PenTest+ · Domain 1 of 5

PenTest+ Domain 1: Engagement Management

Engagement Management covers the professional scaffolding around a penetration test: scoping and authorization, the agreements that make testing legal, the frameworks that guide it, and the report that turns findings into action. In PT0-003 reporting lives here.

Exam weight
13%
Official objectives
5
Estimated questions estimate
~12
Suggested study time estimate
15–20 hrs

About 13 min read Reviewed October 2026

Overview

Domain 1 covers everything that surrounds the technical work. It starts with pre-engagement activities: scope definition, regulations and standards, rules of engagement, agreement types such as NDA, MSA, SoW and ToS, target selection, assessment types, the shared responsibility model, and legal and ethical considerations including authorization letters and mandatory reporting. It covers collaboration and communication: peer review, stakeholder alignment, root cause analysis, escalation paths, secure distribution, articulating risk and severity, goal reprioritization, business impact analysis and client acceptance. It compares testing frameworks and methodologies such as OSSTMM, PTES, MITRE ATT&CK, OWASP Top 10 and MASVS, the Purdue model, and threat modeling with DREAD, STRIDE and OCTAVE. It finishes with the components of a penetration test report and analyzing findings to recommend technical, administrative, operational and physical remediation.

This domain frames the whole engagement. The other four domains carry out the work this one authorizes, scopes and reports.

How it's tested

Questions describe a pre-test negotiation, a mid-engagement surprise, a framework choice or a reporting decision and ask what the tester should do, which agreement or framework applies, or what a report must contain. The professional and legal answer usually beats the technically aggressive one.

  • Authorization and scope

    The tester encounters an out-of-scope system or a legal question, and you must choose the response that stays within authorization.

  • Right agreement or framework

    A document or methodology need is described, and you must match it to the correct agreement type or testing framework.

  • Report and remediation

    A finding or report section is described, and you must choose what belongs in it or the right remediation control.

Reasoning it through

During an external test, the tester discovers that a critical vulnerability sits on an IP address not listed in the scope but clearly owned by the client. Exploiting it is tempting. But acting outside the agreed scope breaks the rules of engagement and the authorization. The correct move is to stop, document the finding, and contact the client through the agreed escalation path to decide whether to extend scope.

Objectives 5

Official objectives from the CompTIA outline, in outline order.

