The correct choice is a clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected. This directly addresses the client’s concern about service disruption by establishing a measurable threshold—such as CPU exceeding 90% or network packet loss above 5%—that, when crossed, triggers an automatic halt to testing. In AWS environments, aggressive scanning can inadvertently exhaust EC2 burst credits, trigger Auto Scaling events, or saturate S3 request limits, causing degraded performance that mimics a DoS attack. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of the rules of engagement (ROE) as a critical pre-engagement document, specifically how to balance thorough cloud penetration testing with operational safety. A common trap is selecting a vague “monitor and report” option, which lacks the mandatory stop action required to prevent real harm. Memory tip: “Define the line, then stop on time”—the ROE must set a clear DoS definition and enforce an immediate halt to protect cloud infrastructure.
PT0-002 Planning and Scoping Practice Question
This PT0-002 practice question tests your understanding of planning and scoping. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A client wants a penetration test of their cloud infrastructure hosted on AWS. The client states that they want to test the security of their EC2 instances, S3 buckets, and IAM configurations. The client's security team is concerned about potential service disruption due to testing. Which of the following should be included in the rules of engagement to address this concern?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected.
Option B is correct because it directly addresses the client's concern about service disruption by establishing a clear threshold for denial-of-service (DoS) conditions and a mandatory stop action. In AWS, automated scanning or aggressive testing can inadvertently trigger Auto Scaling events, exhaust burst credits on EC2 instances, or saturate S3 request limits, leading to degraded performance. Defining what constitutes a DoS condition (e.g., CPU > 90%, network packet loss > 5%) ensures the tester can halt immediately, protecting the client's cloud infrastructure while still allowing effective security testing.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A clause that the tester will avoid using any automated scanning tools.
Why it's wrong here
Automated tools are often necessary for efficient testing; a blanket ban would limit effectiveness.
✓
A clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected.
Why this is correct
This addresses the concern directly by defining thresholds and a response plan.
Related concept
Read the scenario before looking for a memorised answer.
✗
A requirement that the tester only performs manual testing and no tools.
Why it's wrong here
Manual-only testing is inefficient and may not cover all attack vectors.
✗
A clause that the tester will test only during business hours.
Why it's wrong here
Time restrictions do not prevent service disruption; they only limit when testing occurs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose options A or C, mistakenly believing that avoiding automation or restricting testing hours will prevent service disruption, when in reality the key is having a clear, measurable definition of disruption and a stop condition, as required by the PT0-002 exam's focus on scoping and risk management.
Detailed technical explanation
How to think about this question
Under the hood, AWS services like EC2 use burstable instance types (e.g., t3.micro) that rely on CPU credits; a sudden spike from scanning can deplete credits and throttle performance. Similarly, S3 has a 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix limit; exceeding this can cause 503 SlowDown errors. A well-defined DoS clause in the rules of engagement (RoE) should reference specific AWS CloudWatch metrics (e.g., CPUUtilization, BucketSizeBytes, NumberOfObjects) and set actionable thresholds to trigger a halt, preventing unintended service degradation while still allowing aggressive testing within safe limits.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Planning and Scoping — This question tests Planning and Scoping — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected. — Option B is correct because it directly addresses the client's concern about service disruption by establishing a clear threshold for denial-of-service (DoS) conditions and a mandatory stop action. In AWS, automated scanning or aggressive testing can inadvertently trigger Auto Scaling events, exhaust burst credits on EC2 instances, or saturate S3 request limits, leading to degraded performance. Defining what constitutes a DoS condition (e.g., CPU > 90%, network packet loss > 5%) ensures the tester can halt immediately, protecting the client's cloud infrastructure while still allowing effective security testing.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.