PT0-002 Engagement Management Practice Question
Which of the following best describes the purpose of a vulnerability disclosure policy in the context of a penetration test?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To establish a process for reporting discovered vulnerabilities to the client and possibly to the public
A vulnerability disclosure policy outlines how vulnerabilities found during testing will be reported and remediated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To list the assets that are out of scope
Why it's wrong here
A vulnerability disclosure policy does not enumerate out-of-scope assets; that information belongs in the Statement of Work (SOW) or the Rules of Engagement, which define the testing boundaries and approved targets. The disclosure policy instead governs what happens after a vulnerability is verified, including how the tester reports it to the client and under what circumstances it may be shared publicly. Confusing scope with disclosure would mix pre-engagement contractual details with post-engagement communication procedures.
- ✗
To define the rules of engagement for the test
Why it's wrong here
Rules of Engagement (RoE) are a separate pre-engagement artifact that defines the approved attack surface, testing hours, and techniques — not the disclosure procedure. The vulnerability disclosure policy, in contrast, describes the reporting chain, the client's expected response, and any agreed-upon public disclosure timeline. RoE focuses on operability and legal boundaries during the test; the disclosure policy focuses on responsible handling of findings after the test.
- ✓
To establish a process for reporting discovered vulnerabilities to the client and possibly to the public
Why this is correct
The primary purpose of a vulnerability disclosure policy is to establish a clear, agreed-upon process for reporting discovered vulnerabilities to the client and, where necessary, to the public after an embargo period or remediation. It sets expectations for how findings are communicated, who is responsible for triage, and what conditions trigger coordinated disclosure — protecting the client from surprise and the tester from accusations of irresponsible release. This is the central function of the policy in any professional engagement.
- ✗
To provide legal protection to the tester
Why it's wrong here
While a disclosure policy may include a safe harbor clause in some bug bounty programs, it is not the instrument that provides legal protection to a penetration tester. Legal authorization and protection come from the signed engagement contract, the Statement of Work, or a written authorization letter that explicitly permits the testing activities. A vulnerability disclosure policy primarily manages the handling of findings; relying on it as a legal shield would leave the tester unprotected in court.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.