Exam CFR-310 topic 1 question 88 discussion

B. Determining scope Explanation: During the scope determination phase, a security consultant would identify and document any special requirements, such as retaining a legacy device that cannot be taken offline. This ensures that all constraints and limitations are clearly outlined before the assessment begins. Incorrect Responses: A. Conducting post-assessment tasks: This occurs after the assessment and focuses on reporting and follow-up actions, not defining the assessment requirements. C. Identifying critical assets: This step focuses on determining which assets are most important to the organization, but does not specifically involve documenting the need to retain a legacy device. D. Performing a vulnerability scan: This is a technical step where vulnerabilities are identified, but documenting exceptions like legacy devices happens earlier.