Run the whole of engagement management on one brief

capstone · 150 min · Objective 1.4

Task

Take a single client brief from first contact to delivered report, producing every Domain 1 artifact in order and keeping them consistent with each other: scope, rules of engagement, authorisation, an escalation decision, stakeholder routing, and the final report. This is the domain end to end, unguided.

Steps

  1. Start from this brief: "A mid-size retailer wants to know whether an outsider could reach cardholder data in two weeks, and whether their team would notice." Create /tmp/engagement/ and write each artifact as its own file.
  2. scope.md — in-scope, out-of-scope, and the ambiguity rule, with concrete lab values. Decide and justify the engagement type and box model; note the detection question changes the shape.
  3. roe.md — permitted techniques, windows and blackouts (a retailer has trading-hour constraints), contacts, and escalation path.
  4. authorisation.md — who authorises, their standing, and nothing before it is signed.
  5. decisions.md — one mid-engagement event and the correct response, tied to a clause.
  6. report.md — executive summary, at least three findings in full shape, consistent severities, a sanitised appendix, and a coverage statement.
  7. Check the set is internally consistent: every asset named in the report is in scope; nothing tested was out of scope; the report's coverage matches the windows.

Verify

ls /tmp/engagement/ | grep -cE "^(scope|roe|authorisation|decisions|report)\.md$"
grep -cE "^###\s+Finding" /tmp/engagement/report.md
grep -ciE "out of scope" /tmp/engagement/scope.md
grep -ciE "executive summary|coverage" /tmp/engagement/report.md
for f in scope roe authorisation decisions report; do test -s /tmp/engagement/$f.md || echo "EMPTY: $f.md"; done

The first count must be 5 — every artifact present. The second at least 3. The third and fourth non-zero. The loop must print nothing: an empty artifact is an engagement stage skipped. Then read across them yourself for the consistency the commands cannot check — an asset in the report that is not in the scope is the error that ends engagements.

Notes

Domain 1 and Domain 5 together are more than a quarter of PT0-003, and both open and close on communication. This capstone is the argument for why: a tester who can get the shell but cannot produce this coherent set of documents is capped, because the documents are what the client actually buys. The detection question in the brief is the tell that this brief has a red-team flavour — note where that changes the scope.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.