Skip to main content
E
EmmaPrep.com
CompTIA PenTest+ (PT0-002) Collection2026 Core Spec
Engagement ManagementMEDIUMVerified Curriculum18 min read

Engagement Management

Interactive AI Tutor Study Mode
Ask questions, request worked examples, or test understanding.

Chapter 1

Engagement Management

Course: Comptia Pentest Pt0 003
Subject: Comptia Pentest Plus
Chapter: Engagement Management

Pre-engagement activities form the foundation of a successful security assessment, such as penetration testing, vulnerability assessments, or red teaming. These activities help define the scope, responsibilities, legal considerations, and testing parameters. Proper pre-engagement planning ensures alignment between stakeholders, minimizes legal risks, and optimizes resource allocation.

1. Scope Definition

Scope definition is one of the most critical steps in pre-engagement activities. It outlines the extent and boundaries of the security test to prevent unauthorized access to systems beyond the agreed scope. It includes:

Regulations, Frameworks, and Standards

A security assessment must comply with various regulations and industry standards to ensure ethical and legal testing. These regulations define security and privacy expectations.

  • Privacy Regulations:

General Data Protection Regulation (GDPR) – Protects user privacy in the EU and mandates secure data handling. California Consumer Privacy Act (CCPA) – Defines how businesses collect and use personal data. Health Insurance Portability and Accountability Act (HIPAA) – Governs healthcare data privacy and security. Family Educational Rights and Privacy Act (FERPA) – Regulates student data privacy in educational institutions.

  • General Data Protection Regulation (GDPR) – Protects user privacy in the EU and mandates secure data handling.
  • California Consumer Privacy Act (CCPA) – Defines how businesses collect and use personal data.
  • Health Insurance Portability and Accountability Act (HIPAA) – Governs healthcare data privacy and security.
  • Family Educational Rights and Privacy Act (FERPA) – Regulates student data privacy in educational institutions.
  • Security Frameworks & Standards:

ISO 27001 – A global standard for information security management. National Institute of Standards and Technology (NIST) Cybersecurity Framework – Provides security guidelines for protecting critical infrastructure. Payment Card Industry Data Security Standard (PCI DSS) – Required for organizations handling credit card transactions.

  • ISO 27001 – A global standard for information security management.
  • National Institute of Standards and Technology (NIST) Cybersecurity Framework – Provides security guidelines for protecting critical infrastructure.
  • Payment Card Industry Data Security Standard (PCI DSS) – Required for organizations handling credit card transactions.

Rules of Engagement

Rules of engagement (RoE) define how security testing will be conducted. Clear RoE reduces misunderstandings and legal risks.

  • Exclusions: Defines out-of-scope systems, such as critical infrastructure or sensitive employee data.
  • Test Cases: Specifies what aspects of the system will be tested (e.g., network, APIs, cloud infrastructure).
  • Escalation Process: Defines who to contact in case of security incidents during testing.
  • Testing Window: Specifies the time frame when security testing will take place to minimize business disruption.

Agreement Types

Pre-engagement agreements help establish legal protection for both parties.

  • Non-Disclosure Agreement (NDA): Prevents the disclosure of confidential information gathered during testing.
  • Master Service Agreement (MSA): A broad agreement defining long-term business relationships, terms, and conditions.
  • Statement of Work (SoW): Specifies deliverables, objectives, and timelines for the assessment.
  • Terms of Service (ToS): Outlines the general terms under which security testing is conducted.

2. Target Selection

Target selection is a critical phase in security assessments, including penetration testing, vulnerability assessments, and ethical hacking engagements. Properly defining the scope and selecting appropriate targets ensures an efficient and comprehensive evaluation of an organization’s security posture.

Importance of Target Selection

  • Helps testers focus on critical assets that could impact business operations if compromised.
  • Prevents unauthorized testing of out-of-scope assets, reducing the risk of legal or operational issues.
  • Enables structured testing by defining specific parameters, such as network ranges, domains, and web applications.

Methods of Target Selection

1. Classless Inter-Domain Routing (CIDR) Ranges

CIDR notation is used to define network address blocks for testing. This is useful when conducting network penetration tests to assess security across a range of IPs.

Example:

  • A CIDR block such as 192.168.1.0/24 includes 254 usable IP addresses (192.168.1.1 – 192.168.1.254).
  • A broader range like 10.0.0.0/16 covers 65,536 IPs, suitable for large enterprise networks.
Real-Life Example:

A financial institution might scan its internal network (10.1.0.0/16) for vulnerabilities to prevent unauthorized access. If an open SSH port (22) with weak credentials is found, an attacker could gain control over internal systems.

