Definition of Scope Creep:
Scope creep refers to the uncontrolled expansion of a project's objectives, deliverables, or requirements beyond the original scope as defined in the project plan, without corresponding increases in resources or timelines.
Key Characteristics:
* Often results from lack of proper change management.
* Can cause budget overruns, missed deadlines, and resource strain.
Why Not Other Options:
* Deadline extension (B): Refers to extending the project timeline, not scope changes.
* Scope modification (C): Implies controlled and approved changes to the scope.
* Deliverable expansion (D): Does not specifically address the lack of control involved in scope creep.
EC-Council CISO Guidance:
Effective project management requires robust change management processes to prevent scope creep while ensuring stakeholder alignment.

Revenue refers to the total income generated by the sale of goods or services related to a company's primary operations. It represents the "top line" or gross income figure from which costs are subtracted to determine net income. Unlike options A, B, and C, which incorrectly relate to financial liabilities, profit-making potential, or asset valuation, revenue is specifically about the economic benefits derived during business operations as per established accounting principles.
Reference: https://www.investopedia.com/terms/r/revenue.asp

The Simple Network Management Protocol (SNMP) uses "community strings" as a form of authentication.
The default read-only string for SNMP is often set to "Public".
* SNMP Overview:
* SNMP is used for monitoring and managing network devices such as routers, switches, and servers.
* Default Community Strings:
* Default strings like "Public" (read-only) and "Private" (read-write) are well-known and often targeted by attackers if not changed.
* Penetration Test Findings:
* Discovering devices through SNMP indicates improper security practices where default settings haven't been updated, making devices vulnerable.
* Mitigation:
* Change SNMP community strings to strong, unique values.
* Restrict SNMP access to trusted IP ranges.
* Configuration Management: Emphasizes updating default settings as a baseline security measure.
* Penetration Testing Insights: Findings like this are critical for improving network security posture, aligning with EC-Council's penetration testing methodologies.
EC-Council CISO References:

* Deploying the IPS in monitor mode first allows the SOC to assess its behavior and ensure it does not block legitimate traffic, addressing IT's concerns about network availability.
* Configuring the IPS to fail open ensures that in the event of a failure, the network remains operational.
Why Other Options Are Less Effective:
* A. Simply assert no network impact: This approach does not provide tangible reassurance or evidence to address concerns.
* B. Fail open alone: Focusing only on the fail-open capability does not address IT's concerns about testing or monitoring.
* C. Accept responsibility for failure: While demonstrating accountability, this approach does not mitigate risks proactively.
EC-Council CISO Reference:
The curriculum emphasizes collaboration with IT teams and phased deployment strategies, such as using monitor mode, to ensure smooth implementation of new technologies without operational disruption.