CompTIA PenTest+ PT0-002 (PT0-002) — Questions 226–300

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because completely avoiding automated scanning tools is impractical for a thorough penetration test of AWS EC2, S3, and IAM configurations; tools like Nmap, Burp Suite, or custom scripts are essential for discovering vulnerabilities such as open ports, misconfigured bucket policies, or weak IAM roles. Option C is wrong because requiring only manual testing is overly restrictive and unrealistic for testing cloud-scale environments; automated tools are needed to efficiently enumerate S3 bucket permissions, scan for IAM privilege escalation paths, and test EC2 security group rules. Option D is wrong because testing only during business hours does not mitigate the risk of service disruption; in fact, testing during peak usage could increase the chance of impacting production workloads, and the client's concern is about disruption itself, not timing.

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS zone transfers (AXFR) require explicit server configuration to allow them and are rarely successful against public DNS servers; they are not a reliable method for discovering subdomains from an SPF include. Option B is wrong because enumerating MX records for the third-party domain only reveals mail exchange servers, not necessarily subdomains or internal infrastructure of the target; it does not leverage the SPF include chain. Option D is wrong because Google dorks for exposed email addresses are a passive reconnaissance technique for finding user emails, not for systematically discovering subdomains or internal network infrastructure from an SPF record.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling SYN scan (a half-open scan) only changes the TCP handshake method to reduce network noise and avoid connection logging, but it does not prevent the scanner from sending exploit payloads that crash services. Option B is wrong because adjusting the scan timing template to a slower rate reduces packet transmission speed to avoid network congestion or IDS alerts, but it does not disable the intrusive exploit attempts that cause service crashes. Option D is wrong because increasing the port range to include high ports expands the scope of the scan to discover more services, but it does not mitigate the aggressive exploitation behavior that crashes services.

Why this answer

How to eliminate wrong answers

Option B (-m 1100) is wrong because it corresponds to Domain Cached Credentials (DCC), also known as MS Cache Hash, not NTLM. Option C (-m 3000) is wrong because it is used for LM (LAN Manager) hashes, an older and weaker Windows hash format. Option D (-m 5500) is wrong because it is used for NetNTLMv1 hashes, which are challenge-response hashes used in network authentication, not the local NTLM hash stored in the SAM.

Why this answer

How to eliminate wrong answers

Option B is wrong because it lacks the `filetype:` operator, so it returns general web pages containing the words 'username' and 'password' rather than specific document files. Option C is wrong because it targets `filetype:xls` (Excel files), not PDF documents as specified in the question. Option D is wrong because `intitle:'index of'` is used to find directory listings, not PDF documents, and it does not include `filetype:pdf` to filter for PDFs.

Why this answer

How to eliminate wrong answers

Option A is wrong because providing a detailed schedule of every attack method violates operational security (OPSEC) and is impractical; the RoE should specify types of attacks, not a rigid timeline, as testers need flexibility to adapt to findings. Option B is wrong because a clause to stop testing immediately upon any service degradation is too vague and reactive; it lacks predefined thresholds for what constitutes degradation, potentially causing premature termination without proper analysis. Option D is wrong because listing all tools and versions is unnecessary for the RoE; while tool inventory may be part of a separate agreement, the RoE focuses on scope, constraints, and legal boundaries, not granular tool details.

Why this answer

How to eliminate wrong answers

Option A is wrong because stating 'Upgrade to the latest version' is too vague; it does not specify the exact version number, patch level, or any prerequisite steps, leaving room for misinterpretation or incomplete remediation. Option C is wrong because recommending vendor-supplied patches without specific version numbers fails to address the exact vulnerable component; the client may apply an outdated or incorrect patch, leaving the vulnerability unmitigated. Option D is wrong because suggesting a third-party consultant shifts responsibility without providing any technical guidance; the report should empower the client's own team to act, not defer action to an external party.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because a Non-Disclosure Agreement (NDA) only governs confidentiality of information shared between parties, not the technical or operational boundaries of the test. Option C is wrong because the Penetration Testing Report is a post-engagement deliverable that summarizes findings and remediation steps; it does not define pre-engagement constraints like IP ranges or notification requirements. Option D is wrong because the Scope of Work (SOW) defines the high-level objectives, deliverables, and timelines of the engagement, but it does not contain the granular operational rules (e.g., specific IP ranges, scanning windows, or provider-mandated restrictions) that belong in the ROE.