✅ Tools for CIDR-based Scanning:

  • Nmap (nmap -p 1-65535 192.168.1.0/24) – Scans all ports for a given subnet.
  • Masscan – A high-speed network scanner that handles massive CIDR ranges.
2. Domains

Targeting domains ensures the security assessment covers internet-facing assets like websites, email servers, and subdomains.

Example:

  • Primary domain: example.com
  • Subdomains: mail.example.com, api.example.com, admin.example.com

Attackers often use subdomain enumeration techniques to discover hidden entry points.

Real-Life Example:

In 2021, Uber’s subdomain partners.uber.com was found vulnerable to an open redirect attack, which could have been exploited for phishing or session hijacking.

✅ Tools for Domain Targeting:

  • Subfinder – Enumerates subdomains using passive sources.
  • Amass – Performs active reconnaissance and subdomain enumeration.
3. Internet Protocol (IP) Addresses

A direct method of targeting specific assets is to use public or private IP addresses. These may represent:

  • Web servers
  • Firewalls
  • IoT devices
  • Cloud-hosted applications

Example:

  • Public IP: 203.0.113.45 (Externally hosted service)
  • Private IP: 192.168.0.10 (Internal database server)
Real-Life Example:

In 2022, misconfigured Elasticsearch instances with publicly accessible IP addresses exposed millions of records. Attackers exploited open ports to steal sensitive data.

✅ Tools for IP Address Testing:

  • Shodan – Searches for internet-connected devices.
  • Nmap – Scans for open ports and services.
4. Uniform Resource Locator (URL)

URLs define web applications, APIs, or specific resources to be tested.

Example:

Testing web applications ensures that vulnerabilities such as SQL injection (SQLi), Cross-Site Scripting (XSS), and Broken Authentication are identified.

Real-Life Example:

In 2019, Facebook’s API endpoints were found to expose private user data due to improper access control. Attackers could extract personal information without authentication.

✅ Tools for Web Application Testing:

  • Burp Suite – Intercepts and manipulates HTTP requests.
  • OWASP ZAP – Automated scanning for web application vulnerabilities.

3. Assessment Types

Security assessments are critical for identifying vulnerabilities and ensuring the robustness of an organization's infrastructure, applications, and networks. Depending on the environment, different security assessment methodologies are applied to detect weaknesses before attackers exploit them.

Types of Security Assessments

1. Web Security Assessment

A Web Security Assessment (WSA) focuses on testing web applications to uncover vulnerabilities that could lead to unauthorized access, data breaches, or service disruption.

Key Vulnerabilities Tested:

  • SQL Injection (SQLi): Exploits poorly sanitized database queries to manipulate or extract sensitive data.
  • Cross-Site Scripting (XSS): Injects malicious scripts into web pages to steal user sessions or manipulate content.
  • Broken Authentication: Weak authentication mechanisms allow attackers to take over user accounts.
  • Security Misconfigurations: Exposed debug logs, default credentials, or unnecessary services increase risks.

Real-Life Example:

In 2017, Equifax suffered a massive breach due to an unpatched Apache Struts vulnerability in their web application. Attackers exploited this flaw to gain access to sensitive customer data.

✅ Tools for Web Security Testing:

  • Burp Suite – Intercepts and manipulates HTTP requests.
  • OWASP ZAP – Automated scanning for web vulnerabilities.
2. Network Security Assessment

A Network Security Assessment (NSA) evaluates an organization’s internal and external networks to identify security gaps.

Key Areas of Focus:

  • Open Ports: Unsecured or unnecessary open ports can expose services to attackers.
  • Misconfigurations: Weak firewall rules or improper access controls can allow unauthorized access.
  • Insecure Protocols: Use of outdated or unencrypted protocols (e.g., Telnet, HTTP) increases risk.

Real-Life Example:

In 2018, the WannaCry ransomware spread across networks due to an unpatched SMBv1 vulnerability. A network security assessment could have identified the vulnerable systems.

✅ Tools for Network Security Testing:

  • Nmap – Scans for open ports and services.
  • Nessus – Identifies vulnerabilities in network assets.
3. Mobile Security Assessment

A Mobile Security Assessment (MSA) evaluates Android and iOS applications for security flaws.

Common Mobile Vulnerabilities:

  • Insecure API Calls: Data transmission without encryption can lead to eavesdropping.
  • Weak Authentication: Lack of multi-factor authentication (MFA) makes account takeover easier.
  • Data Leakage: Storing sensitive data in logs or unprotected storage can expose users to attacks.

