Exam PT0-001 topic 1 question 89 discussion

Statement of Work.

PenTest+ Practice Tests Book - SYBEX C. - A statement of work (SOW) defines what work will be done during an engagement. A SOW is a document that defines the purpose of the test, what tests will be done, what will be created, the timeline for the test to be completed, the price for the testing, and any additional terms and conditions.

AAAAAAAAAA

looks good to me

looks good to me

SOW - States what will be tested ROE - How and when the testing will occur

Statement of Work = Work to be done. RoE - Targets that are to be hit. Answer is A

Well, if you go throug the SANS Rules of Engagment Worksheet Only Attacker IP's are mentioned. https://sansorg.egnyte.com/dl/bF4I3yCcnt/? So i would go with the Statement of Work

Answer is A ROE https://community.infosecinstitute.com/discussion/134877/rules-of-engagement-vs-sow

Pay attention to the actual question fellas. This says "which of the following would define the target list?". They're throwing you off with that addition peice and your brain is going straight to scope creep. The question itself has NOTHING to do with scope creep. The question is a simple "where would this be defined" and it's definitely part of the ROE doc.

I think this is actually a question about scope creep. If this was a real world scenario then the pen tester would need to know more about the new targets, which sort of swings the process round to the start. I'd say this would mean revisiting the statement of works

I would say "both"... but since that isn't an answer... SoW defines the targets, RoE gives specifics on how you are going to attack the target. So C.

The rules of engagement are established BEFORE testing begins and are usually not modified. If the test has begun and new requirements are added, they will be included in the SOW. So I think the answer is C.

A - Rules of Engagement – This is the meat of the document, and these rules are crucial to reveal in detail, as they provide the dos and do nots of testing. They contain a lot of important project specifics such as special testing parameters, requested rules the testing team should abide by, and disclosures about testing that can help protect the client. Below are some of the different things captured and detailed in this section: Treatment of sensitive information during the project How project status updates will be communicated Emergency contact information Handling of a sensitive and critical vulnerability Steps taken if a prior compromise is uncovered Security controls impact and specifics IP addresses of testing machines for monitoring/whitelisting Requirements for third-party hosting provider approvals to test In-scope targets, including the IP addresses and URLs Any specific compromise goals (i.e. Material and Non-public information, Credit Card Data) Specific web-forms to be avoided