PT0-002 Engagement Management Practice Question
A penetration tester is planning a red team exercise for a client. The client insists that the testing should not disrupt production systems and only target a replicated staging environment. However, the tester believes that testing the production environment is necessary for realistic adversary simulation. What is the MOST appropriate course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Negotiate with the client to include some production systems, explaining the value, and document agreed scope
Option A is correct because the tester should negotiate and document any scope changes with the client, ensuring mutual agreement and authorization before including production systems. This respects the client's risk tolerance while addressing the tester's realism concerns through formal change control. Option B is wrong because testing production without explicit authorization is unethical and potentially illegal. Option C is wrong because canceling is premature when the scope can be renegotiated. Option D is wrong because extrapolating staging results to production is unreliable and does not provide a valid assessment of the production environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Negotiate with the client to include some production systems, explaining the value, and document agreed scope
Why this is correct
The client's non-disruption constraint governs the engagement, so the tester cannot unilaterally target production. Requesting a scope amendment through formal negotiation preserves the client relationship and ensures any production testing is authorised and documented, satisfying the realistic-simulation goal without breaching agreed boundaries.
- ✗
Proceed with testing the production environment despite the client's request to ensure realism
Why it's wrong here
Testing production without written authorisation breaches the rules of engagement and constitutes unauthorised access, regardless of realism gained. Proceeding against the client's explicit instruction is never justified; production testing is legitimate only when the client authorises it in the signed scope.
- ✗
Cancel the engagement because the scope is too restrictive
Why it's wrong here
Cancelling abandons the engagement entirely, whereas the tester should negotiate scope with the client and document agreed constraints. Withdrawal is warranted only when a client demands illegal activity or refuses any testing at all, not when they simply restrict targets to a staging replica.
- ✗
Test the staging environment and then extrapolate results to production
Why it's wrong here
Extrapolating staging findings to production assumes configuration parity that rarely holds, so reported risk may not exist in the live payment path. Staging testing is valid when the client accepts it as the agreed scope; it cannot substitute for authorised production assessment.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Adversary simulation
A cybersecurity exercise where a team mimics the tactics, techniques, and procedures of a real attacker to test an organization's defenses without causing actual harm.
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.