1.1 Summarize pre-engagement activities.Scope, regulations, rules of engagement, agreements, targets, assessment types, shared responsibility and legal considerations.
What it means
Pre-engagement work defines the scope and the rules of engagement (exclusions, test cases, escalation, testing window), selects agreement types (NDA, MSA, SoW, ToS), identifies targets by CIDR ranges, domains, IPs and URLs, chooses assessment types such as web, network, mobile, cloud, API and wireless, clarifies the shared responsibility model between hosting provider, customer, tester and third parties, and settles legal and ethical considerations including authorization letters and mandatory reporting.
What to understand
Written authorization is non-negotiable and defines what may be tested, when and how. In cloud assessments the shared responsibility model and the provider's testing rules limit what the customer can authorize. Some findings, such as evidence of an existing breach or illegal content, trigger mandatory reporting obligations.
How it shows up
A scoping or authorization question is posed, and you must identify the right agreement, the correct scope boundary, or the mandatory reporting duty.
Common confusion
Confusing the agreement types. An NDA protects confidentiality, an MSA sets overall terms, and a SoW defines the specific work.
1.2 Explain collaboration and communication activities.Peer review, stakeholder alignment, root cause analysis, escalation, secure distribution and risk articulation.
What it means
This covers working with the client and the team: peer review of findings, stakeholder alignment, root cause analysis, escalation paths, secure distribution of sensitive reports, articulating risk, severity and impact, goal reprioritization during the engagement, business impact analysis, and formal client acceptance at the end.
What to understand
Communication is continuous, not just at the report stage. Critical findings, such as a system already compromised, are escalated immediately rather than held for the final report. Reports contain sensitive attack detail, so they must be distributed securely, often encrypted, to named recipients only.
How it shows up
A critical finding appears mid-test, or a report must be shared, and you must choose the right communication or escalation action.
Common confusion
Assuming all findings wait for the final report. Severe or dangerous findings are escalated at once.
1.3 Compare and contrast testing frameworks and methodologies.OSSTMM, CREST, PTES, MITRE ATT&CK, OWASP Top 10 and MASVS, the Purdue model, and threat modeling with DREAD, STRIDE and OCTAVE.
What it means
This objective covers the structured approaches to testing: OSSTMM, CREST, PTES, MITRE ATT&CK, the OWASP Top 10 and Mobile Application Security Verification Standard (MASVS), the Purdue model for industrial networks, and threat modeling frameworks DREAD, STRIDE and OCTAVE.
What to understand
Each framework fits a purpose. The OWASP Top 10 and MASVS guide web and mobile application testing, the Purdue model structures OT and ICS network segmentation, PTES and OSSTMM give overall methodology, ATT&CK maps adversary techniques, and DREAD, STRIDE and OCTAVE structure threat modeling.
How it shows up
A target type or testing goal is described, and you must choose the matching framework or threat modeling method.
Common confusion
Treating these as interchangeable. The exam expects you to match the framework to the target, such as MASVS for mobile and the Purdue model for industrial networks.
1.4 Explain the components of a penetration test report.Format, documentation, risk scoring, definitions and report sections.
What it means
A penetration test report covers format alignment, documentation specifications, risk scoring, definitions, and the standard components: executive summary, methodology, detailed findings, attack narrative, and recommendations including remediation guidance. It also covers test limitations and assumptions and reporting considerations such as legal, ethical, quality control and the use of AI.
What to understand
The executive summary is written for leadership in business terms, while detailed findings and the attack narrative serve technical readers. Risk scoring makes priorities clear. Limitations and assumptions set the boundaries of what the test could conclude. If AI assists in writing, its output must be checked for accuracy and confidentiality.
How it shows up
A report audience or section is described, and you must choose what belongs in it, or identify a missing component.
Common confusion
Putting technical detail in the executive summary. Leadership needs impact and decisions, not exploit specifics.
1.5 Given a scenario, analyze the findings and recommend the appropriate remediation within a report.Technical, administrative, operational and physical remediation controls.
What it means
This objective covers recommending remediation by control category. Technical controls include system hardening, input sanitization and parameterized queries, MFA, encryption, patch management, key rotation, certificate and secrets management, and network segmentation. Administrative controls include role-based access control, a secure SDLC, password requirements and policies. Operational controls include job rotation, time-of-day restrictions, mandatory vacations and user training. Physical controls include access control vestibules, biometrics and video surveillance.
What to understand
Remediation should match the root cause of the finding. SQL injection is fixed with parameterized queries and input validation, not with a firewall rule. Recommendations should be practical and prioritized by risk.
How it shows up
A finding is described, and you must choose the most effective remediation, usually the one that addresses the underlying weakness.
Common confusion
Recommending a detective or network control for a flaw that needs a code or configuration fix.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Rules of engagement

    The agreed terms of the test: scope, exclusions, test cases, escalation and the testing window.

    Remember
    They define what is permitted. Acting outside them is unauthorized.
    Tested as
    Scope and authorization questions.
    Trap
    Testing a discovered but out-of-scope system.

  • Authorization letter

    Written permission from an authorized party to conduct the test.

    Remember
    Without it, testing is illegal regardless of skill.
    Tested as
    Legal consideration questions.
    Trap
    Relying on a verbal go-ahead.

  • NDA vs. MSA vs. SoW vs. ToS

    NDA protects confidentiality, MSA sets overall terms, SoW defines the specific work, and ToS states service conditions.

    Remember
    The SoW scopes the actual engagement.
    Tested as
    Agreement identification.
    Trap
    Confusing the MSA with the SoW.

  • Shared responsibility in cloud tests

    Hosting provider, customer, tester and third parties each own part of security and of what may be tested.

    Remember
    The customer cannot authorize testing of what it does not control, and provider rules apply.
    Tested as
    Cloud scoping questions.
    Trap
    Scanning provider infrastructure without permission.

  • Mandatory reporting

    An obligation to report certain discoveries, such as evidence of a prior breach or illegal content.

