PT0-002 Engagement Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add the cloud provider to the scope without notifying the client

  Why it's wrong here

  Adding the cloud provider to scope unilaterally circumvents the client-approved engagement boundaries; a pen test's scope is a contractual agreement between the tester and the client, and expanding it to include a third party's infrastructure requires the client's explicit sign-off and typically a separate authorization document from the provider. Unilaterally modifying scope exposes you to breach-of-contract liability and could invalidate your legal protections, so any scope change must be routed through the client and documented in writing.

• ✓

  Stop testing the cloud infrastructure and notify the client

  Why this is correct

  The correct action is to immediately halt all testing against the cloud-infrastructure components that fall outside the client-authorized scope. Because the infrastructure is owned and operated by the cloud provider as a third party, continuing against it without authorization could constitute unauthorized access under laws like the CFAA or the Computer Misuse Act, and the tester must notify the client so the client can formally amend the scope or obtain written permission from the provider.

• ✗

  Continue testing because the application is owned by the client

  Why it's wrong here

  The fact that the application itself is owned by the client does not grant permission to test the cloud provider's underlying infrastructure. In a typical IaaS/PaaS engagement, the provider retains responsibility for the host, network, and virtualization layers, and testing those layers without the provider's explicit, written authorization is outside the engagement and potentially illegal—even if the application lives in that environment.

• ✗

  Obtain verbal permission from the cloud provider and proceed

  Why it's wrong here

  Verbal permission from the cloud provider is not legally enforceable and fails to meet the standard of documented authorization required for penetration testing. A proper authorization must be a written agreement (often a Pen Test Authorization Addendum) issued by the provider's security or legal team, and it must also be incorporated into the client's scope change—otherwise, the tester remains exposed to civil and criminal liability while probing the provider's infrastructure.

Go deeper

Related to this question