A county RoE excludes the HR admin panel, but an abandoned CNAME for a decommissioned ticket portal remains in scope. What should the tester do?
Select an answer to reveal the explanation.
Short Explanation
Scope is a fence, not a suggestion box. An abandoned CNAME that points at a deleted cloud service is still fair game when that hostname is in scope — even if the HR admin console is off-limits. Report the takeover-class risk; do not wander into excluded panels just because DNS looks interesting.
Full Explanation
Subdomain takeover classes arise when DNS still points at abandoned third-party services. When such a hostname is in scope, testers should evaluate and report the dangling reference without expanding into explicitly excluded applications. Out-of-scope assets remain off-limits regardless of related DNS clues. Professional practice separates in-scope takeover awareness from unauthorized testing of excluded admin interfaces.