The answer is listing the allowed AWS regions and associated VPC CIDR ranges, as this is the most critical documentation to include in the rules of engagement (ROE) when defining cloud asset scope in ROE for data sovereignty and compliance. This precise technical boundary ensures the penetration testing team only targets systems within US-based regions, preventing inadvertent access to resources in non-US regions that could violate data sovereignty laws. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of how ROE must translate legal constraints into actionable network scoping—a common trap is choosing a vague policy statement instead of specific CIDR ranges. Remember, without explicit region and subnet boundaries, the test scope is legally ambiguous. Memory tip: “Regions and Ranges” — if the ROE doesn’t list both, the scope is out of bounds.
PT0-002 Planning and Scoping Practice Question
This PT0-002 practice question tests your understanding of planning and scoping. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
List of allowed AWS regions and associated VPC CIDR ranges
Option B is correct because the rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Statement of Work (SOW)
Why it's wrong here
The SOW outlines the general objectives and deliverables, but not the specific regional restrictions.
✓
List of allowed AWS regions and associated VPC CIDR ranges
Why this is correct
This explicitly defines the geographic scope, preventing tests in non-US regions and ensuring compliance with data sovereignty laws.
Related concept
Read the scenario before looking for a memorised answer.
✗
Data Processing Agreement (DPA)
Why it's wrong here
A DPA governs how data is processed and protected, but does not define which systems are in scope for testing.
✗
Penetration testing methodology document
Why it's wrong here
The methodology describes techniques and procedures, not the scope or legal boundaries.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the SOW (which defines high-level scope) with the ROE (which requires specific technical boundaries like region and CIDR lists), leading them to select Option A instead of the more precise Option B.
Detailed technical explanation
How to think about this question
AWS regions are isolated geographic areas, and each region has a unique set of API endpoints and VPC CIDR ranges (e.g., us-east-1 uses 10.0.0.0/8 by default but can be customized). In a penetration test, the ROE must specify allowed region identifiers (e.g., us-east-1, us-west-2) and their associated VPC CIDR blocks to ensure that scanning tools (e.g., Nmap, masscan) and exploitation attempts are restricted to those IP ranges. A real-world scenario might involve a misconfigured VPC peering that routes traffic to a non-US region; explicit CIDR whitelisting in the ROE prevents accidental cross-region testing.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Planning and Scoping — This question tests Planning and Scoping — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: List of allowed AWS regions and associated VPC CIDR ranges — Option B is correct because the rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?
medium
A.Detailed network diagrams of the cloud environment
✓ B.Explicit exclusion of all cloud-based assets
C.Approval from the cloud service provider
D.A list of all cloud API endpoints
Why B: The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.
Variation 2. A penetration testing firm is hired to assess a client's network that includes both internal servers and external cloud-based services. The client wants to test only the internal network due to compliance concerns about testing cloud infrastructure. Which of the following should the penetration tester MOST strongly emphasize during the scoping meeting?
medium
A.That cloud services are often the most vulnerable and should be included for a thorough test
✓ B.That the test will not provide a complete risk picture without cloud components
C.That the client can always test cloud services later in a separate engagement
D.That compliance concerns are unfounded and the test should proceed anyway
Why B: Option B is correct because the scope of a penetration test directly determines the validity of its risk assessment. Excluding cloud services creates a significant blind spot, as the client's attack surface includes both internal servers and external cloud-based services; without testing the cloud components, the test cannot provide a complete risk picture. The penetration tester must emphasize this limitation during scoping to ensure the client understands that the final report will not reflect the full security posture of their hybrid environment.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.