A civic open-data portal engagement is scoped as web-application testing only, but a tester begins port-scanning the entire municipal /16. What problem does that create?
Select an answer to reveal the explanation.
Short Explanation
Interesting is not the same as authorized. Web-only means the web apps you agreed to — not the whole city /16 because the traceroute looked fun. Stay inside the fence or stop and renegotiate scope.
Full Explanation
Scoping a civic open-data portal as web-application testing only means authorization is limited to that application surface. Beginning a port scan of the entire municipal /16 is a scope violation: those hosts were not agreed targets, so the activity is unauthorized and unethical even if the tester is curious. Broader CIDR coverage is not encouraged merely because ranges look interesting. TLS certificate renewal is unrelated to justifying out-of-scope network sweeps. Expanding scans does not magically upgrade box type from grey to white; it simply breaches authorization. Exam caveat: if related infrastructure must be tested, obtain a written scope change first rather than improvising with citywide sweeps. Operational check: pause immediately, notify the designated municipal contact, document the accidental or intentional overreach, and confine subsequent work to the portal URLs, APIs, and hosts explicitly listed in the letter of engagement. Keep the explanation tied to authorized civic scope, documented rules of engagement, and evidence that a reviewer can reproduce without guessing. Prefer precise technical language over slogans, and separate what was observed from what was successfully exploited under permission.