A city attorney objects to a municipal pentest scoped as 'test everything on the network.' Why is that scope statement a professional risk?
Select an answer to reveal the explanation.
Short Explanation
Vague scope is like telling a contractor 'fix the whole block' with no address — nobody knows what is allowed. 'Everything on the network' sounds bold but leaves assets, ranges, and exclusions undefined. Pros pin those down so authorization stays clear and nobody wanders into trouble.
Full Explanation
A city attorney correctly flags 'test everything on the network' because professional authorization requires named assets, IP ranges, applications, and exclusions. Unbounded wording leaves ambiguity about partner circuits, OT segments, cloud tenancies, and third-party systems that happen to be reachable, which creates legal and operational risk for both the municipality and the tester. Preference for black-box versus grey-box labels is orthogonal; box type does not replace an asset list. Scanners do not refuse to run merely because DNS is incomplete, so that distractor invents a tooling constraint that is not the professional issue. Municipal networks are not broadly exempt from authorized penetration testing under typical state practice; the problem is ambiguous permission, not a categorical ban. Exam caveat: if discovery reveals adjacent ranges, treat them as out of scope until a formal change order expands authorization. Operational check: rewrite scope into concrete CIDR blocks, hostnames, URLs, and exclusions, then have the designated municipal authority re-sign before active testing resumes on city networks. In municipal operations, record the decision and residual risk in the engagement notes so future civic responders understand which control or boundary was honored and which failure modes the rejected approaches would create for public services. Re-check the same control at the next maintenance window or retest cycle.