Network Penetration Test
	1	Why is the customer having the penetration test performed against their environment?
	2	Is the penetration test required for a specific compliance requirement?
	3	When does the customer want the active portions (scanning, enumeration, exploitation, etc...) of the penetration test conducted?
	1	During business hours?
	2	After business hours?
	3	On the weekends?
	4	How many total IP addresses are being tested?
	1	How many internal IP addresses, if applicable?
	2	How many external IP addresses, if applicable?
	5	Are there any devices in place that may impact the results of a penetration test such as a firewall, intrusion detection/prevention system, web application firewall, or load balancer?
	6	In the case that a system is penetrated, how should the testing team proceed?
	1	Perform a local vulnerability assessment on the compromised machine?
	2	Attempt to gain the highest privileges (root on Unix machines, SYSTEM or Administrator on Windows machines) on the compromised machine?
	3	Perform no, minimal, dictionary, or exhaustive password attacks against local password hashes obtained (for example, /etc/shadow on Unix machines)?
Web Application Penetration Test
	1	How many web applications are being assessed?
	2	How many login systems are being assessed?
	3	How many static pages are being assessed? (approximate)
	4	How many dynamic pages are being assessed? (approximate)
	5	Will the source code be made readily available?
	6	Will there be any kind of documentation?
	1	If yes, what kind of documentation?
	7	Will static analysis be performed on this application?
	8	Does the client want fuzzing performed against this application?
	9	Does the client want role-based testing performed against this application?
	10	Does the client want credentialed scans of web applications performed?
Wireless Network Penetration Test
	1	How many wireless networks are in place?
	2	Is a guest wireless network used? If so:
	1	Does the guest network require authentication?
	2	What type of encryption is used on the wireless networks?
	3	What is the square footage of coverage?
	4	Will enumeration of rogue devices be necessary?
	5	Will the team be assessing wireless attacks against clients?
	6	Approximately how many clients will be using the wireless network?
Physical Penetration Test
	1	How many locations are being assessed?
	2	Is this physical location a shared facility? If so:
	1	How many floors are in scope?
	2	Which floors are in scope?
	3	Are there any security guards that will need to be bypassed? If so:
	1	Are the security guards employed through a 3rd party?
	2	Are they armed?
	3	Are they allowed to use force?
	4	How many entrances are there into the building?
	5	Is the use of lock picks or bump keys allowed? (also consider local laws)
	6	Is the purpose of this test to verify compliance with existing policies and procedures or for performing an audit?
	7	What is the square footage of the area in scope?
	8	Are all physical security measures documented?
	9	Are video cameras being used?
	1	Are the cameras client-owned? If so:
	1	Should the team attempt to gain access to where the video camera data is stored?
	10	Is there an armed alarm system being used? If so:
	1	Is the alarm a silent alarm?
	2	Is the alarm triggered by motion?
	3	Is the alarm triggered by opening of doors and windows?
Social Engineering
	1	Does the client have a list of email addresses they would like a Social Engineering attack to be performed against?
	2	Does the client have a list of phone numbers they would like a Social Engineering attack to be performed against?
	3	Is Social Engineering for the purpose of gaining unauthorized physical access approved? If so:
	1	How many people will be targeted?
It should be noted that as part of different levels of testing, the questions for Business Unit Managers, Systems Administrators, and Help Desk Personnel may not be required. However, in the case these questions are necessary, some sample questions can be found below.
Questions for Business Unit Managers
	1	Is the manager aware that a test is about to be performed?
	2	What is the main datum that would create the greatest risk to the organization if exposed, corrupted, or deleted?
	3	Are testing and validation procedures to verify that business applications are functioning properly in place?
	4	Will the testers have access to the Quality Assurance testing procedures from when the application was first developed?
	5	Are Disaster Recovery Procedures in place for the application data?
Questions for Systems Administrators
	1	Are there any systems which could be characterized as fragile? (systems with tendencies to crash, older operating systems, or which are unpatched)
	2	Are there systems on the network which the client does not own, that may require additional approval to test?
	3	Are Change Management procedures in place?
	4	What is the mean time to repair systems outages?
	5	Is any system monitoring software in place?
	6	What are the most critical servers and applications?
	7	Are backups tested on a regular basis?
	8	When was the last time the backups were restored?