Question 79 of 509

Planning and Scoping →mediumMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is to include a provision to install a custom CA certificate on a rooted or jailbroken device. This works because certificate pinning in mobile apps hardcodes a specific server certificate or public key, causing the app to reject any proxy or interception certificate that doesn’t match. By installing a custom CA certificate as a trusted root on a rooted or jailbroken device, the penetration tester can bypass the pinning—the proxy (such as Burp Suite) uses that CA to sign its own certificates, allowing decryption of HTTPS traffic for dynamic analysis. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of mobile app security testing constraints and the need for explicit client authorization in the rules of engagement. A common trap is assuming a non-rooted device or a simple proxy configuration will work, but pinning blocks that without root-level trust injection. Memory tip: think “root the trust” to bypass the pin—elevated device access is the key.

PT0-002 Planning and Scoping Practice Question

This PT0-002 practice question tests your understanding of planning and scoping. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A client wants to test a mobile app that uses certificate pinning. The penetration tester needs to perform dynamic analysis of the app's network traffic. Which of the following should be included in the rules of engagement to enable this testing?

Question 1mediummultiple choice

Full question →

A
Include a provision to install a custom CA certificate on a rooted/jailbroken device.
This is the standard approach to bypass certificate pinning. By installing a custom CA certificate that the testing proxy uses, the tester can intercept and modify traffic. Rooting/jailbreaking may void warranties, so client permission is essential.
B
Request the app's source code for static analysis instead of dynamic analysis.
Why wrong: Static analysis does not require bypassing pinning, but it does not test the runtime behavior. The client requested dynamic analysis, so a source code review alone is insufficient.
C
Use a proxy tool like Burp Suite without any modification to the device.
Why wrong: Without bypassing certificate pinning, the proxy will be unable to intercept the app's SSL/TLS traffic. The device must trust the proxy's certificate, which is prevented by pinning.
D
Obtain a list of API endpoints from the developer and test them manually.
Why wrong: This approach bypasses the need to intercept traffic, but it does not test the mobile app's actual behavior or reveal issues like hardcoded credentials, insecure data storage, or client-side vulnerabilities. Dynamic analysis of the live app is more thorough.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Include a provision to install a custom CA certificate on a rooted/jailbroken device.

Certificate pinning in mobile apps rejects any proxy or interception certificate that is not the expected pinned certificate. Installing a custom CA certificate on a rooted/jailbroken device allows the tester to bypass the pinning by injecting a trusted root CA that the proxy (e.g., Burp Suite) uses to sign its certificates, enabling decryption of HTTPS traffic for dynamic analysis.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Include a provision to install a custom CA certificate on a rooted/jailbroken device.
Why this is correct
This is the standard approach to bypass certificate pinning. By installing a custom CA certificate that the testing proxy uses, the tester can intercept and modify traffic. Rooting/jailbreaking may void warranties, so client permission is essential.
Related concept
Read the scenario before looking for a memorised answer.
✗
Request the app's source code for static analysis instead of dynamic analysis.
Why it's wrong here
Static analysis does not require bypassing pinning, but it does not test the runtime behavior. The client requested dynamic analysis, so a source code review alone is insufficient.
✗
Use a proxy tool like Burp Suite without any modification to the device.
Why it's wrong here
Without bypassing certificate pinning, the proxy will be unable to intercept the app's SSL/TLS traffic. The device must trust the proxy's certificate, which is prevented by pinning.
✗
Obtain a list of API endpoints from the developer and test them manually.
Why it's wrong here
This approach bypasses the need to intercept traffic, but it does not test the mobile app's actual behavior or reveal issues like hardcoded credentials, insecure data storage, or client-side vulnerabilities. Dynamic analysis of the live app is more thorough.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates assume a proxy tool alone can intercept pinned traffic, forgetting that certificate pinning explicitly rejects untrusted CAs, so device modification (root/jailbreak and custom CA) is mandatory for dynamic analysis.

Detailed technical explanation

How to think about this question

Certificate pinning is implemented via the app's trust store (e.g., Android's Network Security Config or iOS's ATS with pinned public keys). On a rooted/jailbroken device, tools like Frida or Objection can hook into the app's SSL/TLS validation methods (e.g., checkServerTrusted in Java) to bypass pinning, or a custom CA can be added to the system trust store. In real-world engagements, testers often combine a custom CA with a proxy and a bypass tool like Frida to handle apps that use both pinning and certificate transparency checks.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PT0-002 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Planning and Scoping practice questions

Practise PT0-002 questions linked to Planning and Scoping.

Information Gathering and Vulnerability Scanning practice questions

Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.

Attacks and Exploits practice questions

Practise PT0-002 questions linked to Attacks and Exploits.

Reporting and Communication practice questions

Practise PT0-002 questions linked to Reporting and Communication.

Tools and Code Analysis practice questions

Practise PT0-002 questions linked to Tools and Code Analysis.

PT0-002 fundamentals practice questions

Practise PT0-002 questions linked to PT0-002 fundamentals.

PT0-002 scenario practice questions

Practise PT0-002 questions linked to PT0-002 scenario.

PT0-002 troubleshooting practice questions

Practise PT0-002 questions linked to PT0-002 troubleshooting.

Practice this exam

Start a free PT0-002 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PT0-002 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PT0-002 question test?

Planning and Scoping — This question tests Planning and Scoping — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Include a provision to install a custom CA certificate on a rooted/jailbroken device. — Certificate pinning in mobile apps rejects any proxy or interception certificate that is not the expected pinned certificate. Installing a custom CA certificate on a rooted/jailbroken device allows the tester to bypass the pinning by injecting a trusted root CA that the proxy (e.g., Burp Suite) uses to sign its certificates, enabling decryption of HTTPS traffic for dynamic analysis.

What should I do if I get this PT0-002 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.