The answer is the written authorization and the rules of engagement. The written authorization, often called the pre-test authorization documents, is the foundational legal contract that grants explicit permission to test only the specified public IP ranges, shielding the tester from liability under laws like the Computer Fraud and Abuse Act. The rules of engagement then define the operational boundaries, such as the prohibition of denial-of-service testing, ensuring the tester avoids service disruption and stays within scope. On the CompTIA PenTest+ PT0-002 exam, this concept tests your understanding of the critical pre-engagement phase, where missing either document can invalidate the entire test or expose you to legal risk. A common trap is confusing the rules of engagement with the scope statement alone—remember, the rules of engagement explicitly list prohibited techniques like DoS, while the scope defines targets. Memory tip: think "Permission and Parameters"—the written authorization gives you the legal key, and the rules of engagement draw the fence you cannot cross.
PT0-002 Planning and Scoping Practice Question
This PT0-002 practice question tests your understanding of planning and scoping. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Before starting a penetration test, the tester receives permission to test only two public IP ranges and is told not to perform denial-of-service testing. Which two documents or artefacts are most important to confirm before testing begins? (Choose 2.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Written authorization to test the specified targets.
Written authorization (A) is the foundational legal document that explicitly grants the tester permission to test the specified public IP ranges, protecting against claims of unauthorized access under laws like the Computer Fraud and Abuse Act. The rules of engagement (B) define the scope boundaries, including the prohibition of denial-of-service testing, which is critical to avoid service disruption and legal liability. Without these two documents, the tester lacks both legal authority and operational constraints, making them the most important artefacts before testing begins.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Written authorization to test the specified targets.
Why this is correct
Testing must be explicitly authorized.
Related concept
Read the scenario before looking for a memorised answer.
✓
Rules of engagement describing prohibited techniques such as DoS.
Why this is correct
RoE defines allowed methods, timing, contacts, and restrictions.
Related concept
Read the scenario before looking for a memorised answer.
✗
A list of exploit payloads from a public GitHub repository.
Why it's wrong here
Payload lists do not authorize the test or define scope.
✗
A screenshot of the company home page.
Why it's wrong here
A screenshot is not a scope or authorization artefact.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may mistakenly prioritize technical artefacts like exploit lists or screenshots over the legal and scoping documents that are mandatory before any testing begins, confusing operational tools with authorization requirements.
Detailed technical explanation
How to think about this question
In penetration testing, the rules of engagement (ROE) typically include explicit clauses on prohibited actions (e.g., DoS, social engineering) and target scope (e.g., IP ranges, URLs), often formalized in a signed statement of work (SOW). Written authorization should reference specific IP ranges and be signed by an authorized stakeholder, such as a CISO or legal representative, to ensure enforceability under contract law and cybercrime statutes like the CFAA or GDPR.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Planning and Scoping — This question tests Planning and Scoping — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Written authorization to test the specified targets. — Written authorization (A) is the foundational legal document that explicitly grants the tester permission to test the specified public IP ranges, protecting against claims of unauthorized access under laws like the Computer Fraud and Abuse Act. The rules of engagement (B) define the scope boundaries, including the prohibition of denial-of-service testing, which is critical to avoid service disruption and legal liability. Without these two documents, the tester lacks both legal authority and operational constraints, making them the most important artefacts before testing begins.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.