PT0-002 Practice Question: A penetration testing firm has been hired to test…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Exclude the HR department's IP range from the test

  Why it's wrong here

  Excluding the HR department's IP range from the authorized scope directly contradicts the client's requirement to test all in-scope IP ranges and creates an exploitable blind spot. HR systems often store highly sensitive PII, payroll data, and confidential employee records, making them a prime target for lateral movement from other compromised segments. By removing this subnet, the pentest fails to validate whether an attacker who initially breaches another system could pivot into HR and exfiltrate critical data, thereby leaving the organization's most valuable data assets unassessed.

• ✓

  Perform the test during off-peak hours and provide prior notification

  Why this is correct

  Scheduling the engagement during off-peak hours, such as nights or weekends, reduces the risk of operational disruption to critical HR processes like payroll runs, benefits processing, and employee self-service transactions. Providing prior notification to HR allows their IT and security teams to review planned test activities, adjust monitoring thresholds to avoid false positives, and ensure that any system failures can be distinguished from test-induced incidents. This approach aligns with proper change management and deconfliction procedures, ensuring that valid business activities are not mistaken for intrusions while maintaining full coverage of the assigned scope.

• ✗

  Use only passive reconnaissance techniques on the HR systems

  Why it's wrong here

  Restricting the assessment to passive reconnaissance techniques—such as OSINT gathering, network traffic capture, and certificate transparency analysis—prevents the test from actively engaging with HR systems to identify exploitable vulnerabilities. A penetration test requires active scanning, service enumeration, vulnerability verification, and safe exploitation attempts to demonstrate real-world risk and assess the effectiveness of existing security controls. Without these active steps, many flaws—including unpatched CVEs, misconfigured authentication, and injection points—can remain undetected, so this approach fails to meet the objective of a comprehensive internal penetration test.

• ✗

  Include the HR systems but require written authorization from HR management

  Why it's wrong here

  Securing written authorization from HR management addresses the legal and contractual aspects of the engagement but does nothing to mitigate the operational risk of testing systems that support time-sensitive HR functions. Unlike prior notification and off-peak scheduling, this measure fails to protect availability, as active test traffic during business hours could trigger outages, corrupt batch jobs, or disrupt employee access to HR applications. Therefore, while authorization is a necessary prerequisite, it is insufficient on its own to satisfy the client's requirement to minimize business impact during the test.

Go deeper

Related to this question