mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is hired to assess a web…
A penetration tester is hired to assess a web application that integrates with a third-party payment API. The client wants the API included in the test but does not have a signed agreement with the vendor. What is the most appropriate action for the tester?
⚠ Common exam trap
Watch out — candidates often assume 'anonymous techniques' or 'testing only the application logic' are safe workarounds, failing to recognize that legal authorization is a non-negotiable prerequisite for any testing activity, regardless of technique or scope limitation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ask the client to obtain a written authorization from the third-party vendor before testing the API.
Testing a third-party API without explicit written authorization from the vendor violates legal and contractual boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must obtain signed authorization to ensure the test is legally defensible and within scope, as the client cannot grant permission for assets they do not own.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ask the client to obtain a written authorization from the third-party vendor before testing the API.
Why this is correct
Testing a third-party API without explicit written authorization from the vendor violates legal boundaries such as the Computer Fraud and Abuse Act (CFAA) and the vendor's terms of service, even if the client holds API credentials. The penetration tester must ensure the scope of work includes a signed authorization from the vendor, specifying the exact systems, time window, and test types permitted, to protect both the tester and the client from liability. Without this, the engagement is technically an unauthorized intrusion, and any findings would be inadmissible or could lead to legal action against the tester.
- ✗
Proceed with testing the API using anonymous techniques to avoid detection.
Why it's wrong here
Anonymizing techniques like VPNs, TOR, or spoofed source IPs do not grant permission to test a third-party API; unauthorized access remains illegal under statutes like the CFAA irrespective of how the traffic is concealed. This approach also exposes the tester to the vendor's intrusion detection and incident response, potentially triggering a full cyber-attack investigation and legal escalation. Furthermore, active security testing against a system without prior consent is a violation of the PenTest+ code of ethics and the fundamental rules of engagement.
- ✗
Test only the client's application logic but not the actual API endpoint.
Why it's wrong here
Restricting the assessment to the client's application logic and ignoring the actual API endpoint fails to deliver the required security validation, as critical risks like injection attacks, broken object-level authorization (BOLA), and insecure direct object references (IDOR) only manifest when interacting with the API itself. This partial test would also miss misconfigurations in the integration, such as exposed sensitive data in API responses, and could give a false sense of security. Since the client specifically requested an assessment of the web application including its API integration, omitting the endpoint would be a scoping failure that undermines the entire engagement.
- ✗
Include the API in the test because the client owns the integration.
Why it's wrong here
The client's ownership of the integration—meaning the code and business logic that calls the API—does not convey any legal or ethical right to actively test the third-party vendor's infrastructure. The API is hosted on the vendor's servers, which are subject to that vendor's security policies, service-level agreements, and access controls, making any unauthorized scanning or probing equivalent to an attack from the vendor's perspective. Written consent from the vendor is a separate requirement, and without it, the tester would be operating outside the authorized boundary and could be held liable for damages or downtime caused by the tests.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.