PT0-002 Engagement Management Practice Question
A penetration tester is performing a wireless penetration test. The RoE states that testing is only allowed between 8 PM and 6 AM. At 7:30 PM, the tester begins active scanning. At 8:15 PM, a client employee calls emergency contact to report suspicious activity. According to the RoE, which of the following is the most likely reason for the call?
⚠ Common exam trap
PT0-003 often tests whether candidates correctly attribute an incident to the specific RoE clause violated (timing, scope, tooling) rather than assuming the most dramatic cause like out-of-scope targeting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tester started testing outside the agreed time window
The RoE explicitly restricts testing to 8 PM – 6 AM, but the tester began active scanning at 7:30 PM — 30 minutes before the allowed window. Active scanning generates detectable wireless traffic (probe requests, deauth frames, association attempts) that a client employee could notice and report. The call at 8:15 PM is most likely a delayed report of the activity that started at 7:30 PM, outside the agreed window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The tester used an unauthorized tool
Why it's wrong here
The RoE restricted testing to 8 PM–6 AM, and scanning began at 7:30 PM, so the breach was the timing window, not tooling. Tool authorisation is tempting because unapproved tools commonly trigger complaints, and an unauthorised-tool finding would be correct had the RoE listed permitted tools and the tester deviated from that list.
- ✓
The tester started testing outside the agreed time window
Why this is correct
Active scanning began at 7:30 PM, thirty minutes before the 8 PM window opened, so the tester breached the RoE's permitted testing hours. The employee's 8:15 PM call follows that unauthorised activity, making the early start the most likely trigger. The constraint satisfied is the agreed time window itself.
- ✗
The tester targeted an out-of-scope access point
Why it's wrong here
Nothing indicates an out-of-scope access point; the tester simply started active scanning 30 minutes before the permitted 8 PM window. Scope violations are tempting because they are a frequent cause of client complaints, and this would be the correct reason had the tester's target list included an access point excluded from the agreed scope.
- ✗
The tester exceeded the allowed signal strength
Why it's wrong here
Signal strength limits are not mentioned in the RoE, which only defines the permitted time window, so exceeding power cannot explain the call. Signal strength is tempting because wireless RoE documents often cap transmit power, and that limit would be the correct cause had the tester used a high-gain antenna beyond the agreed threshold.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.