What best describes scope creep in a penetration test?

• A. A misunderstanding leads to adding more systems, target networks/types, and types of testing to the test as it proceeds, and dangerous and costly proposition for a tester.
• B. A planned expansion of scope.
• C. When testers refuse to expand scope.
• D. When the client reduces requirements.

Answer: (A)

Scope creep in a penetration test means the engagement expands beyond what was originally agreed, often without formal approvals. The described scenario fits this idea: a misunderstanding leads to adding more systems, target networks, and types of testing as the test proceeds, which makes the engagement dangerous and costly for the tester. This uncontrolled growth is exactly what makes scope creep risky, because it can invalidate the contract, violate laws or rules of engagement, and blow up timelines and budgets. In contrast, a planned expansion would be a deliberate, documented change with approvals, stopping short of true scope creep; testers refusing to expand or the client reducing requirements reflect staying within or shrinking the scope, not creep.