Real-Life Example:

In 2019, WhatsApp had a vulnerability that allowed attackers to install spyware on phones via a malicious VoIP call. This flaw enabled unauthorized remote access.

✅ Tools for Mobile Security Testing:

  • MobSF (Mobile Security Framework) – Static and dynamic analysis of mobile apps.
  • Frida – Dynamic instrumentation to analyze runtime behavior.
4. Cloud Security Assessment

A Cloud Security Assessment (CSA) evaluates cloud environments such as AWS, Azure, and Google Cloud for security misconfigurations.

Common Cloud Security Issues:

  • Exposed Storage (S3, Blob, Buckets): Publicly accessible storage leads to data leaks.
  • Misconfigured IAM Roles: Overprivileged user roles increase insider threats.
  • Unrestricted API Endpoints: API gateways without authentication can expose sensitive operations.

Real-Life Example:

In 2020, Capital One suffered a cloud security breach due to a misconfigured AWS S3 bucket, exposing 106 million customer records.

✅ Tools for Cloud Security Testing:

  • Prowler – AWS security best practices checker.
  • CloudSploit – Scans cloud configurations for security issues.
5. API Security Assessment

An API Security Assessment ensures that Application Programming Interfaces (APIs) are hardened against security risks.

Key API Vulnerabilities:

  • Broken Authentication: Weak authentication allows unauthorized access.
  • Injection Attacks: APIs that fail to sanitize inputs can be exploited.
  • Excessive Data Exposure: Poorly designed APIs may return more information than necessary.

Real-Life Example:

In 2021, the Facebook API was found leaking phone numbers of over 500 million users due to an improperly secured endpoint.

✅ Tools for API Security Testing:

  • Postman – API security testing and request manipulation.
  • OWASP ZAP API Scanner – Detects API vulnerabilities.
6. Application Security Testing

Application Security Testing (AST) analyzes application source code, dependencies, and configurations to identify vulnerabilities.

Key Security Weaknesses:

  • Hardcoded Secrets: API keys or credentials stored in source code can be exploited.
  • Vulnerable Libraries: Outdated dependencies introduce known vulnerabilities.
  • Misconfigured Access Controls: Improper user permissions lead to privilege escalation.

Real-Life Example:

In 2018, GitHub accidentally exposed private RSA keys due to misconfigured repository access.

✅ Tools for Application Security Testing:

  • Snyk – Detects security issues in application dependencies.
  • Checkmarx – Static code analysis for security vulnerabilities.
7. Wireless Security Assessment

A Wireless Security Assessment tests Wi-Fi networks for misconfigurations, rogue access points, and encryption weaknesses.

Common Wi-Fi Security Issues:

  • Rogue Access Points (APs): Attackers create fake APs (Evil Twin Attacks) to intercept data.
  • Weak Encryption: Use of WEP or WPA without WPA2/WPA3 leads to easy decryption.
  • Signal Leakage: Wi-Fi signals extending beyond secured premises increase attack surface.

Real-Life Example:

In 2018, hackers used a rogue Wi-Fi hotspot in a Starbucks to intercept customers' banking credentials.

✅ Tools for Wireless Security Testing:

  • Aircrack-ng – Wi-Fi packet capture and cracking.
  • Kismet – Wireless network detection and analysis.

4. Shared Responsibility Model

The shared responsibility model defines security responsibilities between cloud service providers (CSPs), customers, penetration testers, and third-party vendors. Understanding these roles is crucial for securing cloud environments and preventing misconfigurations that could lead to data breaches.

Overview of the Shared Responsibility Model

Cloud security is a joint effort between the cloud provider and its customers. While the provider secures the underlying infrastructure, customers are responsible for securing their applications, data, and access controls.

Key Cloud Service Models:

  • Infrastructure as a Service (IaaS) – Customers manage operating systems, applications, and data security (e.g., AWS EC2, Azure VMs).
  • Platform as a Service (PaaS) – Providers manage OS and infrastructure, while customers secure applications and user data (e.g., AWS Lambda, Google App Engine).
  • Software as a Service (SaaS) – The provider manages most security aspects, while customers secure configurations and access control (e.g., Microsoft 365, Salesforce).

A general rule is that the more control a customer has over the environment, the more security responsibility they assume.

Key Stakeholders and Their Responsibilities

Cloud Hosting Provider Responsibilities (CSP)

The cloud provider (e.g., AWS, Azure, Google Cloud) is responsible for securing the physical infrastructure and foundational security controls.

