Which of the following is a PRIMARY challenge when running a penetration test?

Cost determination is an administrative and procurement concern handled before the engagement begins, not a technical or operational challenge encountered during the execution of a penetration test.

Establishing a business case is a pre-engagement management activity used to justify the test to stakeholders, and while important, it occurs before the test runs and is not a challenge intrinsic to conducting the penetration test itself.

Remediation of found vulnerabilities is a post-engagement activity performed by the target organization's teams after the report is delivered, and it falls outside the scope of running the penetration test itself.

Determining the depth of coverage is a primary challenge because penetration testers must decide how far to pursue an exploit chain, which systems are in scope, and how deeply to probe without causing outages or exceeding authorization boundaries. Insufficient depth yields false assurance, while excessive depth risks system damage or legal liability. This scoping decision fundamentally shapes the value and safety of the entire engagement.