Study. uk . com
  1. Home
  2. All questions
  3. Question 58

CISSP study material · question 58 of 500

Midway through an authorised assessment, a tester judges that a denial-of-service check falling outside the signed document would expose a serious weakness in a customer portal. The engagement is time-boxed and the sponsor who signed is travelling. How should the tester proceed?

  1. Hold the check until the portal's operations team approves widening the scope on the sponsor's behalf
  2. Hold the check until the sponsor who signed the rules of engagement grants permission, normally in writing
  3. Run the check and record the deviation in the final report, since the assessment itself is already authorised
  4. Run the check outside business hours, since the rules of engagement bound scope rather than technique
Show the answer

Answer: B. Hold the check until the sponsor who signed the rules of engagement grants permission, normally in writing

Rules of engagement grant written authority for actions policy otherwise forbids; assessors may deviate only with permission, usually written, from the person who signed the document.

Source: NIST SP 800-115 (NIST) — SP 800-115 > Section 6.5, Assessment Plan Development, and Section 7.2, Assessing

Challenge yourself on this topic → Study as cards