PT0-002 Engagement Management Practice Question
Which penetration testing standard provides a methodology that includes pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?
⚠ Common exam trap
It's easy for candidates to confuse the OWASP Testing Guide (Option C) as a general penetration testing standard because it is widely known, but it is strictly limited to web application security and does not cover the full lifecycle of a penetration test as defined in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PTES
The Penetration Testing Execution Standard (PTES) is the only standard among the options that explicitly defines a full penetration testing methodology with the phases listed: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. PTES provides a structured, seven-phase framework designed specifically for penetration testers, making it the correct choice for this question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OSSTMM
Why it's wrong here
OSSTMM is a security testing methodology but is not as comprehensive for penetration testing lifecycle because it centers on operational security metrics and tactical verification of controls, such as trust and human factors, without defining a full engagement structure. It lacks explicit phases for pre-engagement client interactions, remediation planning, and post-engagement reporting that a complete penetration testing standard requires.
- ✗
NIST SP 800-115
Why it's wrong here
NIST SP 800-115 is a technical guide for assessing security controls, providing specific techniques like network discovery, vulnerability scanning, and password cracking, but it does not prescribe a full penetration testing lifecycle. It focuses on the assessment execution steps rather than the business-oriented phases of pre-engagement, reporting, and post-remediation validation, making it a reference for testers rather than a comprehensive methodology standard.
- ✗
OWASP Testing Guide
Why it's wrong here
OWASP Testing Guide is strictly scoped to web application security, enumerating vulnerabilities such as injection, XSS, and broken authentication, along with corresponding test cases for web apps. It does not address network penetration, social engineering, physical security, or the broader engagement management phases, so using it as a general penetration testing standard would leave critical non-web components untested and unmanaged.
- ✓
PTES
Why this is correct
PTES is the correct answer because it defines a complete penetration testing methodology with seven distinct phases, including pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. This structure explicitly incorporates both technical execution and business/legal considerations, providing a comprehensive standard that fully covers the penetration testing lifecycle from initial scoping to final client deliverable.
Go deeper
Related to this question
Learn chapter
Phishing Campaigns in Penetration Testing
Key term
Post-exploitation
Post-exploitation is the phase of a penetration test that begins after an attacker has gained initial access to a system, focusing on maintaining access, escalating privileges, moving laterally, and achieving the test's objectives.
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.