Any type of penetration testing activities should be approved in writing by a business executive, such as a CISO or CIO, prior to conducting the test.

Responses

True

True

False

False

Question

Which legal contract used in penetration testing provides a framework for payment, scheduling, and general terms of the organizations conducting business such as the purpose of conducting business, limits of liability, how to handle a breach of contract, dispute resolution, and other information

Responses

A NDANDA

B ROEROE

C MSAMSA

D BAABAA

Question

A SOW may be part of the MSA.

Responses

True

True

False

False

Question

HIPAA regulations require which legal contract as part of any security test?

Responses

A BAABAA

B SOWSOW

C MSAMSA

D NCANCA

Question

Which legal document is often used in preparation for a penetration test to ensure understanding of the work to be completed by all parties involved in the assessment? It often includes networks, subnets, or URLs to be tested, the person or team performing the test, and information about special circumstances or hosts that are off limits

Responses

A ROEROE

B SOWSOW

C HIPAAHIPAA

D BAABAA

Question

Nondisclosure agreements protect the information a penetration tester may find and provide legal recourse if either organization shares unauthorized information about the other.

Responses

True

True

False

False

Question

Cybersecurity team objectives such as whether a cybersecurity team will be informed of a penetration test ahead of time, do not need to be documented.

Responses

True

True

False