PT0-002 Practice Question: A client wants to conduct a penetration test of…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Specify that the tester will only use ACK scans and never send data payloads.

  Why it's wrong here

  ACK scans are a TCP stealth technique that never completes a handshake, so they avoid crashing target services, but they still generate packets and can trigger intrusion detection/prevention systems, causing log flooding and potential rate-based blocking. Restricting the test to ACK scans alone limits your ability to accurately map open ports and firewall rules, reducing test coverage while still failing to contractually guarantee that automated tools won't be rate-limited or that a DoS condition won't occur. The client's concern is service disruption, and an ACK-only rule neither explicitly prohibits DoS nor sets a safe traffic ceiling, so it is insufficient.

• ✓

  Include a clause that prohibits denial-of-service attacks and rate-limits all automated tools.

  Why this is correct

  Including a clause that explicitly prohibits denial-of-service attacks and rate-limits automated tools directly mitigates the client's concern about service disruption by setting a contractual maximum on traffic intensity. Rate limiting—such as capping packets per second or concurrent connections—ensures that vulnerability scanners and other automated tools cannot unintentionally overwhelm the web application or its backend infrastructure. This is the standard rules-of-engagement practice that balances thorough testing with operational safety, making it the correct choice.

• ✗

  State that the tester will not use any automated tools and will perform only manual testing.

  Why it's wrong here

  Barring all automated tools forces a purely manual approach, which is typically far too slow and error-prone to provide comprehensive coverage of a web application's attack surface within a typical engagement window. Rate-limited automated scanning is more efficient and controllable than manual probing, and manual testers can still accidentally trigger a denial-of-service through a poorly timed flood of requests or by executing a heavy resource-consuming payload. The client's requirement is to prevent disruption, not to eliminate automation, so removing automation entirely is an overreaction that sacrifices test quality without actually guaranteeing zero downtime.

• ✗

  Do not include any specific limitation; the tester assumes responsibility for any outages.

  Why it's wrong here

  Omitting any constraint on traffic or attack types directly ignores the client's request, and adding an unqualified liability clause does not make that acceptable—it simply transforms a likely operational incident into a legal dispute. Unthrottled automated tools can easily exhaust connection pools, saturate logging, or trigger auto-scaling failures, causing the exact disruption the client wanted avoided. A professional rules-of-engagement document must define measurable limits and reflect the client's risk tolerance; refusing to do so is both unethical and a recipe for contract disputes.

Go deeper

Related to this question