Study. uk . com
  1. Home
  2. All questions
  3. Question 93

CompTIA Security+ study material · question 93 of 611

Mid-engagement, a tester discovers they can reach a system that was not listed in the agreed scope. What should they do?

  1. Test it, since it was reachable from an in-scope host
  2. Stop and consult before proceeding
  3. Note it in the final report without telling the client
  4. Exploit it to demonstrate the segmentation failure
Show the answer

Answer: B. Stop and consult before proceeding

The authorisation that makes the work lawful covers only what the rules of engagement named.

Source: NIST SP 800-115 (NIST) — SP 800-115 § 2 Security Testing and Examination Overview

Challenge yourself on this topic → Study as cards