When using cloud-based pen testing infrastructure, which statement correctly reflects IP considerations?

• A. They must follow the provider's terms of service and may allow inbound IPs
• B. They require no terms of service compliance
• C. They disallow all password cracking activities
• D. They restrict testing to internal networks only

Answer: (A)

When you’re doing pen testing from cloud infrastructure, IP handling is tightly tied to the provider’s policies. You must operate under the provider’s terms of service and acceptable-use policies, and many cloud platforms require traffic you generate to come from IPs that have been whitelisted or otherwise approved for the engagement. That often means you’ll use specific inbound IP addresses or ranges, and you may need to coordinate with the provider to ensure those IPs aren’t blocked or flagged as abuse. This setup helps prevent collateral Impact on other customers and keeps the testing traceable and within policy.

That’s why the statement about complying with the provider’s terms and potentially using approved inbound IPs is the best reflection of how IPs behave in cloud-based pen testing. It isn’t about having no terms of service, nor is it a blanket ban on password cracking, and it certainly isn’t a blanket restriction to internal networks only—cloud tests can target external assets as long as you have explicit permission and the IP usage is approved by the provider.