During the attack phase of a school-district WLAN test, which practice is correct?

During the attack phase of a school-district WLAN test, testers may attempt only authorized techniques against in-scope SSIDs and systems. Scope documents remain binding even after the first handshake is captured; success does not expand authority. Cracking every residential PSK heard from the parking lot regardless of paperwork attacks out-of-scope third parties. Expanding into neighboring clinics without updating the engagement letter likewise violates authorization. Treating scope as optional once interesting frames appear is a professional ethics and legal failure. Exam caveat: the attack phase is still process-bound—tools and techniques must match the written rules of engagement; CWSP expects judgment about authorization, not maximum exploit creativity. Operational check: before any cracking or exploitation attempt, re-check the target BSSID against the signed in-scope list, pause if a residential or clinic network appears in captures, and document every attack technique used with start/stop times for the district security office. Escalate scope-change requests in writing rather than improvising mid-test. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.