CompTIA PenTest+ (PT0-003)Engagement ManagementMedium
According to the Penetration Testing Execution Standard (PTES), during which phase do the tester and client formally agree on scope, objectives, and rules of engagement before any technical activity begins?
- AIntelligence gathering
- BPre-engagement interactions
- CPost-exploitation
- DThreat modeling
Show answer & explanationAnswer & explanation
Correct answer: B. Pre-engagement interactions
PTES's first phase, pre-engagement interactions, is where scope, goals, RoE, and legal documents are established before any scanning or exploitation occurs.
Why the other options are wrong
- A. Intelligence gathering is the reconnaissance phase after agreements are in place.
- C. Post-exploitation occurs after successful compromise, near the end of testing.
- D. Threat modeling analyzes potential attack paths after intelligence gathering.
PTES Pre-engagement Interactions
The first phase of PTES where scope, objectives, legal agreements, and RoE are established between tester and client.
- Occurs before any technical testing
- Includes defining scope and success criteria
- Sets legal groundwork (contracts, NDA, RoE)
Memory trick: 'People Talk, Intelligence Threats, Vulnerabilities Exploited, Post, Report' - Pre-engagement first!