PT0-001 · Question #243
During an engagement, a consultant identifies a number of areas that need further investigation and require an extension of the engagement. Which of the following is the MOST likely reason why the…
The correct answer is C. The company did not properly scope the project. When newly discovered areas fall outside the originally contracted scope, the engagement cannot be extended without a formal rescoping agreement, making improper initial scoping the primary barrier.
Question
During an engagement, a consultant identifies a number of areas that need further investigation and require an extension of the engagement. Which of the following is the MOST likely reason why the engagement may not be able to continue?
Options
- AThe consultant did not sign an NDA.
- BThe consultant was not provided with the appropriate testing tools.
- CThe company did not properly scope the project.
- DThe initial findings were not communicated to senior leadership.
How the community answered
(28 responses)- A7% (2)
- B4% (1)
- C86% (24)
- D4% (1)
Why each option
When newly discovered areas fall outside the originally contracted scope, the engagement cannot be extended without a formal rescoping agreement, making improper initial scoping the primary barrier.
A missing NDA creates a confidentiality risk but does not legally prohibit the continuation of authorized testing activities that are already underway.
Lack of testing tools is an operational inconvenience that can be remedied during the engagement and is not a contractual or legal barrier to continuation.
Penetration testing engagements are legally and contractually bounded by the agreed-upon scope of work. If the company failed to properly scope the project, additional systems or assets discovered during testing are not authorized targets, and the consultant cannot legally continue testing them without a signed scope amendment. Poor scoping is the foundational reason the engagement stalls, as no amount of communication or tooling resolves an undefined authorization boundary.
Failure to communicate initial findings to senior leadership is a reporting gap but does not itself revoke authorization to continue testing within the defined scope.
Concept tested: Penetration test scoping and rules of engagement
Source: https://www.pentest-standard.org/index.php/Pre-engagement
Topics
Community Discussion
No community discussion yet for this question.