Exam PT0-002 topic 1 question 206 discussion

In a penetration testing scenario, the company requesting the test should provide accurate and clear scope, including the range of IP addresses that are to be tested. If an IP address is within the scope defined by the client and later turns out to be a third-party system, the responsibility for that mistake falls on the company that defined the scope. So, the correct answer is: A. The company that requested the penetration test

A is the answer

Definitely A

Isn't the responsability of the Pentesting Company to gather information about the client and the scope?

The client is primarily responsible for defining the scope.

D. makes logical sense

In chapter one of the All-in-One guide, under governance, Risk, and Compliance and Permission to Test, "Pentesters must do their own due diligence to verify that the person who is requesting the testing has authority over tested assets in order to approve the test or that additional permission has been acquired."

If lets say, company asks the pentester to hack google, even without any authority over that domain, pentester should still verify, that the domain is companies property and the person, that signed the document is legally entitled to sign it. Plus what Natthew99 said, its from the book

going with D - the All in One book says something like "pentester must do their own due diligence to verify that the person requesting the testing has authority over the assets to approve the test and that any additional permissions have been acquired."

A is the correct answer The company that requested the penetration test

I think A is correct

The responsible stakeholder for this mistake is the penetration testing company. Penetration testers are responsible for verifying the scope of their testing and ensuring that they have permission to test all systems in the specified range. They should have confirmed the ownership of the IP address before conducting any testing, and if there was any doubt, they should have raised the issue with the company that requested the penetration test. In this scenario, the fact that the IP address belonged to a third party indicates that the penetration tester did not conduct adequate reconnaissance or validation of the IP addresses before testing them. This oversight is the responsibility of the penetration testing company.

A 100% sure

A, for sure. The company/client requesting the Pen Test is responsible.

149.14.1.24 is part of the network scope (149.14.1.0/24)

Isn't it D?