Which term defines the boundaries and limitations of an engagement?

• A. Risk assessment
• B. Test plan
• C. Project Scope
• D. Deliverable

Answer: (C)

Project scope defines the boundaries and limitations of an engagement. It lays out what is in scope and what is out of scope, along with constraints like time, resources, and acceptance criteria. In a security assessment, this includes which systems, networks, and data are authorized for testing, which testing methods are allowed, the testing window, and how findings will be reported and handled. Clear scope prevents scope creep, ensures legal authorization, and aligns expectations among stakeholders.

Risk assessment focuses on identifying and prioritizing potential threats and vulnerabilities, not specifically the boundaries of the engagement. A test plan describes how the testing will be conducted (approach, tools, steps), rather than defining the engagement’s limits. A deliverable is the output produced (like the final report or artifacts), not the scope of work itself.