A penetration tester is performing a black-box test of a client web application, and the scan host is unable to access it. The client has sent screenshots showing the system is functioning…

A WSDL file describes the interface of a SOAP web service; its absence would prevent the tester from understanding service endpoints but would not prevent the scan host from reaching the application.

Modern web applications and APIs commonly require a valid OAuth 2.0 bearer token in the Authorization header before serving any content or allowing any interaction. Without this token, the tester's scan host is denied access entirely, while the client - who holds valid credentials and is authenticated - sees the application functioning correctly. In a black-box engagement, failing to supply OAuth credentials is a common access barrier.

An incorrect password applies only to form-based or basic authentication scenarios and would result in a login failure response rather than a complete inability to access the application.

An IPS/WAF whitelist blocking the scan host is possible but less likely in a formal engagement, as rules of engagement typically require the client to whitelist the tester's source IP before testing begins.