Classify six engagements before you scope any of them

short · 45 min · Objective 1.1

Task

Given six client requests, decide for each whether the right work is a vulnerability scan, a penetration test or a red team engagement, and which box model fits — and justify each in one line. Getting this wrong at the start is how an engagement delivers the wrong thing competently.

Steps

  1. Copy the six scenarios below into /tmp/engagements.md, one per numbered block: (a) "Confirm our monthly patching is actually landing across 400 hosts." (b) "We think we're fine but want someone to try to get to the customer database the way an outsider would, over two weeks." (c) "Our board asked whether our SOC would even notice a real intrusion." (d) "A customer contract requires an annual test report before renewal." (e) "We just built a new payments API and want it examined before launch." (f) "Prove our office network is segmented from the card-processing network."
  2. For each, write three fields: type: (scan / pentest / redteam), box: (black / grey / white), and why: a one-line justification tied to what the client said they want to learn.
  3. For at least one, note what you would ask the client to confirm the choice — the request that is ambiguous until answered.
  4. Mark which one is overt by default and which one implies stealth, and say how you know.

Verify

grep -cE "^type:\s*(scan|pentest|redteam)\b" /tmp/engagements.md
grep -cE "^box:\s*(black|grey|white)\b" /tmp/engagements.md
grep -cE "^why:\s+\S" /tmp/engagements.md
awk '/^type:\s*redteam/{r++} END{print r" redteam classification(s)"}' /tmp/engagements.md

Each of the first three counts must be 6: every engagement has a type, a box, and a justification. Scenario (c) is the red team one — stealth is the point there and nowhere else — so the last line must be at least 1. If it is 0, you have called a detection test a penetration test, which is the exact confusion this lab exists to catch.

Notes

The box choice follows from what the client wants to learn, not from what sounds most thorough: (a) and (f) are grey or white because the client already knows their own estate and paying you to rediscover it wastes the budget. Only (b) genuinely wants black box, and only (c) wants stealth. A classification you cannot justify in one line is one you have not finished thinking about.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.