Assessment foundations · Lesson 1 of 6
Start an ethical assessment with permission and purpose
About 16 minutes · Introductory draft · Checked 2026-10-22
AI editorial review for introductory study; independent review and complete exam alignment remain pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
What you will learn
- Define written scope, rules of engagement and stop conditions.
- Collect minimal reproducible evidence and report business impact.
- Use AI assistance without delegating authority or disclosing secrets.
Agree what success and permission mean
An ethical assessment answers an agreed security question for an authorized owner. Written scope should identify assets, accounts, dates, permitted methods, exclusions, data handling and an emergency contact. Rules of engagement explain how the work is conducted, including rate limits, notification and stop conditions. A public website being reachable does not itself grant testing permission.
Authority must cover the actual systems involved. A customer may authorize testing its application but not an unrelated supplier platform. Clarify uncertain boundaries before interaction. This course uses fictional scenarios; it does not grant permission to test any real service.
Keep evidence useful and proportionate
Write down the expected behavior, observed behavior, environment, time and minimal steps needed for an authorized colleague to reproduce the issue. Use designated test accounts and synthetic records. If one approved sample establishes impact, downloading an entire database adds exposure rather than necessarily improving the finding.
A useful report separates observation from inference. Describe the affected asset, preconditions, consequence, uncertainty, recommended correction and retest criteria. Technical severity helps, but exposure and business use influence priority. Protect the report as sensitive information and share it with the agreed recipients.
Stop, communicate and close the loop
If a test causes unexpected disruption or exposes real private data, follow the stop and escalation rules. Preserve necessary evidence securely without continuing merely to prove the point. Cleanup should remove only agreed test artifacts; deleting operational audit logs is not ethical cleanup.
AI can help organize sanitized notes, but a generated command or finding may be incorrect. Review scope, technical meaning and data handling before using output. Keep credentials and customer evidence out of unapproved external tools. The named tester remains responsible for what is run and what is reported.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
An approved test of a training portal reveals a link to a supplier billing service. The supplier is not listed in scope. What should the tester do?
Compare your reasoning
Record the relationship without probing the supplier and ask the engagement owner to clarify scope and authority. Continue permitted portal work if safe. Do not assume that a linked service inherits authorization from the original target.
Applied study · Added 2026-10-22
Turn permission into a testable rules-of-engagement plan
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: Permission first; evidence throughout; remediation last.
Explore the anchors
Agree scope limits and stop conditions.
Concept matching activity
Match this task or description to its concept:
Collect evidence using approved methods.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 1.1. Open its full syllabus chapter.
Write boundaries that survive a difficult finding
An assessment needs authorized targets, allowed techniques, testing times, escalation contacts, data-handling rules and explicit stop conditions. Ownership of a domain name does not establish permission to test every hosted service behind it. Shared infrastructure, supplier systems and production payment flows need separate consideration. Record who can approve a change in scope. If a finding points to an excluded system, document the observation without probing further and request authorization through the agreed contact. Urgency does not silently expand permission.
Make the report useful to a remediation owner
Separate the observation, reproducible evidence, affected assets, business consequence, confidence and recommended correction. A scanner label is not a demonstrated business impact. Use minimal synthetic data and redact secrets. Preserve enough evidence for an authorized reviewer to reproduce the issue, with dates and environment limits. Record what was not tested and why. A retest checks whether the underlying condition and related paths were corrected; receiving a patch ticket is not equivalent to verifying the change.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A signed assessment covers a staging portal and excludes its external identity provider.
- A redirect points to that provider after a test login; no vulnerability has yet been demonstrated there.
Your task
- Decide whether to probe the identity provider.
- Write the next communication to the assessment owner.
Compare with the model answer
Do not probe the excluded provider. Record the redirect and why it creates a dependency for the assessment. Request an approved scope decision, including the provider’s authority, allowed tests and handling of shared services. Continue work on approved portal controls where safe. The final report should distinguish a test limitation from a confirmed identity-provider vulnerability.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Remember
- Written scope defines boundaries; reachability does not.
- Use minimal evidence and distinguish facts from assumptions.
- Retesting and agreed cleanup are part of a professional assessment.
Orientation and further reading
- EC-Council: CEH course overview and modules
- NIST SP 800-115: planning and assessing security tests
- OWASP: Web Security Testing Guide project
- RST Forum: curriculum comparison reference
- RST Forum: provider lab comparison reference
Original examples and explanations. Background references do not establish complete exam coverage.