Responsibilities:

  • Data center security: Protecting against unauthorized access, power failures, and natural disasters.
  • Network security: Implementing firewalls, anti-DDoS measures, and network segmentation.
  • Hardware and server security: Ensuring secure hypervisors, firmware updates, and virtualization isolation.
  • Encryption and logging services: Offering data encryption at rest and in transit, as well as security monitoring tools.

Real-Life Example:

AWS Shield is a service designed to protect cloud resources from DDoS attacks. Google Cloud Security Command Center provides real-time threat monitoring.

Security tools provided by CSPs:

  • AWS Security Hub – Detects misconfigurations and compliance violations.
  • Azure Security Center – Monitors security posture across cloud workloads.
Customer Responsibilities

Cloud customers are responsible for securing applications, identity management, and data configurations.

Responsibilities:

  • Identity & access management (IAM): Enforce least privilege access and enable multi-factor authentication (MFA).
  • Encryption management: Encrypt sensitive data using AWS KMS or Azure Key Vault.
  • Firewall and security group configurations: Restrict inbound and outbound traffic using security groups and network ACLs.
  • Application security: Protect web applications from SQL injection (SQLi), cross-site scripting (XSS), and API abuse.

Common Customer Misconfigurations Leading to Breaches:

  • Publicly exposed S3 buckets – Sensitive data leaks due to improper permissions.
  • Weak IAM policies – Overprivileged roles can be exploited in attacks.
  • Unpatched software – Outdated applications can be compromised by known vulnerabilities.

Real-Life Example:

In 2019, Capital One suffered a breach due to a misconfigured AWS S3 bucket, which allowed an attacker to exfiltrate 106 million customer records.

Best practices for customers:

  • Implement zero trust security – Never trust, always verify access.
  • Use AWS IAM roles instead of long-lived access keys.
  • Conduct regular vulnerability assessments on cloud assets.
Penetration Tester Responsibilities

Penetration testers play a crucial role in cloud security assessments, ensuring that legal, ethical, and technical considerations are met.

Responsibilities:

  • Following legal and compliance requirements: Obtain proper authorization before testing.
  • Avoiding data loss and service disruptions: Testing should not alter production data or cause denial-of-service conditions.
  • Responsible disclosure of vulnerabilities: Report security flaws through coordinated vulnerability disclosure (CVD) policies.

Allowed vs. Restricted Testing in Cloud Environments

| Test Type | Allowed? | | Application Security Testing (Web, APIs) | Yes | | IAM Misconfiguration Testing | Yes | | Network Scanning (External) | Limited (must follow CSP policies) | | DDoS Simulation | No (strictly prohibited) | | Exploiting Shared Infrastructure | No |

Recommended tools for cloud penetration testing:

  • CloudBrute – Identifies misconfigured cloud storage and exposed services.
  • Pacu – AWS exploitation framework for security assessments.
Third-Party Vendor Responsibilities

Third-party vendors such as SaaS providers, software suppliers, and managed security services must ensure their products and services do not introduce security risks.

Responsibilities:

  • Third-party risk management (TPRM): Conduct vendor security audits to prevent supply chain attacks.
  • Code security & vulnerability management: Ensure secure software development practices (e.g., DevSecOps).
  • Compliance with security standards: Adhere to SOC 2, ISO 27001, GDPR, or HIPAA regulations.

Real-Life Example:

In 2019, Magecart attackers injected malicious JavaScript into a third-party script used by British Airways. This breach led to the theft of 380,000 credit card records. A third-party security assessment could have identified the vulnerability before exploitation.

How third-party security can be strengthened:

  • Conduct security audits of third-party vendors before integrating their services.
  • Use Subresource Integrity (SRI) to prevent unauthorized script modifications.
  • Implement Web Application Firewalls (WAFs) to block malicious requests.

5. Legal and Ethical Considerations

Ethical and legal constraints define the boundaries of penetration testing to ensure that security assessments are conducted responsibly, without violating laws or exposing organizations to unnecessary risks.

Importance of Legal and Ethical Compliance

Penetration testing simulates real-world cyberattacks to identify vulnerabilities before malicious actors can exploit them. However, unauthorized or improperly conducted tests can lead to legal consequences, reputational damage, and operational disruptions.

Strict adherence to legal and ethical guidelines ensures that testing activities remain lawful, controlled, and aligned with industry regulations.

Key Legal and Ethical Requirements

Authorization Letters

Before conducting any penetration test, testers must obtain written authorization from the organization being assessed.

