PT0-002 Practice Question: A penetration tester is tasked with performing…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use a slow, distributed scan from multiple IP addresses with random delays

  Why this is correct

  A slow, distributed scan from multiple IP addresses with random delays evades rate-based and behavioral detection by mimicking organic traffic patterns. Modern IPS/WAF platforms correlate request frequency, source entropy, and timing signatures; spreading the load across a botnet-like source pool with jittered intervals keeps the aggregate request rate under the alert threshold while still enumerating services. This approach is the standard for stealthy active scanning in high-security environments, as it trades speed for reliability and avoids the self-defeating burst that triggers countermeasures.

• ✗

  Perform an aggressive scan with a high thread count to complete before the WAF adapts

  Why it's wrong here

  An aggressive scan with a high thread count is self-defeating because it relies on completing before the WAF adapts, but modern security devices use real-time heuristics and can throttle or drop requests within milliseconds of detecting a spike. High thread counts also create deterministic patterns—identifying the client as a scanner via TCP window, request ordering, or TLS fingerprint—allowing the WAF to block the source after a single burst. In practice, this yields incomplete data because the scan triggers a block early in the enumeration, leaving ports, services, and vulnerabilities hidden.

• ✗

  Only perform passive reconnaissance and avoid active scanning

  Why it's wrong here

  Passive reconnaissance alone is insufficient for vulnerability identification because it only reveals externally observable metadata (e.g., TLS certificates, HTTP headers, or DNS records), not patch levels, open ports, or misconfigurations that require active probing. While passive methods help scope targets, missing patches or vulnerable services often have no distinct passive signature; the tester must send crafted requests to confirm exposure. Thus, avoiding active scanning entirely fails the penetration test objective of enumerating exploitable weaknesses, even though it may dodge WAF detection.

• ✗

  Use known WAF bypass techniques for each request

  Why it's wrong here

  Using known WAF bypass techniques per request is a tactical, not strategic, approach—it assumes the attacker already knows the specific WAF product, version, and filtering rules. Bypasses such as encoding tricks, header injection, or payload obfuscation address singular signatures (e.g., SQLi keyword matching) but do not cover the full range of vulnerabilities a scan must discover (e.g., CVE chains, misconfigurations, or logic flaws). Additionally, repeated reliance on a bypass can itself become a behavioral fingerprint, as many WAFs learn and adapt, rendering the technique useless midway through the scan.

Go deeper

Related to this question