Regarding the scope of a pen test, what is essential?

• A. Scope is optional.
• B. The tester defines scope unilaterally.
• C. Scope only matters for legal compliance, not testing.
• D. You must verify which systems are within the scope of the test.

Answer: (D)

Defining and confirming the scope is essential because it sets exactly which assets you are authorized to test and which are off-limits. This clarification guides what you assess, what techniques you can use, when you test, and what you report on. Verifying which systems are in scope involves checking the organization’s asset inventory and approvals, and documenting the agreed targets in a formal engagement. This prevents testing unintended systems, avoids legal or contractual risk, and ensures the results reflect the actual scope of the engagement. It’s not something to be done unilaterally or treated as optional, and scope matters for more than just compliance—it determines what you will actually examine and what you will deliver.