easyMultiple Choice
PT0-002 Practice Question: Is the most important factor when determining the…
Which of the following is the most important factor when determining the scope of a penetration test?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Business objectives
The client's business objectives drive the scope to ensure the test addresses what the client needs to protect. Tools, vulnerabilities, and team size are secondary considerations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Tester's available tools
Why it's wrong here
The tester's available tools do not dictate engagement scope; rather, the scope and business objectives determine which tools are permissible and effective. If tooling were the primary factor, testing would be constrained by the tester's inventory rather than the organization's risk landscape, potentially leaving critical assets unexamined. Tools are selected to meet the engagement's goals and legal boundaries.
- ✓
Business objectives
Why this is correct
Business objectives are the most important scoping factor because they define why the test is conducted—such as regulatory compliance, security posture improvement, or protecting high-value assets—and thus which systems, data, and activities fall in scope. Without clear objectives, a penetration test lacks clear targets, success criteria, and boundaries, making results less meaningful to the organization. These objectives align the engagement with management's risk tolerance and business priorities.
- ✗
Latest vulnerabilities
Why it's wrong here
While knowledge of current vulnerabilities informs the tester's methodology, the latest CVEs do not define an organization's testing scope. Scope is based on the organization's business objectives, asset criticality, and compliance requirements; a vulnerability that is new may be irrelevant to the client's environment if it does not affect in-scope systems. Relying on recent disclosures could also create a snapshot that misses systemic configuration or architecture weaknesses unique to the target.
- ✗
Number of testing team members
Why it's wrong here
The number of testers is a resource scheduling consideration, not a scoping decision, as a larger team only affects how quickly and in what breadth testing can be completed. Defining what to test is driven by business objectives, regulatory mandates, and the client's risk priorities, which remain constant regardless of team size. Even a single tester can thoroughly assess a well-defined scope, whereas a large team cannot compensate for an undefined or misaligned engagement.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.