Free CompTIA PenTest+ PT0-002 Practice Question
As a penetration tester, you are authorized to test an application's API that employs scoped access tokens. When you request a token from the authorization server specifying a particular scope, you receive a token with broader privileges than expected. What should your next course of action be to ethically continue the test according to the rules of engagement?
Continue testing using the received token but avoid accessing the functionalities that are outside the initial scope.
Manually adjust the scope in the token to match the intended permissions and proceed with testing.
Inform the client and request a token with the correct scope.
Use the broader scoped token to test additional functionalities since it will provide a more comprehensive security assessment.
