← WA Computer Science ATAR Unit 2

Scope and written authorisation for a penetration test

Written permission from the system owner that sets the scope: which systems, methods and time window a tester may use. Testing outside it is illegal.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 145

Understanding Scope and written authorisation for a penetration test in WA Computer Science ATAR Unit 2

What it does: Rules of engagement set the allowed methods, such as a port scan, and ban risky ones, such as a denial of service attack. Testing outside the agreed scope is illegal, so the tester must stop when a target is not covered by the authorisation. A penetration test needs written authorisation from the system owner. A casual verbal OK from any employee is not enough proof or authority.

Common mistakes: The test must only run when signed written permission exists. The condition should be signedPermit = TRUE, otherwise the tester would test without authorisation. 10.0.0.9 is not in the scope list, so scanning it is testing outside scope. The line should scan only the checked host: scan(target).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Scope and written authorisation for a penetration test to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A penetration tester wants to start scanning a company's servers. What must they have first?
A verbal OK from any employeeWritten permission from the system owner
Matches
permission: verbal OK from a manager
↓
Permission must be written and signed by the system owner. A verbal OK is not reliable proof of authorisation.
Applying
Meanings
Term
written authorisation
Meaning
Written permission from the system owner that sets the scope: which systems, methods and time window a tester may use. Testing outside it is illegal.
Practice
AUTHORISATION TO TEST
Testing
Gaps
IF target NOT IN THEN STOP
Check Answer
Spots
1IF signedPermit = FALSE THEN
2 RUN test(scopeList)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Owl' badge — Wise Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A penetration tester wants to start scanning a company's servers. What must they have first?
A. A verbal OK from any employee
B. Written permission from the system owner ✓
A penetration test needs written authorisation from the system owner. A casual verbal OK from any employee is not enough proof or authority.
2. Which statement about the scope of a penetration test is correct?
A. It lists the systems, methods and time window the tester may use ✓
B. It lets the tester try anything once they are inside the network
The scope sets the limits of the test. It names the allowed systems, methods and times, and the tester must stay within it.
3. A tester's written permission covers only the company's web server. They also probe the payroll database server. What is this?
A. Good practice, because it finds more weaknesses
B. Testing outside scope, which is illegal ✓
The payroll server was not in the scope. Testing it without permission is unauthorised access and can break computer offences laws, even if the tester means well.
4. What do the rules of engagement set out?
A. How and when the testing may be done, such as allowed methods and test times ✓
B. Which hacking tools are the most popular with testers
Rules of engagement spell out the allowed methods, times and limits for the test. They are agreed in writing before testing starts.
5. The written authorisation allows testing only between 10 pm and 2 am on Saturday. When may the tester run the tests?
A. Only between 10 pm and 2 am on Saturday ✓
B. Any time that week, as long as the target is in scope
The time window is part of the scope. Testing outside the agreed times is outside the permission given.

Match the Pairs

scope: 10.0.5.0/24, web-server-1 → Lists the exact systems the tester is allowed to test. Anything not listed is off limits.
window: 22 Jun, 1am to 5am → Sets the time window in which testing is permitted. Testing outside these hours is not authorised.
Rules of engagement say which methods a tester may use, and which are banned. → allow: port scan | deny: DoS attack
Testing is only legal while it stays inside the written authorisation. If a target is outside it, the tester must stop. → if target not in scope: stop_test()
permission: verbal OK from a manager → Permission must be written and signed by the system owner. A verbal OK is not reliable proof of authorisation.
target: 10.0.9.7 # not in scope, test anyway → The target is outside the agreed scope. Testing it without authorisation is illegal, even if it is close to the approved systems.

Key Term

written authorisation
Written permission from the system owner that sets the scope: which systems, methods and time window a tester may use. Testing outside it is illegal.

Fill in the Blanks

1. scope ← ["10.0.0.5", "shop.test"] IF target NOT IN scope THEN STOP
Hint: Type the variable name of the list that holds the systems the owner has approved for testing.
2. IF signedAuthorisation = FALSE THEN STOP
Hint: Type the Boolean value that means there is no written permission, so testing must not start.
3. IF now < startTime OR now > endTime THEN STOP
Hint: Type the logical operator that makes the condition true when the time is before the start or after the end of the agreed window.
4. allowedMethods ← ["port scan", "web test"] IF method NOT IN allowedMethods THEN STOP
Hint: Type the variable name of the list of techniques the rules of engagement permit.
5. IF target IN scope THEN RUN test ELSE STOP
Hint: Type the keyword for the branch that runs when the target is outside the agreed scope, because testing there is illegal.

Spot the Error

Question 1
A IF signedPermit = FALSE THEN
B RUN test(scopeList)
C ELSE
D STOP
Line A — The test must only run when signed written permission exists. The condition should be signedPermit = TRUE, otherwise the tester would test without authorisation.
Question 2
A target <- 10.0.0.5
B scope <- [10.0.0.5, 10.0.0.6]
C IF target IN scope THEN
D scan(10.0.0.9)
Line D — 10.0.0.9 is not in the scope list, so scanning it is testing outside scope. The line should scan only the checked host: scan(target).
Question 3
A start <- 900
B end <- 1700
C IF now >= start OR now <= end
D RUN test()
Line C — The time window needs both limits to be met, so the condition must use AND. With OR it is always true and would allow testing outside the authorised hours.
Question 4
A owner <- "Acme Ltd"
B signedBy <- tester
C IF signedBy = owner THEN
D RUN test()
Line B — Authorisation must be signed by the system owner. A tester cannot approve their own test. It should be signedBy <- owner.
Question 5
A IF target NOT IN scope THEN
B OUTPUT "Out of scope"
C RUN test(target)
Line C — A target outside the agreed scope must not be tested, because that is illegal. The tester should STOP instead of running the test.

Student with a class code? Join your class →