Free CompTIA Security+ SY0-701 Practice Question

The effectiveness of a penetration test does not solely depend on the element of surprise against the IT department or system administrators. While covert testing (red team/blue team exercises) is a method used, it must always be pre-approved and within the agreed upon scope of work. Running covert tests without informing or obtaining permission from the system owner or relevant parties is against legal practices and can breach trust and professional ethical standards. The correct answer must reflect the necessity for approval and communication with pertinent organizational entities. Providing notice and getting explicit permission are mandatory for legal and ethical compliance in penetration testing. The idea that surprise is required could be misleading, as it may incorrectly suggest that penetration testing always imitates malicious methods exactly.