How is the scope of a penetration test defined?