    Remember
    It can override normal confidentiality.
    Tested as
    Ethical and legal questions.
    Trap
    Staying silent to avoid disrupting the test.

  • Escalation path

    The agreed route for raising urgent issues during an engagement.

    Remember
    Critical findings are escalated immediately, not held for the report.
    Tested as
    Communication questions.
    Trap
    Waiting until the final report to raise a severe issue.

  • Executive summary

    The report section for leadership, in business terms.

    Remember
    Impact and decisions, not exploit detail.
    Tested as
    Report component questions.
    Trap
    Filling it with technical steps.

  • Attack narrative

    A step-by-step account of how the tester achieved their objectives.

    Remember
    It lets defenders reproduce and understand the attack path.
    Tested as
    Report component questions.
    Trap
    Confusing it with the executive summary.

  • OWASP Top 10 vs. MASVS

    The OWASP Top 10 lists common web application risks. MASVS is the mobile application security verification standard.

    Remember
    Use MASVS for mobile and the Top 10 for web.
    Tested as
    Framework selection.
    Trap
    Applying the web Top 10 to mobile testing as if complete.

  • Purdue model

    A reference model for segmenting industrial control system networks into levels.

    Remember
    It structures OT and ICS testing and segmentation.
    Tested as
    OT framework questions.
    Trap
    Treating OT networks like ordinary IT networks.

  • STRIDE vs. DREAD vs. OCTAVE

    STRIDE categorizes threats, DREAD scores them, and OCTAVE is an organizational risk assessment method.

    Remember
    STRIDE identifies, DREAD rates, OCTAVE assesses organizational risk.
    Tested as
    Threat modeling questions.
    Trap
    Using DREAD to discover threats.

  • Remediation by control category

    Technical, administrative, operational and physical controls.

    Remember
    Match the remediation to the root cause of the finding.
    Tested as
    Remediation questions.
    Trap
    Recommending a network control for a code-level flaw.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

NDA vs. MSA vs. SoW vs. ToS

ConceptMeaningKey differenceCommon trap
NDA Protects confidential information shared during the engagement About secrecy Thinking it defines the work
MSA Master terms governing the overall relationship Sets general legal terms Expecting project specifics in it
SoW Defines the specific scope, deliverables and timeline Scopes this engagement Confusing it with the MSA
ToS Conditions for using a service Governs service use Treating it as the engagement contract

Executive summary vs. detailed findings vs. attack narrative

ConceptMeaningKey differenceCommon trap
Executive summary High-level overview for leadership Business impact and decisions Adding exploit detail
Detailed findings Each vulnerability with evidence and severity Technical specifics for fixers Omitting remediation guidance
Attack narrative The story of how the attack unfolded Reproducible attack path Merging it into the summary

STRIDE vs. DREAD vs. OCTAVE

ConceptMeaningKey differenceCommon trap
STRIDE Categories of threats Identifies threat types Using it to score severity
DREAD Scoring model for threats Rates severity Using it to find threats
OCTAVE Organizational risk assessment methodology Assesses enterprise risk Treating it as a per-vulnerability tool

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Exploit the bonus target

    What candidates pick
    Exploit an out-of-scope but client-owned system because the flaw is serious.
    Why it looks right
    It demonstrates real risk and the client owns the system.
    Why it's wrong
    The rules of engagement and authorization define what may be tested. Acting outside them is unauthorized and can be illegal.

    Clue to watch for The target is not listed in the scope or CIDR ranges.

  2. Verbal is enough

    What candidates pick
    Begin testing after a manager says it is fine, before paperwork is signed.
    Why it looks right
    The client seems eager and time is short.
    Why it's wrong
    Written authorization protects the tester legally and defines scope. Verbal approval does not.

    Clue to watch for The authorization letter or signed agreement is not yet in place.

  3. Save it for the report

    What candidates pick
    Record a system that is already compromised and continue testing quietly.
    Why it looks right
    It avoids disrupting the engagement.
    Why it's wrong
    Evidence of an active breach is escalated immediately through the agreed path, and may trigger mandatory reporting.

    Clue to watch for The finding indicates an existing compromise or illegal activity.

