PT0-002 Engagement Management Practice Question
A penetration tester is conducting a wireless penetration test. The client's rules of engagement state that testing must not disrupt production services. During the test, the tester's de-authentication attack causes the company's guest Wi-Fi to go offline. What should the tester do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stop testing and follow the emergency stop procedure
According to the RoE, the tester must stop testing if there is an emergency or disruption. The tester should follow the emergency stop procedure and contact the client.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the issue and complete the test
Why it's wrong here
Ignoring the disruption and completing the test violates the Rules of Engagement (RoE) and professional conduct. Any unintentional availability impact, such as a guest Wi-Fi outage, must be reported immediately and trigger the agreed-upon emergency procedures. Continuing the test without addressing the issue could also invalidate findings, since the environment has changed, and expose the tester to legal liability for the disruption.
- ✗
Reduce the intensity of the attack
Why it's wrong here
Lowering the attack intensity is insufficient because the emergency stop procedure requires fully halting testing activities, not just dialing them back. As long as the attack continues, even at a reduced rate, it can still cause further availability degradation or unpredictable side effects, which may continue to violate the RoE. The tester must completely stop the attack and then coordinate with the client to assess whether the impact has subsided before considering any resumption.
- ✗
Continue testing because guest Wi-Fi is not critical
Why it's wrong here
Deeming guest Wi-Fi as non-critical does not excuse the disruption; the RoE typically prohibits any denial-of-service impact unless explicitly authorized. Even a non-critical network may be used by employees or partners, and the outage could have broader operational consequences that the tester is unaware of. The tester must always respect the agreed scope and impact thresholds, and any unforeseen disruption requires an immediate halt and client notification.
- ✓
Stop testing and follow the emergency stop procedure
Why this is correct
Stopping the test and executing the emergency stop procedure is the mandated response to an unintended service disruption. This action immediately prevents further impact, triggers the client notification and incident response plan, and allows the tester to document the incident as part of the test results. Following the procedure also preserves the integrity of the test and demonstrates compliance with the RoE, protecting both the tester and the client.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.