CAS-004 Security Operations Practice Question
A penetration tester is preparing for an engagement and must define the rules of engagement (ROE) with the client. Which TWO of the following should be included in the ROE? Select TWO.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time window for testing (e.g., after hours)
Rules of engagement should include scope (IP ranges, systems), limitations (what is off-limits), and authorization. Testing credentials and vulnerability details are not part of ROE.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Time window for testing (e.g., after hours)
Why this is correct
Specifies when testing can occur to minimize impact.
- ✓
Scope of testing (IP ranges and systems)
Why this is correct
Defines what is in scope to avoid legal issues.
- ✗
List of vulnerabilities to be tested
Why it's wrong here
The tester determines vulnerabilities; they are not predefined.
- ✗
Testing credentials provided by the client
Why it's wrong here
Credentials may be provided but are not typically part of ROE; they are operational details.
- ✗
Vendor contact information
Why it's wrong here
Not typically part of ROE; may be in communication plan.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.