When selecting an exploit in a penetration test, what is MOST crucial to stay within the contract's scope?

• A. The exploit's alignment with the objectives outlined in the penetration testing contract.
• B. Whether the exploit uses an old vulnerability.
• C. Whether the exploit is the newest vulnerability.
• D. Whether the exploit crashes the target system.

Answer: (A)

Staying within the contract’s scope means ensuring every exploit you choose directly supports the agreed objectives and stays within the boundaries defined by the engagement. The most important factor is alignment with the contract’s objectives because that determines what is authorized, what systems and data can be tested, and what techniques are permitted. When an exploit is selected because it directly helps verify a stated goal—such as testing authentication weaknesses or access controls within the approved assets—the test remains within scope, legal, and defensible. This alignment also helps prevent scope creep, reduces risk to the client, and ensures the findings are relevant to what was agreed.

Choosing an exploit based on whether it’s old or new or whether it crashes the target is less about staying within scope and more about the exploit’s nature or impact. A test could involve a vulnerability that’s not in scope, or it could cause a crash, which might violate safety or risk constraints, even if the exploit itself is legitimate in another context. Prioritizing the contract’s objectives keeps the engagement trustworthy and controlled.