  4. Technical detail for executives

    What candidates pick
    Lead the executive summary with the exploit chain and payloads.
    Why it looks right
    It shows the depth of the work.
    Why it's wrong
    Executives need business impact, risk and decisions. Technical detail belongs in detailed findings and the attack narrative.

    Clue to watch for The audience is leadership or non-technical.

  5. Firewall the SQLi

    What candidates pick
    Recommend a network firewall rule to fix a SQL injection flaw.
    Why it looks right
    Firewalls are a familiar control.
    Why it's wrong
    SQL injection is fixed at the application layer with parameterized queries and input validation.

    Clue to watch for The finding is a code-level injection flaw.

  6. Scan the whole cloud

    What candidates pick
    Scan all cloud infrastructure the client's app runs on.
    Why it looks right
    Thorough coverage seems better.
    Why it's wrong
    Under shared responsibility, the customer cannot authorize testing of provider-managed infrastructure, and provider rules apply.

    Clue to watch for The target runs on a third-party cloud provider.

Answer framework

For any Domain 1 engagement scenario, use these steps before choosing an answer.

  1. Confirm that written authorization exists and that the target falls inside the agreed scope and rules of engagement before any action.
  2. For cloud or third-party targets, apply the shared responsibility model and the provider's testing rules to decide what may be tested.
  3. Escalate critical or unexpected findings immediately through the agreed path, and meet any mandatory reporting obligation.
  4. Match the agreement or framework to the need, such as a SoW for scope, MASVS for mobile or the Purdue model for OT.
  5. In reporting, write for the audience and recommend remediation that fixes the root cause, prioritized by risk, and keep the client informed throughout.

Practice question

Midway through an authorized external network test, a penetration tester finds indicators that an attacker has already compromised one of the in-scope servers and is exfiltrating data. What should the tester do FIRST?

Want more like this? The PenTest+ practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with 1.1 and the non-negotiable rule: no written authorization and clear scope means no testing. Learn the agreement types and the rules of engagement until you can tell them apart instantly, and understand the cloud shared responsibility limits.

Next, study reporting in 1.4 and 1.5, which carry real weight now that reporting lives in this domain. Learn the report components and who each is written for, and practice matching findings to root-cause remediation across the four control categories.

Then cover the frameworks in 1.3. You do not need deep internals, but you must match each to its use: MASVS for mobile, the Purdue model for OT, PTES and OSSTMM for overall methodology, and STRIDE, DREAD and OCTAVE for threat modeling.

Candidates commonly underestimate collaboration in 1.2, especially immediate escalation and secure distribution. Afterwards, keep this domain in mind as you study the technical domains, since every technique must stay inside the scope and authorization defined here.

FAQ

How much of PenTest+ PT0-003 is Domain 1?

Engagement Management is 13% of the PT0-003 exam. In V3 it also absorbed reporting, which was a separate domain in PT0-002.

Why does a hacking exam spend so much on paperwork?

Because authorization, scope and clear reporting are what separate a professional penetration test from a crime. The exam treats them as core competence.

What is the difference between an MSA and a SoW?

A master service agreement sets the overall legal terms of the relationship. A statement of work defines the specific scope, deliverables and timeline of one engagement.

When should a finding be escalated during a test?

Immediately, when it is critical or indicates an active compromise or illegal activity, using the agreed escalation path, rather than waiting for the final report.

Which frameworks do I need to know?

Know the purpose of OSSTMM, CREST, PTES, MITRE ATT&CK, the OWASP Top 10, MASVS and the Purdue model, plus the STRIDE, DREAD and OCTAVE threat modeling methods.

Does PT0-003 include AI?

AI appears as a reporting consideration in 1.4 and as an attack topic in Domain 4. In reporting, AI-assisted output must be checked for accuracy and confidentiality.

How does Domain 1 connect to the rest of the exam?

It authorizes, scopes and reports the technical work carried out in Domains 2 to 5, and every technique must stay within its rules of engagement.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered scoping, authorization, frameworks, reporting and remediation. Test whether you can make the professional, in-scope choice under exam conditions.

Take the PenTest+ practice test Check your PenTest+ readiness

Keep going