A civic Wi-Fi guest VLAN is in scope for discovery only, but a tester proposes starting credential attacks immediately. What should happen?
Select an answer to reveal the explanation.
Short Explanation
Discovery-only means you are allowed to map the parking lot, not hotwire the cars. If the RoE parked exploitation for later—or never—respect that lane. Interesting hosts do not rewrite the phase agreement by themselves.
Full Explanation
If a civic Wi-Fi guest VLAN is in scope for discovery only, the tester must stay in the agreed discovery phase; that window is not silent approval to begin credential attacks or other exploitation-class techniques. In-scope status for a VLAN does not automatically authorize every technique class. Skipping discovery to drop persistent implants violates both phase gates and typically RoE. Finding interesting hosts during discovery does not eject the VLAN from scope; it may justify a written request to expand into exploitation later. Exam caveat: keep clear phase labels in notes so the municipality can see when discovery ended and whether exploitation was approved. Operational check: complete approved discovery deliverables, present candidates for deeper testing, and wait for written RoE/scope confirmation before any credential attacks on the guest VLAN. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.