CompTIA PenTest+ (PT0-003)Engagement ManagementMedium
While running an nmap scan against the client's authorized /24 subnet, a penetration tester discovers a responsive host whose IP address falls outside the range documented in the SOW. What is the BEST course of action?
- AIgnore the host entirely and exclude it from the final report
- BScan the host anyway since it is on the same network segment
- CImmediately run Metasploit exploits against it since it belongs to the same client
- DDocument the discovery and request written authorization from the client before testing it
Show answer & explanationAnswer & explanation
Correct answer: D. Document the discovery and request written authorization from the client before testing it
Testing systems outside the documented scope without written authorization can expose the tester to legal liability, even if the host appears to belong to the same client. The correct action is to pause, document, and obtain explicit written approval before proceeding.
Why the other options are wrong
- A. Ignoring and omitting the finding hides potentially valuable information from the client.
- B. Same network segment does not imply authorization; scope is defined explicitly in the SOW.
- C. Exploiting out-of-scope systems is a serious legal and ethical violation.
Scope Creep / Out-of-Scope Discovery
The situation where testing activities reveal systems or assets not covered by the signed scope agreement, requiring explicit written authorization before further action.
- Testing out-of-scope systems is a legal risk
- Written authorization must be obtained, not verbal
- Document discovery even if not tested
Memory trick: When in doubt, don't scope it out — get it in writing!