A county CIO asks what a letter of engagement is supposed to lock in before any scanning starts. What should the tester treat as the primary purpose of that letter?
Select an answer to reveal the explanation.
Short Explanation
Think of the letter of engagement like a building permit before you swing a hammer. It is not about which tool you like — it is the signed go-ahead that says what you may touch, when, and how hard. Without that written authorization, scope, and RoE, scanning is just unauthorized noise.
Full Explanation
Before active scanning begins on county systems, a letter of engagement exists primarily to lock written authorization, agreed scope, and rules of engagement into a single contractual record. That package tells the tester which assets may be touched, which techniques are allowed or forbidden, who to notify, and when work may run. Preferring a scanner brand or credential wordlist is a tooling choice that belongs later, after authorization is settled, and never substitutes for legal cover. Guaranteeing that every discovered CVE will be exploited overstates methodology and often violates availability or exploit constraints in municipal RoE. Permission to remediate production without change tickets confuses assessment with unauthorized change control and is not what engagement letters are designed to grant. Exam caveat: marketing language about 'full testing' does not expand legal authorization beyond the signed bounds, and verbal hallway approvals are not a substitute for the letter. Operational check: before the first packet, confirm the signed LoE lists in-scope ranges or applications, explicit exclusions, emergency contacts, and prohibited actions, then store that document with the engagement kit for the civic engagement lead.