How is the scope defined for a penetration test?