ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Penetration testing is an intrusive activity that can violate laws, acceptable-use policies, and cloud service terms if performed without consent. AWS allows self-service tests only for certain services and benign techniques; anything broader-such as a full-scope assessment of production EC2 behind an ALB-requires a formal penetration-testing request through AWS Support and explicit approval. Because the environment holds ePHI, HIPAA and internal policy also mandate executive authorization. Therefore, securing written approval from both AWS and the organization, with a clearly defined scope, methods, and schedule, is the indispensable first step. Creating privileged IAM accounts, enabling monitoring tools, or deploying DDoS protection are important but come after legal authorization is in place.