Why this answer

How to eliminate wrong answers

Option B is wrong because the detailed technical report contains in-depth exploit chains, raw logs, and system-level data that would overwhelm a board of directors and is intended for technical teams. Option C is wrong because a vulnerability scan report is an automated output listing CVEs and severity scores, lacking the manual exploitation context and business risk analysis required for a penetration test summary. Option D is wrong because a remediation plan focuses solely on step-by-step fix instructions for technical staff, omitting the scope and high-level findings needed for executive review.

Why this answer

How to eliminate wrong answers

Option A is wrong because a direct DNS zone transfer is an active reconnaissance technique that requires a misconfigured DNS server to allow AXFR requests, whereas theHarvester performs passive reconnaissance without interacting with the target's DNS servers. Option B is wrong because Shodan is a search engine for internet-connected devices and services, but theHarvester does not natively integrate Shodan as a source for email and subdomain collection; it focuses on search engines and PGP key servers. Option C is wrong because while Baidu is a search engine, theHarvester's common configurations prioritize Google and Bing due to their broader coverage and API accessibility for passive OSINT gathering.

Why this answer

How to eliminate wrong answers

Option A is wrong because Domain Admin privileges are not needed; Kerberoasting only requires the ability to authenticate to the domain, and Domain Admin is an overprivileged role that would expose the attacker to more detection. Option C is wrong because Local Administrator on the domain controller is irrelevant; the attack does not require local administrative access to any machine, as the TGS request is made over the network to the domain controller. Option D is wrong because Enterprise Admin is a forest-wide administrative role; Kerberoasting can be performed by any authenticated domain user without any elevated group membership.

Why this answer

How to eliminate wrong answers

Option A is wrong because providing network access to both in-scope and out-of-scope systems would defeat the purpose of segmentation testing; the tester should only have access to the CDE (in-scope) and must attempt to reach out-of-scope systems from that position to verify isolation. Option C is wrong because the tester must scan out-of-scope IP addresses as part of segmentation testing—specifically, to confirm that those systems are not reachable from the CDE—so agreeing not to scan them would prevent the core validation. Option D is wrong because written authorization from the client's security team is a general legal/contractual requirement for any penetration test, not a specific consideration for segmentation testing; the question asks for the most important consideration for the rules of engagement regarding segmentation.

Why this answer

How to eliminate wrong answers

Option A is wrong because a CVSS score and brief description provide only a severity rating and high-level summary, which lacks the technical specifics (e.g., vulnerable parameter, injection syntax) developers need to remediate the SQL injection. Option C is wrong because describing business impact in financial terms is relevant for management or stakeholders, not for developers who require technical details to fix the code. Option D is wrong because a bullet-point summary without context omits critical information like the exact HTTP requests, payloads, and vulnerable endpoints, leaving developers without enough detail to reproduce or patch the vulnerability.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because heap spraying is used to increase the predictability of heap memory layout for exploiting use-after-free or heap-based vulnerabilities, but it does not bypass NX (which prevents shellcode execution) and does not leverage fixed-address ROP gadgets. Option C is wrong because a stack canary bypass using an information leak addresses stack smashing protection but does not overcome NX or ASLR; it would still require a method to execute code, which ROP provides. Option D is wrong because a format string attack can overwrite GOT entries to redirect execution, but it does not inherently bypass NX or ASLR unless combined with other techniques, and the question specifies that a fixed-address ROP gadget is available, making ROP the direct and intended approach.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `$0` variable is set by the shell to the script's path (e.g., `/opt/tool/backup.sh`) and cannot be modified by the user during execution; it is read-only in this context. Option C is wrong because the user has only low-privileged access and cannot overwrite `/opt/tool/backup.sh` (owned by root) without already having root privileges. Option D is wrong because there is no indication of a buffer overflow vulnerability in the Bash interpreter; the script is a simple shell script, and the attack vector is PATH hijacking, not memory corruption.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because SQL injection targets database queries via input fields, not SSH connections using paramiko. Option C is wrong because cross-site scripting (XSS) injects malicious scripts into web pages viewed by other users, and has no relation to SSH authentication attempts. Option D is wrong because ARP spoofing manipulates the Address Resolution Protocol to intercept network traffic at Layer 2, and does not involve password guessing against SSH services.

