A county web login form will be tested with carefully limited credential attempts under the rules of engagement. What constraint remains non-negotiable?
Select an answer to reveal the explanation.
Short Explanation
Having the login URL in scope is not a blank check to lock every civic account before lunch. Web forms still sit behind lockout and uptime rules. Spray carefully, count attempts, and keep availability in mind — that is RoE living in the real world.
Full Explanation
Even when a county web login form is in scope, tests must respect lockout thresholds and availability constraints. Carefully limited credential attempts under RoE still require observing how the application and directory lock accounts so citizen-facing portals are not taken down by the assessment itself.
Naming a URL in RoE does not authorize unlimited hammering. HTTP forms are subject to lockout concerns, not only SSH. Successful guesses must not be reused against unrelated out-of-scope SaaS tenants.
Exam caveat: authentication testing is dual-constrained by security evidence needs and operational safety. CPTS professionalism treats lockout and rate limits as first-class test design inputs.
Operational check: confirm lockout and CAPTCHA behavior with the civic owner, set attempt ceilings, monitor for lockouts during testing, and pause if municipal users lose access. Coordinate with county service-desk monitoring during login tests so real staff lockouts are noticed within minutes and testing stops. Keep attempt ceilings written into the RoE so pressure never overrides availability math. Service-desk watch during auth tests is part of professional county engagement hygiene. Cite the control owner in the civic remediation plan.