jperezduerto.info
Security in depth · Unit 18 · Lesson 2 of 8
Scope has inclusions and exclusions
Match assets, activities, timing, and exclusions to a written review agreement.
Helpful before thisReconnaissance: building an evidence-based map
After this lesson you can
- Explain why an owned asset can still be outside an authorized activity or time window.
One idea. One situation. One reasoned decision.
How it works
A review scope identifies authorized assets, activities, time boundaries, and exclusions. A name that resembles an organization’s brand is not sufficient evidence of ownership or permission. Keep scope decisions explicit and distinguish discovery from authorization to interact. When an asset’s ownership is uncertain, record the uncertainty and resolve it through the agreed owner rather than silently expanding the review.
Read the supplied record
The fictional review agreement names Booking and Events, permits review of provided internal documents on Day 4, and excludes supplier-operated platforms. No configuration changes are authorized.
| Proposal | Relevant fact |
|---|---|
| A | Read Booking’s supplied access-policy record on Day 4 |
| B | Change Booking’s configuration on Day 4 |
| C | Include the supplier’s platform because Booking depends on it |
Only A fits the agreement as written. B concerns an included asset but a different activity. C concerns a relevant dependency that is explicitly excluded. A review on Day 5 would also require the timing to be resolved, even if the documents and asset were unchanged.
Keep dependency questions in the decision record instead of silently expanding work. The review owner can obtain suitable evidence or revise the agreement through the responsible parties. This distinction makes the resulting report honest about coverage: “Booking documentation reviewed” is narrower than “the whole booking service and every supplier assessed.”
The key distinction: Identity clues do not replace an agreed scope.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which proposed work fits the supplied agreement?
Show the answer
Correct answer: Review the provided Booking records during the agreed window and leave excluded or unapproved work out. This matches the named asset, permitted activity, time boundary, and exclusions.
Try it
- WriteWrite a scope decision for A, B, and C. Quote the relevant supplied rule and identify any clarification needed before the activity can change.