PT0-003 Flashcards

All 50 terms

Penetration test

An authorised, scoped simulation of an attack that finds and reports weaknesses so an organisation can fix them.

Rules of engagement (RoE)

The written agreement that defines what may be tested, when, from where, by whom, and what is off-limits.

Scoping

Deciding which addresses, applications, cloud tenants or sites are in and out, and which techniques are permitted.

Scope creep

Testing beyond the agreed targets or techniques; the correct response is to stop and get written authorisation.

Statement of work (SOW)

The document that defines deliverables, timeline and commercial terms for an engagement.

Master service agreement (MSA)

The standing contract that sets the ongoing legal relationship between tester and client.

Non-disclosure agreement (NDA)

A contract that protects the confidential information a tester learns during an engagement.

Authorisation

Written permission from someone empowered to grant it, obtained before any testing begins.

Third-party authorisation

Extra approval needed when assets are hosted or managed by another provider whose own policy applies.

De-confliction

Coordinating with the defensive team so testing traffic is not mistaken for a real incident.

Stop condition

A pre-agreed trigger that pauses or halts a test, such as an outage or evidence of a prior breach.

Known-environment testing

Testing where the client shares full information (formerly "white box"); more coverage, less realism.

Unknown-environment testing

Testing with little or no shared information (formerly "black box"); more realistic, less thorough.

Threat model

The attacker being simulated (external, insider, compromised employee) that sets the starting position.

Attestation of findings

A short signed statement of what was tested and when, often passed by a client to an auditor.

Executive summary

The non-technical opening of a report that states business risk for leadership.

Retest

A follow-up check confirming that reported findings were actually fixed.

Passive reconnaissance

Gathering information without sending traffic to the target, using public and third-party sources.

Active reconnaissance

Sending traffic to the target to see what responds; detectable and legitimate only in scope.

OSINT

Open-source intelligence: information collected from public records, documents, code and social media.

Enumeration

Building out detail on a discovered system: services, versions, shares, users, domains and cloud assets.

Service enumeration

Identifying listening services and their software versions on a host.

Attack surface

Everything exposed that an attacker could interact with; the map that guides the next phase.

Vulnerability scan

An automated check that compares a system against a database of known weaknesses.

Credentialed scan

A scan that authenticates, seeing patch and configuration state with far fewer false positives.

Non-credentialed scan

A scan run without login, seeing only what an unauthenticated attacker would.

False positive

A reported weakness that is not actually exploitable; wastes client time and hurts credibility.

False negative

A real weakness the scan missed; leaves a genuine hole out of the report.

Validation

Manually confirming a scanner finding is real before it goes in the report.

CVE

Common Vulnerabilities and Exposures: a catalogue identifier for a specific known vulnerability.

CVSS

Common Vulnerability Scoring System: a 0-10 severity score used as one input to prioritisation.

Prioritisation

Ranking findings by exposure, asset value and real exploitability, not by CVSS score alone.

On-path attack

Intercepting communication between two parties (formerly "man-in-the-middle").

Injection

A class of web flaw where untrusted input is processed as a command by the application.

Cross-site scripting (XSS)

A web flaw that lets an attacker run script in another user's browser session.

Broken access control

A flaw where users can reach data or actions that should be restricted to others.

Server-side request forgery (SSRF)

A flaw where a server can be induced to make requests to systems the attacker cannot reach directly.

BOLA

Broken Object Level Authorisation: an API flaw exposing objects a user should not be able to see.

Evil twin

A rogue wireless access point that imitates a legitimate one to intercept connections.

Social engineering

Manipulating people to bypass controls; in a test it must be explicitly authorised in writing.

Phishing

A social-engineering technique using fake messages to obtain credentials or access.

Privilege escalation

Gaining higher access than granted: vertical (higher level) or horizontal (another account, same level).

Lateral movement

Reaching further systems after an initial foothold by reusing trust relationships.

Pivoting

Routing through a compromised host to reach a network segment not directly accessible.

Persistence

A mechanism that keeps access after a reboot; in a test it must be agreed and removed at cleanup.

Data exfiltration

Moving data out of the target; in a test it is minimised, evidenced and handled under agreed rules.

Detection avoidance

Behaving so activity blends into normal administration; the client learns whether monitoring noticed.

Cleanup

Removing accounts, tools, files and changes made during a test and restoring the original state.

Performance-based question (PBQ)

An exam item that asks you to complete or interpret a task rather than pick a definition.

CompTIA CE program

The continuing-education scheme that keeps the certification valid for its three-year term.