A county RoE excludes the HR admin panel, but an abandoned CNAME for a decommissioned ticket portal remains in scope. What should the tester do?
Select an answer to reveal the explanation.
Short Explanation
Scope is a fence, not a suggestion box. An abandoned CNAME that points at a deleted cloud service is still fair game when that hostname is in scope — even if the HR admin console is off-limits. Report the takeover-class risk; do not wander into excluded panels just because DNS looks interesting.
Full Explanation
Rules of engagement are binding fences for civic assessments. An abandoned CNAME for a decommissioned ticket portal that remains in scope should be assessed as a subdomain-takeover-class finding: DNS still points at a third-party service the county no longer controls. The tester evaluates and reports that dangling reference without touching the explicitly excluded HR admin panel.
Ignoring all DNS findings because an admin panel is out of scope over-generalizes—the excluded panel does not erase in-scope hostname risk. Attacking the out-of-scope HR panel because DNS looks interesting is a scope violation regardless of dangling CNAMEs. Demanding worldwide expansion of every subdomain before continuing is unnecessary when the specific hostname is already authorized.
Exam caveat: takeover risk is about reclaiming the pointed-at service or fixing DNS; it is not automatic permission to test unrelated excluded applications that share an organizational brand.
Operational check: confirm the hostname is listed in scope, document the dangling CNAME and abandoned provider target, attempt only authorized takeover-awareness checks on that name, and leave the excluded HR admin UI untouched. Note residual risk if DNS cleanup is delayed for other civic subdomains.