hardMultiple ChoiceObjective-mapped
Defining Cloud Asset Scope in ROE — Data Sovereignty & Compliance
A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?
Quick Answer
The answer is listing the allowed AWS regions and associated VPC CIDR ranges, as this is the most critical documentation to include in the rules of engagement (ROE) when defining cloud asset scope in ROE for data sovereignty and compliance. This precise technical boundary ensures the penetration testing team only targets systems within US-based regions, preventing inadvertent access to resources in non-US regions that could violate data sovereignty laws. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of how ROE must translate legal constraints into actionable network scoping—a common trap is choosing a vague policy statement instead of specific CIDR ranges. Remember, without explicit region and subnet boundaries, the test scope is legally ambiguous. Memory tip: “Regions and Ranges” — if the ROE doesn’t list both, the scope is out of bounds.
⚠ Common exam trap
A common mix-up: candidates confuse the SOW (which defines high-level scope) with the ROE (which requires specific technical boundaries like region and CIDR lists), leading them to select Option A instead of the more precise Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
List of allowed AWS regions and associated VPC CIDR ranges
The rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Statement of Work (SOW)
Why it's wrong here
The SOW outlines the general objectives and deliverables, but not the specific regional restrictions.
- ✓
List of allowed AWS regions and associated VPC CIDR ranges
Why this is correct
This explicitly defines the geographic scope, preventing tests in non-US regions and ensuring compliance with data sovereignty laws.
- ✗
Data Processing Agreement (DPA)
Why it's wrong here
A DPA governs how data is processed and protected, but does not define which systems are in scope for testing.
- ✗
Penetration testing methodology document
Why it's wrong here
The methodology describes techniques and procedures, not the scope or legal boundaries.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Rules of engagement
Rules of engagement are the documented guidelines that define the scope, boundaries, and authorized actions a security tester may take during a penetration test or security assessment.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PT0-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?
medium- A.Detailed network diagrams of the cloud environment
- ✓ B.Explicit exclusion of all cloud-based assets
- C.Approval from the cloud service provider
- D.A list of all cloud API endpoints
Why B: The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.
Variation 2. A penetration testing firm is hired to assess a client's network that includes both internal servers and external cloud-based services. The client wants to test only the internal network due to compliance concerns about testing cloud infrastructure. Which of the following should the penetration tester MOST strongly emphasize during the scoping meeting?
medium- A.That cloud services are often the most vulnerable and should be included for a thorough test
- ✓ B.That the test will not provide a complete risk picture without cloud components
- C.That the client can always test cloud services later in a separate engagement
- D.That compliance concerns are unfounded and the test should proceed anyway
Why B: The scope of a penetration test directly determines the validity of its risk assessment. Excluding cloud services creates a significant blind spot, as the client's attack surface includes both internal servers and external cloud-based services; without testing the cloud components, the test cannot provide a complete risk picture. The penetration tester must emphasize this limitation during scoping to ensure the client understands that the final report will not reflect the full security posture of their hybrid environment.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.