CompTIA PenTest+ (PT0-003)Engagement ManagementMedium
A client's Rules of Engagement state that active scanning and exploitation using tools such as Burp Suite's active scanner may only occur between 10:00 PM and 4:00 AM local time to avoid impacting production traffic. What is this restriction called?
- AA scope boundary
- BAn authorized testing window
- CA blackout window
- DA change freeze
Show answer & explanationAnswer & explanation
Correct answer: B. An authorized testing window
An authorized testing window defines the specific hours during which active testing techniques are permitted, ensuring high-impact activity occurs when it will least disrupt business operations. A blackout window is the inverse concept—specific times or dates when testing is explicitly prohibited.
Why the other options are wrong
- A. Scope boundaries define which systems/assets can be tested, not the permitted times.
- C. A blackout window is a period when testing is prohibited, the opposite of this scenario.
- D. A change freeze refers to halting IT changes, typically unrelated to penetration test scheduling.
Authorized Testing Window
A time period specified in the RoE during which active testing techniques are permitted, chosen to minimize business disruption.
- Often set during off-peak or overnight hours
- The opposite concept is a blackout window (prohibited testing times)
- Should be explicitly documented in the RoE
Memory trick: Green light window vs. red light blackout — know which hours you can scan.