The letter of authorization should clearly outline:

  • The scope of testing, including which systems, networks, or applications can be tested.
  • Permitted testing methods, such as scanning, exploitation, and social engineering.
  • The timeframe for testing activities.
  • Legal protection for the penetration testers.

Without authorization, penetration testing can be considered hacking under laws like the Computer Fraud and Abuse Act (CFAA) in the U.S. or the Computer Misuse Act (CMA) in the U.K.

Real-life example

In 2019, a Coalfire security team was hired to conduct a physical penetration test at an Iowa courthouse. Despite having authorization, local law enforcement arrested the testers due to miscommunication between different government entities. This incident highlights the importance of clear legal agreements and pre-approvals before testing begins.

Mandatory Reporting Requirements

In regulated industries, penetration testers and security professionals may be required to report security vulnerabilities or breaches to relevant authorities.

Financial sector

Banks and financial institutions must report security incidents to government agencies such as:

  • Financial Industry Regulatory Authority (FINRA) in the U.S.
  • European Banking Authority (EBA) in the EU
  • Financial Conduct Authority (FCA) in the UK

Reports often include details about the breach, affected systems, and remediation efforts.

Healthcare

Under the Health Insurance Portability and Accountability Act (HIPAA) in the U.S., security breaches involving patient data must be reported to the Department of Health and Human Services (HHS) within 60 days. Affected patients must be notified if their personal health information (PHI) was exposed.

Government and critical infrastructure

Security incidents in critical infrastructure sectors such as energy, telecommunications, and transportation must be reported to:

  • Cybersecurity and Infrastructure Security Agency (CISA) in the U.S.
  • National Cyber Security Centre (NCSC) in the UK
  • European Union Agency for Cybersecurity (ENISA) in the EU

Failure to report breaches can result in regulatory penalties, fines, and legal action against the organization.

Risks Faced by Penetration Testers

Penetration testers face legal, physical, and cybersecurity risks while conducting security assessments.

Legal risks
  • Unauthorized testing can lead to criminal charges under cybersecurity laws.
  • If a penetration test exceeds the agreed scope, the tester could be sued for damages or data breaches.
  • Companies might attempt to withhold payment or blame testers for unrelated security issues.

Real-life example

A penetration tester in Singapore was arrested in 2022 after conducting unauthorized scans on a government network without prior approval. Despite having good intentions, he was prosecuted under cybercrime laws.

Physical risks
  • On-site penetration tests may require testers to access restricted areas, which can lead to security confrontations or law enforcement involvement.
  • Some organizations do not properly inform their security staff, leading to unexpected responses such as physical detainment, questioning, or arrest.

Real-life example

In 2019, the Coalfire penetration testers in Iowa were physically detained by sheriff’s deputies after attempting to access a courthouse at night as part of a security audit.

Cybersecurity risks
  • Malware infections: Penetration testers may inadvertently execute malicious payloads while testing exploits.
  • Counterattacks: Testers may become targets of adversaries, such as threat actors launching DDoS or phishing attacks in retaliation.
  • Data exposure: Poor handling of collected evidence such as credentials or sensitive files can compromise client security.

Key Legal and Ethical Guidelines for Penetration Testing

To minimize risks and ensure compliance, penetration testers should follow best practices and legal frameworks.

Follow a clear scope of work
  • Define which systems, networks, and applications can be tested.
  • Specify timeframes, testing methods, and expected deliverables.
  • Ensure all stakeholders approve the testing scope.
Obtain signed legal agreements
  • Obtain written authorization before testing.
  • Define liability clauses in case of unintended disruptions.
  • Document agreed limitations, such as no customer data manipulation.
Report vulnerabilities responsibly
  • Follow responsible disclosure policies such as CERT or bug bounty programs.
  • Provide actionable remediation steps to the organization.
  • Avoid publicly disclosing vulnerabilities before they are patched.
Adhere to compliance standards
  • Follow industry regulations such as:

General Data Protection Regulation (GDPR) for EU data protection laws. NIST 800-53 for U.S. government cybersecurity standards. ISO 27001 for global information security management.

  • General Data Protection Regulation (GDPR) for EU data protection laws.
  • NIST 800-53 for U.S. government cybersecurity standards.
  • ISO 27001 for global information security management.
Maintain ethical conduct
  • Do not use discovered vulnerabilities for personal gain.
  • Avoid excessive or disruptive testing that could harm operations.
  • Treat client data with confidentiality and ensure proper data handling.