A security consultant receives a document outlining the scope of an upcoming penetration test. This document contains IP addresses and times that each can be scanned. Which of the following would…

Rules of Engagement translate the broader scope agreement into specific operational constraints that the penetration tester must follow - these include authorized IP ranges, excluded systems, permitted testing hours, allowed techniques, and escalation procedures, making it the authoritative source for what can be scanned and when.

A Request for Proposal is a procurement document sent to vendors soliciting bids for services - it precedes the engagement and does not contain technical scanning parameters.

A Master Service Agreement is a high-level legal contract establishing the overall business relationship and liability terms between parties, not granular technical test parameters.

A Business Impact Analysis assesses the potential consequences of disruptions to business operations and is a risk management document unrelated to penetration test scoping.