Which of the following activities is commonly deemed "OUT OF SCOPE" when undertaking a penetration test?

Testing password complexity and input validation are non-destructive, standard penetration testing activities that are routinely and safely included within authorized test scope.

Reverse engineering thick client software that the client explicitly provides for the engagement is an accepted activity within the defined scope of the test.

DoS attacks against production environments can take down live services, impact real end users, and cause significant financial and reputational harm - outcomes that no legitimate penetration testing engagement is authorized to cause. Standard penetration testing methodologies including NIST SP 800-115 and PTES explicitly recommend excluding or strictly controlling DoS testing, particularly against production infrastructure. This is a standard contractual and ethical boundary that protects both the tester from liability and the organization from self-inflicted outages.

Blind SQL injection and reflected XSS testing are core web application penetration testing techniques that are standard in-scope activities in virtually all web application assessments.

Vulnerability scanning is a foundational, non-destructive step in any penetration test engagement and is nearly always included in the defined scope as a prerequisite to further testing.