Why this answer

How to eliminate wrong answers

Option B is wrong because the Technical Findings Section contains detailed vulnerability descriptions, exploit steps, and raw data (e.g., CVSS scores, CVE references) that are too technical for a board-level audience. Option C is wrong because the Methodology Section describes the tools and techniques used (e.g., Nmap scanning, Metasploit modules), which is operational detail irrelevant to business impact. Option D is wrong because the Appendix with Logs includes raw output (e.g., packet captures, system logs) that is only useful for technical remediation teams, not for high-level decision-making.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because querying pg_shadow extracts password hashes but does not directly escalate to superuser or execute system commands; it only provides hashes that would need to be cracked, and the web application user already has CREATEFUNC, making function creation a more direct path. Option C is wrong because exploiting a kernel vulnerability is unnecessary and less efficient; the tester already has a shell and can leverage database privileges to escalate without kernel exploits. Option D is wrong because the 'sudo' command requires the www-data user to have specific sudo privileges (e.g., to run commands as postgres), which is not indicated in the scenario; the tester has no evidence of sudo access.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages to execute in a victim's browser, not measuring server-side response times with SQL sleep functions. Option C is wrong because command injection involves injecting operating system commands into a vulnerable application (e.g., via shell metacharacters), not SQL sleep functions or database timing delays.

Why this answer

How to eliminate wrong answers

Option A is wrong because an Nmap SYN scan sends crafted TCP SYN packets to the target, which is an active reconnaissance technique that can be detected by firewalls and IDS/IPS. Option C is wrong because brute-force login attempts actively send authentication requests to a service, generating logs and potentially triggering account lockout or alerting mechanisms. Option D is wrong because a Netcat banner grab requires establishing a TCP connection to the target service, which is an active interaction that can be logged and detected.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the maximum number of phishing emails is a constraint on the volume of attacks, not a mechanism to exclude specific targets like the executive leadership team. Option C is wrong because the time window for conducting social engineering activities controls when attacks occur, not who is targeted; it does not prevent attacks against the executive team.

Why this answer

How to eliminate wrong answers

Option B (nslookup) is wrong because it is a DNS lookup tool used to query name servers for domain name resolution, not for capturing or analyzing network packets. Option C (nmap) is wrong because it is a network scanning tool used for port discovery and service enumeration, not for real-time packet capture or protocol analysis.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS cache snooping reveals cached queries (e.g., recently resolved domains) but does not enumerate internal hosts or network ranges; it only shows what has been queried. Option C is wrong because querying for all SRV records only returns service-specific records (e.g., _ldap._tcp.domain.com) and does not provide a full list of hosts or network ranges; it is not a comprehensive enumeration technique.

Why this answer

How to eliminate wrong answers

Option B is wrong because requiring non-disruptive testing techniques only is a constraint on methodology, not a scoping element; it does not address the need to define the target environment, and the staging environment is isolated so disruptive techniques could be safely used. Option C is wrong because including production IP ranges in the scope 'just in case' violates the client's availability requirements and could lead to unauthorized testing on production systems, which is both risky and against the rules of engagement.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the Executive Summary is intended for non-technical stakeholders (e.g., executives, management) and should only contain a high-level overview of risks, business impact, and key metrics—not detailed exploitation steps. Option C is wrong because the Methodology section describes the overall testing approach, tools, and scope (e.g., whether black-box or white-box testing was used), but it does not break down the specific exploitation steps for each individual vulnerability.

