I require a formal questionnaire which would be provided to the client used for penetration test .

If no one is having it how about if some of you guys list up some of questions which you might ask considering the fact that pen test is of network + web app .

That really depends, are you talking about questions for a scoping exercise?

MaXe's questions are good, but before you get to that point you need to have a clear understanding of what they are trying to protect and why. What vectors are the likeliest threats? You want to model what the customer is most likely to face and attack the assets most likely to be attacked. What is the purpose of the test? Are you testing the blue team response times and capabilities or is this test announced? Not all pentests are created equal, you really need to understand the objectives before you can even begin to structure your test.

Some questions I like to ask include:

What is my target?
What systems are in scope?
What systems are off limits?
When can I test?
When must I never test?
What tools and techniques can I use (or not use, e.g. DDOS, social engineering, physical, etc)
Who is my PoC for the test?
Is the test announced?
Where can I test from? (internal, DMZ port, internet remote site, etc)

If doing a physical test, I like to know if the security guards are armed *gulp*

Also, if possible get copies of network diagrams, application maps, past risk assessments, audits and pentests relevant to the scope of your test. It will give you a good starting point and help you understand what you need to be doing and where the customer has been. Afterall, you are another step on their security journey and you want to move them further down the road, not backwards.

I've seen some really badly defined scopes before. One I saw read something like "Exploit discovered vulnerabilities on organization machines" with no further clarification. Problem is target organizations often don't even understand why they are getting the test done, other than PCI or similar.

I group the questions into PPT.

1. People
Know the various groups of users of the system and their roles.
E.g. Sys admins,Monitoring team

2. People
Backup processes,patch processes Incident response processes

3. Technologies
Have a system architecture diagram and data flow diagram to show how the various machines communicate with one another.

A sample questionnaire - this might help:

Penetration Testing - Scoping