The answer is that the tester must use only non-intrusive scanning techniques on the APIs. This is correct because the core scoping consideration for critical APIs that cannot be taken offline is to preserve availability; non-intrusive methods like passive traffic analysis or read-only HTTP calls (GET, HEAD) avoid triggering rate limits, corrupting data, or causing service disruption, directly addressing the client’s operational constraint. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of scoping rules of engagement, where the common trap is to assume intrusive active scanning is always acceptable—remember that availability trumps thoroughness when APIs are business-critical. A useful memory tip is “GET before POST”: if the API can’t go down, stick to safe, read-only verbs and passive observation to keep the lights on while still gathering intelligence.
PT0-002 Planning and Scoping Practice Question
This PT0-002 practice question tests your understanding of planning and scoping. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tester must use only non-intrusive scanning techniques on the APIs.
Option A is correct because the client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The tester must use only non-intrusive scanning techniques on the APIs.
Why this is correct
Non-intrusive techniques reduce the likelihood of causing service disruption while still allowing assessment.
Related concept
Read the scenario before looking for a memorised answer.
✗
The tester must exclude all API endpoints from testing.
Why it's wrong here
Excluding all API endpoints would leave the APIs untested, which is not aligned with the client's goal.
✗
The tester must coordinate testing schedules with the API vendors.
Why it's wrong here
While coordination may be useful, the primary concern is the testing approach; many APIs may not require vendor coordination.
✗
The tester must provide a list of all API calls to be made prior to testing.
Why it's wrong here
Providing a list of calls may be part of the planning but does not address the operational risk of disruption.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may assume 'non-intrusive' means only using automated scanners or that coordinating with vendors (Option C) is necessary for third-party APIs, but the core scoping principle is to avoid impacting production availability while still testing the API attack surface.
Detailed technical explanation
How to think about this question
Non-intrusive scanning on APIs typically involves using safe HTTP methods (GET, HEAD, OPTIONS) and avoiding write operations (POST, PUT, PATCH, DELETE) that could modify state. Tools like OWASP ZAP's 'Passive Scan' or Burp Suite's 'Passive Scanner' analyze traffic without sending payloads, while read-only API calls with proper authentication tokens can enumerate endpoints and check for information disclosure (e.g., exposed API keys in responses). In a real-world scenario, a tester might use a read-only API key to list users or orders without creating or deleting records, ensuring the API remains operational for the client's payment processing and shipping workflows.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Planning and Scoping — This question tests Planning and Scoping — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The tester must use only non-intrusive scanning techniques on the APIs. — Option A is correct because the client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.
What should I do if I get this PT0-002 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.