Why this answer

How to eliminate wrong answers

Option A is wrong because the krbtgt account's NTLM hash is used to sign Kerberos Ticket-Granting Tickets (TGTs), not service tickets; obtaining it requires a different attack like a Golden Ticket or DCSync. Option B is wrong because listing domain users is typically done via LDAP queries (e.g., enum4linux, ldapsearch) and is not the goal of Kerberoasting, which focuses on cracking service account passwords. Option C is wrong because Kerberoasting yields a TGS for a specific service, not a TGT; impersonating a domain admin would require a TGT or a forged ticket (e.g., Silver Ticket), not a service ticket for a single SPN.

Why this answer

How to eliminate wrong answers

Option A is wrong because PsExec requires administrative privileges (typically local admin or domain admin) on the target system to execute services remotely, and membership in 'Remote Management Users' does not grant the necessary admin rights. Option B is wrong because MS16-075 is a local privilege escalation exploit (leveraging SeImpersonatePrivilege) that allows a low-privileged user to impersonate SYSTEM; it is not a lateral movement tool and does not leverage Remote Management Users group membership.

Why this answer

How to eliminate wrong answers

Option A is wrong because the payload does not cause an LDAP error; it successfully modifies the filter syntax to return all users, not a fallback behavior. Option B is wrong because the payload does not alter the base DN (distinguished name) of the search; it only manipulates the filter component of the query. Option C is wrong because the payload introduces a logical AND (the '&' operator) which is a conjunction, not a logical OR; the tautology makes the entire filter true, not by negating the original condition but by appending an always-true clause.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Executive Summary is a high-level overview intended for non-technical stakeholders, summarizing business risks and key findings without providing reproduction steps or root cause details. Option C is wrong because the Methodology section describes the overall testing approach, tools, and scope, but does not include the specific vulnerability reproduction steps or root cause analysis.

Why this answer

How to eliminate wrong answers

Option A is wrong because MySQL runs over TCP, not UDP; port 3306 is a TCP port, and a UDP scan would be irrelevant and waste time. Option B is wrong because attempting default credentials without first identifying the MySQL version or understanding the authentication mechanism is premature and could alert the target or lock out accounts. Option D is wrong because scanning for other hosts with port 3306 open is a broad reconnaissance step that should occur after understanding the current target's service details, not before.

Why this answer

How to eliminate wrong answers

Option A is wrong because a detailed list of all ports and services found is too granular for a non-technical audience; it belongs in the technical findings or appendices, where system administrators can act on it. Option B is wrong because CVSS scores for every vulnerability are numerical metrics that require context to interpret; non-technical readers may not understand the scoring methodology or its implications, and presenting all scores without prioritization can obscure the overall risk picture.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because DNS enumeration with tools like `dnsrecon` involves actively querying DNS servers, which generates network traffic to the target's authoritative name servers or resolvers, making it an active reconnaissance technique rather than passive. Option C is wrong because querying certificate transparency logs (e.g., via crt.sh) is a passive technique, but it reveals SSL certificates and domain names, not cloud storage buckets; it does not directly identify publicly accessible storage endpoints like S3 buckets.

Why this answer

How to eliminate wrong answers

Option B is wrong because the script does not perform any vulnerability assessment; it only checks if port 22 is open (SYN-ACK received) and does not attempt to exploit or enumerate SSH service versions or vulnerabilities. Option C is wrong because the script uses TCP SYN packets to port 22, not ICMP echo requests (ping), so it is not an ICMP ping sweep; it specifically targets a single TCP port to identify live hosts with that port open.

Why this answer

How to eliminate wrong answers

Option A is wrong because social engineering of remote employees is a separate attack vector that does not address the core scoping issue of excluding cloud and branch office systems; the client's restriction is on the systems tested, not the methods used. Option C is wrong because the timing of the test (off-hours vs. business hours) is a separate operational consideration, not a direct response to the client's exclusion of cloud and branch infrastructure; the primary scoping concern is the incomplete coverage of the attack surface, not the schedule.

Why this answer

How to eliminate wrong answers

Option A is wrong because Kerberoasting requires the attacker to have a valid TGT for a domain user and targets service accounts with SPNs, not computer objects with GenericWrite. Option C is wrong because AS-REP Roasting targets user accounts that do not require Kerberos pre-authentication, not computer objects, and does not leverage GenericWrite over an object.

