Which of the following properties of the penetration testing engagement agreement will have the LARGEST impact on observing and testing production systems at their highest loads?

Defining the scope identifies which production systems to target, but does not control when testing occurs or ensure that systems will be experiencing peak load during the engagement.

Setting a schedule of testing access times directly controls when the penetration tester can observe and interact with production systems. By scheduling tests during peak business hours or known high-traffic windows, the tester can measure system behavior under maximum load conditions. This timing element cannot be substituted by scope definition, information-sharing levels, or authorization agreements alone.

White-box testing refers to the level of pre-shared information given to the tester such as network diagrams and credentials, not the timing or load conditions under which systems are tested.

Management sign-off authorizes intrusive testing activities but does not determine when tests are conducted or whether systems will be at their highest loads at that moment.