating it further.
- Choose the test type for each scenario: For six client scenarios you choose black, grey or white box and internal or external testing and write your reasoning.
- Prepare a risk table for testing production: For Pusulam Sigorta's live policy system you tabulate the test steps that risk an outage, the safeguards and the time window.
- Derive test objectives from a threat model: From an online shop's data-flow diagram you derive three threat scenarios and tie each to a measurable test objective and success criterion.
- Fill in an emergency contact sheet: You complete a contact and escalation sheet showing who is called, when and through which channel during the test.
- Set up test notes and command logging: You set up an auditable note system with a working-directory layout, timestamped terminal logging and a screenshot naming rule.
- Audit a pre-engagement document pack: You find and fix four mutually contradicting clauses across a client's scope, rules, communication plan and confidentiality documents.
About this course
You put a penetration test on solid ground before it starts with legal authorisation, scope, rules of engagement and contracts, and plan risk and communication.
What you will learn
- Authorisation and the legal frame
- Planning and ethics
- Preparation
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.