CompTIA PenTest+ (PT0-003)Engagement ManagementEasy
A client requests a penetration test of a single, well-defined web application with a fixed set of test cases and a firm two-week timeline. The client wants cost certainty and is unwilling to accept invoices that fluctuate based on hours worked. Which contract pricing structure should the penetration testing firm propose?
- ATime and materials contract
- BRetainer agreement
- CCost-plus contract
- DFixed-price contract
Show answer & explanationAnswer & explanation
Correct answer: D. Fixed-price contract
A fixed-price contract sets a single agreed-upon fee for a clearly scoped, well-defined deliverable, giving the client cost predictability. Time and materials and cost-plus contracts bill based on actual hours/expenses, which is unsuitable when the client wants certainty, and a retainer is used for ongoing, open-ended availability rather than a single defined engagement.
Why the other options are wrong
- A. Bills by hours/resources used, causing cost uncertainty which the client explicitly rejects.
- B. Used for ongoing access to services over time, not a single bounded project.
- C. Reimburses actual costs plus a fee, still variable rather than fixed.
Fixed-Price vs Time and Materials Contracts
A fixed-price contract charges one agreed total for a clearly scoped deliverable, while a time and materials contract bills based on actual hours and resources consumed.
- Fixed-price suits well-defined, narrow scope work
- Time and materials suits open-ended or uncertain-scope work
- Retainers provide ongoing availability for future testing needs
Memory trick: Fixed scope = Fixed price; Fuzzy scope = pay by the hour