A civic open-data portal engagement is scoped as web-application testing only, but a tester begins port-scanning the entire municipal /16. What problem does that create?
Select an answer to reveal the explanation.
Short Explanation
Interesting is not the same as authorized. Web-only means the web apps you agreed to — not the whole city /16 because the traceroute looked fun. Stay inside the fence or stop and renegotiate scope.
Full Explanation
Authorization is limited to the agreed scope. Expanding into broad network discovery across unrelated address space exceeds the engagement and can constitute unauthorized access activity. Curiosity about adjacent infrastructure does not create permission. Assessment-type labels and certificate operations are unrelated justifications for that expansion.