PT0-002 Engagement Management Practice Question
A penetration testing engagement requires testing a production environment during business hours. The client is concerned about potential service disruption. Which document should specify the conditions under which the test must be halted?
⚠ Common exam trap
In CompTIA Pentest+, candidates often confuse the Statement of Work (SOW) with the Rules of Engagement (RoE). The SOW defines what will be done, while the RoE specifies how and under what constraints it will be done, including explicit halt conditions to prevent service disruption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rules of Engagement
The Rules of Engagement (RoE) is the definitive document that outlines the scope, authorization, and constraints of a penetration test, including explicit conditions under which testing must be halted to prevent service disruption. Unlike other documents, the RoE is a legally binding agreement that specifies technical boundaries such as IP ranges, testing windows, and stop conditions (e.g., CPU threshold exceeded or application error rate spike). This ensures the client's production environment is protected during business hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Get-out-of-jail letter
Why it's wrong here
A get-out-of-jail letter is authorisation proving the tester is permitted to test, not a set of halt criteria. It is tempting because it is a required engagement document and would be the correct answer when the question asks what protects the tester from legal action during the assessment.
- ✓
Rules of Engagement
Why this is correct
The Rules of Engagement defines scope, timing, permitted techniques and stop conditions, so it is the document authorising the tester to halt activity if disruption risk appears. It directly satisfies the client's requirement for agreed business-hours testing safeguards.
- ✗
Communication plan
Why it's wrong here
A communication plan defines who is contacted, when, and through which channels; it does not define the technical thresholds that trigger stopping the test. It is tempting because it governs engagement coordination, and it would be correct when the question asks how findings and incidents are escalated between tester and client.
- ✗
Statement of Work
Why it's wrong here
A Statement of Work defines scope, deliverables, and commercial terms; it does not specify operational stop conditions during live testing. It is tempting because the SOW is the governing engagement contract, and it would be the right document when the question asks which artefact authorises the engagement and bounds its scope.
Go deeper
Related to this question
Learn chapter
Red Team Exercises vs Penetration Tests
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.