PT0-002 Engagement Management Practice Question
A penetration testing company is contracted to perform a social engineering engagement. The client requests that only employees in the finance department be targeted. Which scoping consideration is most relevant?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Personnel scope
Personnel scope defines which individuals or groups are in-scope for social engineering testing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Personnel scope
Why this is correct
Personnel scope defines the specific subset of employees, departments, or roles that a social engineering campaign may legitimately target. For example, it may list all non-executive staff as in-scope but exclude executive leadership or a particular division for internal political reasons. This is the correct scoping element because the question asks where the target population is recorded, and that is precisely what the personnel scope does.
- ✗
Rules of engagement
Why it's wrong here
Rules of engagement (RoE) establish the high-level operational boundaries for the engagement, such as acceptable testing windows, prohibited techniques, and notification procedures. While RoE might authorize the use of phishing or vishing, it does not usually enumerate the specific individuals or user groups who will receive the social engineering payloads. The 'target population' is a separate scoping concept captured in the personnel scope, so RoE is not the correct answer.
- ✗
Production vs. staging environments
Why it's wrong here
Production vs. staging environments is a system-level classification that distinguishes live enterprise systems from isolated test instances, and it is applied to infrastructure, not to people. Social engineering attacks are performed directly against real employees in their live work environment, so there is no analogous production/staging split for human targets. Thus, this option is irrelevant to defining which personnel are in scope.
- ✗
Third-party services
Why it's wrong here
Third-party services refer to external organizations, vendors, or outsourced functions that may be part of the infrastructure or service delivery, and they do not constitute the internal employee population targeted by social engineering. When a test scope mentions third-party services, it is typically to authorize testing of an external network or API, not to define who may receive a phishing email. Even if a social engineering test eventually contacts someone outside the company, the classification of that person as a target belongs in the personnel scope, not in the third-party services category.
Go deeper
Related to this question
Learn chapter
Mobile Application Testing
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.