A city attorney objects to a municipal pentest scoped as 'test everything on the network.' Why is that scope statement a professional risk?
Select an answer to reveal the explanation.
Short Explanation
Vague scope is like telling a contractor 'fix the whole block' with no address — nobody knows what is allowed. 'Everything on the network' sounds bold but leaves assets, ranges, and exclusions undefined. Pros pin those down so authorization stays clear and nobody wanders into trouble.
Full Explanation
Professional engagements require specific, authorized targets: IP ranges, hostnames, applications, and explicit exclusions. An unbounded phrase such as 'test everything on the network' creates legal and operational ambiguity about what was approved. Scope clarity protects the client and the tester; assessment-type labels and tooling limits are secondary to that definition.