Why this answer

How to eliminate wrong answers

Option A is wrong because it omits essential technical details such as reproduction steps and evidence, which are necessary for validating the remediation and for legal/regulatory compliance. Option B is wrong because excluding a remediated vulnerability violates reporting best practices and can lead to incomplete audit trails, making it impossible to prove the issue was ever addressed.

Why this answer

How to eliminate wrong answers

Option A is wrong because listing the CVSS score and exploitability metrics provides a technical severity rating but does not translate that into business impact (e.g., dollar amounts or reputational harm), which the CISO specifically requested. Option C is wrong because providing raw log entries showing exploitation is operational evidence for technical teams, not a summary for executive decision-making; it fails to convey the broader business consequences.

Why this answer

How to eliminate wrong answers

Option B is incorrect because an incorrect Content-Type header would typically cause a 400 Bad Request or 415 Unsupported Media Type, not a 403 Forbidden, and the payloads work manually, so the Content-Type is likely correct. Option C is incorrect because rate limiting usually results in 429 Too Many Requests or connection timeouts, not a consistent 403 Forbidden on every request; the issue is with the request's identity, not its frequency.

Why this answer

How to eliminate wrong answers

Option A is wrong because the whois command queries domain registration details from WHOIS servers, which are not part of the target's infrastructure but still involve sending DNS queries that could be logged or traced, and it does not directly discover email addresses associated with the domain. Option B is wrong because Shodan actively scans the internet for exposed devices and services, including email servers, which involves sending packets to the target's infrastructure and is not passive reconnaissance. Option C is wrong because Google dorking uses search engines to find indexed pages, which is passive, but it is less efficient and targeted for discovering email addresses compared to theHarvester, which automates the process across multiple public sources.

Why this answer

How to eliminate wrong answers

Option A is wrong because Wireshark is a packet analyzer that can capture traffic but cannot perform a man-in-the-middle attack or initiate an authentication handshake; it lacks the ability to set up a rogue AP. Option B is wrong because aircrack-ng is used for cracking WPA/WPA2-PSK (pre-shared key) handshakes, not WPA2-Enterprise with PEAP, which uses EAP-MSCHAPv2 and requires a different attack vector. Option C is wrong because Ettercap is a network sniffing and MITM tool for LAN-based attacks (e.g., ARP spoofing), but it does not support 802.11 wireless rogue AP setup or EAP/PEAP handshake capture.

Why this answer

How to eliminate wrong answers

Option A is wrong because beginning to test the API without authorization assumes the client has the legal right to grant access to a third-party system, which is a common misconception that can lead to unauthorized access and legal consequences. Option C is wrong because it ignores the client's explicit request to include the API in the test scope, failing to meet the engagement requirements and potentially leaving critical integration vulnerabilities unassessed.

Why this answer

How to eliminate wrong answers

Option A is wrong because ASLR randomizes the stack base address, making it impossible to reliably predict where the NOP sled and shellcode reside, so the overwritten return address will likely point to an invalid location. Option B is wrong because return-to-libc typically requires knowing the runtime address of libc functions, which is randomized by ASLR; the PLT entry is a better target as it is resolved at load time and has a fixed address in the binary. Option D is wrong because a ROP chain can bypass ASLR only if you can leak a runtime address first (e.g., via an info leak), which is not provided in this scenario; without a leak, ROP cannot reliably locate gadgets in randomized memory regions.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it assumes on-premises systems are inherently more critical, which is a subjective and unsupported claim; in a hybrid infrastructure, cloud systems may host sensitive data or applications and can be the initial breach vector, so excluding them leaves critical risks unassessed. Option B is wrong because it incorrectly states that cloud systems are generally more secure and do not require testing; in reality, cloud systems are subject to misconfigurations (e.g., open S3 buckets, overly permissive IAM roles) and shared responsibility model gaps that require dedicated security testing.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because a CVSS score and risk rating provide a severity metric but no technical specifics about the vulnerable endpoint, input vector, or remediation steps, which a developer needs to fix the code. Option B is wrong because describing business impact and regulatory fines addresses management concerns but omits the technical details (e.g., the vulnerable parameter, payload, or encoding fix) required for a developer to remediate the stored XSS vulnerability.

