mediumMultiple Choice
PT0-002 Practice Question: A client requests a penetration test of their…
A client requests a penetration test of their production environment, which includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?
⚠ Common exam trap
CompTIA often tests the misconception that immediate stoppage upon any degradation (Option B) is the best safeguard, but the trap is that this lacks measurable criteria and could halt testing unnecessarily, whereas a well-defined scope with off-peak hours and rollback plans is the correct, proactive approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A scope that limits testing to off-peak hours and includes a rollback plan for any changes
It directly addresses the client's concern about service disruptions by limiting testing to off-peak hours and including a rollback plan. This ensures that any changes made during the test can be reversed quickly, minimizing the risk to critical financial transaction systems. The Rules of Engagement (RoE) must balance thorough testing with operational stability, and this scope provision achieves that.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A detailed schedule of every attack method to be used
Why it's wrong here
A detailed schedule of attack methods helps with resource coordination, but it does nothing to limit the blast radius if an attack behaves unexpectedly. For example, a timed SQL injection test could trigger a locking issue that brings a web app down. The client's concern is not when attacks happen, but how risk is controlled through scope, fallback plans, and emergency stop conditions.
- ✗
A clause stating that testing will stop immediately if any service degradation is detected
Why it's wrong here
An immediate-stop clause only responds after a problem has occurred, meaning the service might already be degraded or data corrupted. Detection itself can be slow—some performance issues take minutes to surface, or monitoring may not cover all system aspects. A proactive plan includes scheduling work during low utilization, implementing a rollback of any system changes, and using validated testing procedures to avoid incidents in the first place.
- ✓
A scope that limits testing to off-peak hours and includes a rollback plan for any changes
Why this is correct
Limiting testing to off-peak hours lowers the likelihood that legitimate transactions are interrupted, while a rollback plan ensures that any configuration or data changes made during the test can be undone quickly. This combination reduces both the probability and the impact of a service disruption, which is the core objective of a well-defined rules-of-engagement scope. It also shows the tester is managing operational risk, not just technical risk.
- ✗
A list of all tools and versions that will be used during the test
Why it's wrong here
Enumerating tool versions is administrative transparency; it gives the client an inventory of software to be used. However, it does not constrain test execution, so an aggressive scan or exploit payload could still overwhelm a production service. Preventing disruption requires operational boundaries such as time windows, change control, and rollback procedures, not merely a list of binaries.
Go deeper
Related to this question
Learn chapter
Third-Party and Supply Chain Risk in Scope
Key term
Rules of engagement
Rules of engagement are the documented guidelines that define the scope, boundaries, and authorized actions a security tester may take during a penetration test or security assessment.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.