Question 160 of 509

Planning and Scoping →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is a rate-limiting clause that restricts scan speed and concurrent connections. This clause directly addresses the risk of causing a denial of service (DoS) by throttling the penetration test's traffic, preventing the tester from overwhelming critical systems even when network diagrams or a staging environment are unavailable. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of how to mitigate operational risk within the rules of engagement—a common trap is choosing a liability waiver or an insurance clause, which shifts blame but does not prevent the DoS itself. Remember that rate limiting is a proactive technical control, not a reactive legal one. A useful memory tip is to think "slow and steady avoids the DoS ready"—tools like Nmap’s `--max-rate` flag are your friends here.

PT0-002 Planning and Scoping Practice Question

This PT0-002 practice question tests your understanding of planning and scoping. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A client is planning a penetration test of their internal network but refuses to provide network diagrams or access to a staging environment. The tester is concerned about causing a denial of service (DoS) on critical systems. Which clause should be included in the rules of engagement to mitigate this risk?

Question 1mediummultiple choice

Full question →

A
A clause requiring the client to provide a complete list of in-scope IP addresses.
Why wrong: While a list helps, the client refuses to provide network details, making this clause infeasible. Even with a list, rate limiting is still needed to avoid DoS.
B
A waiver stating that any service disruption is the client's responsibility.
Why wrong: A waiver does not prevent DoS; it only transfers liability. The goal is to reduce the risk of disruption, not just manage legal fallout.
C
A rate-limiting clause that restricts scan speed and concurrent connections.
Rate limiting is a proactive measure that reduces the chance of overwhelming network devices or services, even when the tester lacks full network visibility.
D
An exclusion list for systems that should not be tested.
Why wrong: Without knowing which systems are critical, the tester cannot create an effective exclusion list. Rate limiting is more comprehensive.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A rate-limiting clause that restricts scan speed and concurrent connections.

Option C is correct because a rate-limiting clause directly addresses the risk of causing a denial of service (DoS) by controlling the speed and concurrency of the penetration test. By restricting scan rates (e.g., using tools like Nmap with `--max-rate` or `--min-hostgroup`) and limiting concurrent connections, the tester can prevent overwhelming critical systems, even without network diagrams or a staging environment. This clause mitigates the risk without requiring the client to provide additional information or shifting liability.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A clause requiring the client to provide a complete list of in-scope IP addresses.
Why it's wrong here
While a list helps, the client refuses to provide network details, making this clause infeasible. Even with a list, rate limiting is still needed to avoid DoS.
✗
A waiver stating that any service disruption is the client's responsibility.
Why it's wrong here
A waiver does not prevent DoS; it only transfers liability. The goal is to reduce the risk of disruption, not just manage legal fallout.
✓
A rate-limiting clause that restricts scan speed and concurrent connections.
Why this is correct
Rate limiting is a proactive measure that reduces the chance of overwhelming network devices or services, even when the tester lacks full network visibility.
Related concept
Read the scenario before looking for a memorised answer.
✗
An exclusion list for systems that should not be tested.
Why it's wrong here
Without knowing which systems are critical, the tester cannot create an effective exclusion list. Rate limiting is more comprehensive.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may choose Option A (list of IPs) thinking it reduces risk by narrowing scope, but they overlook that aggressive scanning of even a small IP list can still cause DoS, while rate-limiting directly controls the traffic intensity.

Detailed technical explanation

How to think about this question

Rate-limiting in penetration testing is typically implemented via timing templates in Nmap (e.g., `-T0` for paranoid, `-T1` for sneaky) or by using `--max-rate` to cap packets per second and `--max-parallelism` to limit concurrent probes. In real-world scenarios, a tester might use `--scan-delay` to add inter-probe delays, preventing network congestion and avoiding triggering intrusion detection systems (IDS) that could drop connections. This is especially critical when testing legacy systems or industrial control systems (ICS) that are sensitive to traffic bursts.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PT0-002 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Planning and Scoping practice questions

Practise PT0-002 questions linked to Planning and Scoping.

Information Gathering and Vulnerability Scanning practice questions

Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.

Attacks and Exploits practice questions

Practise PT0-002 questions linked to Attacks and Exploits.

Reporting and Communication practice questions

Practise PT0-002 questions linked to Reporting and Communication.

Tools and Code Analysis practice questions

Practise PT0-002 questions linked to Tools and Code Analysis.

PT0-002 fundamentals practice questions

Practise PT0-002 questions linked to PT0-002 fundamentals.

PT0-002 scenario practice questions

Practise PT0-002 questions linked to PT0-002 scenario.

PT0-002 troubleshooting practice questions

Practise PT0-002 questions linked to PT0-002 troubleshooting.

Practice this exam

Start a free PT0-002 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PT0-002 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PT0-002 question test?

Planning and Scoping — This question tests Planning and Scoping — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: A rate-limiting clause that restricts scan speed and concurrent connections. — Option C is correct because a rate-limiting clause directly addresses the risk of causing a denial of service (DoS) by controlling the speed and concurrency of the penetration test. By restricting scan rates (e.g., using tools like Nmap with `--max-rate` or `--min-hostgroup`) and limiting concurrent connections, the tester can prevent overwhelming critical systems, even without network diagrams or a staging environment. This clause mitigates the risk without requiring the client to provide additional information or shifting liability.

What should I do if I get this PT0-002 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.