Scoping questions / Penetration testing

Restricted environment test scoping questions

The questions asked when scoping a restricted environment breakout test, and why each one matters. Answer them online or in a fillable PDF.

Answer on this page Download the fillable PDF

9 questions · Fillable PDF · No email required to download

These are the questions a SilentGrid consultant asks when scoping a restricted environment breakout test. Answering them first makes the call shorter and the quote more accurate.

"Not sure" is a fine answer. Working out the unknowns is part of what the scoping call is for.

Questions marked Sizing help us prepare an accurate quote.

Before any test

What prompted the test, and what date does the result need to meet?

Why we ask: the reason sets the depth and report format, and the date fixes the testing window and any retest.
Will testing run against production, staging or a dedicated test copy?

Why we ask: production needs tighter limits on load, data and timing. A test copy allows more thorough techniques.
When can testing run, and are there change freezes or peak periods to avoid?

Why we ask: the schedule is built around them.
Will you want fixes retested?

Why we ask: retesting is agreed at scoping, so it is scheduled and priced from the start.

Restricted environments

What is the platform: Citrix, VMware Horizon, Azure Virtual Desktop, Remote Desktop Services, a kiosk or a locked-down laptop? Sizing

Why we ask: each platform has its own breakout techniques.
How many published applications, desktop images or user profiles are in scope? Sizing

Why we ask: each distinct policy is a separate set of restrictions to test.
What should a user be able to do, and what should be blocked?

Why we ask: the test tries to break out of exactly those restrictions.
What could be reached after a breakout: the internal network, other users' sessions, the host?

Why we ask: the impact of a breakout depends on what sits behind it.
Who uses it: staff, contractors, third parties or the public?

Why we ask: the realistic attacker is usually one of those users.

Send your answers

Your answers go to the consultant who will run the scoping call. Leave out credentials, internal addresses and other sensitive detail: general descriptions are enough.

First name Last name Company Work email Phone Optional

Unanswered questions are fine; the call covers them. Handled under the privacy policy. The form is protected by Cloudflare Turnstile, which sets no cookies (Cloudflare privacy policy).