PT0-002 Engagement Management Practice Question
During the pre-engagement phase, which document defines the IP ranges, test windows, and emergency stop criteria for a penetration test?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rules of Engagement (RoE)
The Rules of Engagement (RoE) document specifies technical constraints like IP ranges, timing, and stop conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Get-out-of-jail letter
Why it's wrong here
The get-out-of-jail letter, also known as an authorization letter, is a legal document that grants the penetration tester permission to perform specific activities without fear of prosecution. It shields the tester from criminal or civil liability but does not define technical boundaries such as target IP ranges, testing windows, or when to halt operations. This authorization artifact is often referenced by the Rules of Engagement but is not itself a constraints document.
- ✗
Non-Disclosure Agreement (NDA)
Why it's wrong here
A Non-Disclosure Agreement (NDA) is a legally binding contract that establishes confidentiality obligations between the penetration testing firm and the client. It covers how sensitive data—such as source code, credentials, and findings—is handled, stored, and destroyed after the engagement, but it does not address operational limits like allowed testing techniques, time-of-day restrictions, or emergency stop conditions. The NDA is a privacy safeguard, not a technical rules framework.
- ✗
Statement of Work (SOW)
Why it's wrong here
The Statement of Work (SOW) is a project-level document that outlines the scope of work, deliverables, milestones, and compensation models for the engagement. It may list high-level objectives (e.g., 'test the external perimeter') and specify report formats, but it deliberately avoids granular technical constraints such as exact IP addresses, permissible attack types, or fail-safe termination criteria. The SOW provides the 'what' and 'when' of the project, while the Rules of Engagement provides the precise 'how' and 'when you must stop.'
- ✓
Rules of Engagement (RoE)
Why this is correct
The Rules of Engagement (RoE) is the authoritative document that translates the client's authorization into actionable, technical constraints. It explicitly defines allowed target IP ranges, domains, and systems; test execution windows; permitted tools and attack techniques; escalation paths; and unambiguous stop criteria—such as 'halt testing immediately if any production system fails.' RoE is typically signed by both parties and serves as the singular reference for allowable activities, ensuring no tester exceeds scope and no client is caught off guard.
Go deeper
Related to this question
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.