Why this answer

How to eliminate wrong answers

Option A is wrong because exploiting a kernel vulnerability is a different technique that does not leverage the specific misconfiguration of the SUID binary with a relative path and unsanitized input; it would be used if no such binary existed or if kernel exploits were available, but the question explicitly describes a binary that can be exploited via PATH hijacking. Option C is wrong because impersonating the root user using sudo requires the tester to already have sudo privileges or know the root password, which is not the case here; the tester has a low-privileged shell and cannot simply use sudo without proper authorization.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an Executive Summary is a high-level overview for management, lacking the specific payload and step-by-step reproduction instructions needed by the development team. Option C is wrong because the Rules of Engagement define the scope, authorization, and constraints of the penetration test, not the technical details of a discovered vulnerability.

Why this answer

How to eliminate wrong answers

Option B is wrong because inserting a custom email header that mimics internal mail does not bypass SPF/DKIM/DMARC validation; the ESG still checks the SMTP envelope sender and the From header against DNS records, so the email will likely be rejected or flagged. Option C is wrong because using a URL shortener hides the malicious link but does not address the ESG's authentication checks on the sender domain; the email still fails SPF/DKIM/DMARC if the From domain is spoofed, and many ESGs now block or sandbox shortened URLs. Option D is wrong because registering a similar domain and spoofing the display name only bypasses human inspection, not the ESG's automated checks; the ESG will still validate the actual domain in the From header against SPF/DKIM/DMARC records, and the similar domain will fail unless it is also configured with proper authentication records.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the Heartbleed bug (CVE-2014-0160) is a vulnerability in OpenSSL, not Apache Struts2, and is detected by Nmap scripts like 'ssl-heartbleed', not 'http-vuln-cve2017-5638'. Option C is wrong because the Shellshock Bash vulnerability (CVE-2014-6271) affects the Bash shell and is typically exploited via CGI scripts, not through Apache Struts2's Jakarta Multipart parser, and is detected by scripts such as 'http-shellshock'.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because CVSS base score is a technical severity metric (0-10) based on exploitability and impact factors, not a financial measure; it does not incorporate asset value or loss frequency, so it cannot express monetary risk to a CFO. Option C is wrong because the number of critical findings is a raw count of high-severity vulnerabilities without any financial context; it ignores asset valuation, likelihood of exploitation, and potential loss, making it irrelevant for financial risk communication.

Why this answer

How to eliminate wrong answers

Option A is wrong because listing all tools used during the test does not prevent or mitigate disruption to production systems; it only provides transparency about the testing methodology. Option C is wrong because requiring the client to disable antivirus software would actually increase the risk of disruption, as it removes a critical security control that could detect and block malicious activity, potentially leading to unintended system instability or compromise.

Why this answer

Why this answer

How to eliminate wrong answers

Option B ({{7*'7'}}) is wrong because in Handlebars, multiplying a number by a string may cause a type error or unexpected behavior, not a clean numeric result, making it less reliable for SSTI detection. Option C (<%= 7*7 %>) is wrong because this is an ERB-style tag used in Ruby or other frameworks, not in Handlebars or Express/Node.js. Option D (${7*7}) is wrong because this is JavaScript template literal syntax, which is client-side and not processed by the server-side Handlebars engine.

Why this answer

How to eliminate wrong answers

Option A is wrong because ACK scans are a type of port scan that can still cause service disruption if sent at high rates or to vulnerable services, and the statement 'never send data payloads' is overly restrictive and irrelevant to preventing crashes—many safe techniques (e.g., SQL injection payloads) require data but can be rate-limited. Option C is wrong because it unnecessarily bans all automated tools, which would severely limit the test's effectiveness; manual testing alone cannot efficiently cover a large web application, and automated tools can be safely used with rate-limiting and proper configuration.