Build a rules-of-engagement package and stress it

applied · 90 min · Objective 1.1

Task

Take the scope from the short lab and build it into a full rules-of-engagement package, then deliberately break it with three mid-engagement events and record the correct response to each. Objective 1.1 is planning and scoping, and scoping is only real once it survives contact with events that were not planned.

Steps

  1. Expand /tmp/scope.md into /tmp/roe.md with the sections a signed package needs: authorisation and who granted it, in-scope, out-of-scope, permitted techniques (calling out anything with an availability risk), testing windows and blackouts, emergency contacts both sides, and a reporting and escalation path.
  2. For every in-scope asset, record who owns the infrastructure beneath it, and mark any that would need a third party's written permission before testing.
  3. Now stress it. Write /tmp/decisions.md and log the correct response to each event, tying each to a clause in the ROE: (a) the client asks, casually, "while you're in there, also check the HR system" — which is not in scope; (b) you discover a subdomain that resolves to an unlisted host just outside the ranges you were given; (c) mid-test, a new host appears inside an in-scope range that was not there on day one.
  4. For each event, record: the decision, the ROE clause it rests on, and what you would NOT do.

Verify

grep -cE "^##\s+(Authorisation|In scope|Out of scope|Permitted techniques|Windows|Contacts|Escalation)" /tmp/roe.md
grep -ciE "third[- ]party|written permission|owns the infrastructure" /tmp/roe.md
grep -cE "^(event|decision|clause):" /tmp/decisions.md

The first count must be at least 7 — a package missing any of those sections is not signable. The second must be non-zero: an ROE that never mentions third-party ownership has not thought about it. The third must be at least 9 — three events, each with a decision and the clause it rests on. If any event's answer is "yes, sure" rather than "not without a written amendment", re-read lesson 3: authorisation is specific and does not stretch to things that merely look similar.

Notes

Event (a) gets a written amendment, never a verbal yes. Event (b) is reported as existing and not touched — the interest is exactly the pressure the rule resists. Event (c) is confirmed against the scope and ownership re-verified before anything, because an address in scope on Monday can belong to someone else by Thursday. All three are the same principle wearing different clothes.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.