External and internal are different tests
An external test starts from the internet with no credentials and asks what is reachable from outside: which services answer, what they disclose, and whether any of them let an unauthenticated caller in.
An internal test starts from a position inside your network and asks what someone who already has a foothold can reach. Both are useful and they answer different questions, so the rules of engagement name which one is being run and from where.
What is examined
Scope is a written list of ranges and hosts. Anything that merely shares a range with a target but is not named is out of scope, and shared or third-party hosting needs the provider's permission before it can be included at all.
- Exposed services and what each one discloses about itself
- Default, reused and weak credentials on reachable services
- Missing patches on services an attacker can actually talk to
- Segmentation: whether a host in one zone can reach a host in another that it should not
- Management interfaces that should never have been reachable from where they are
Segmentation testing is the part people skip
Patching is tracked, so patch findings tend to be known before the test starts. Segmentation is rarely tested, which is why it is usually where the surprise is.
The test is mechanical: from a host in zone A, attempt to reach the things in zone B that the design says are unreachable. A rule that was added for a migration three years ago and never removed shows up here and nowhere else.
What stays out of scope
Denial-of-service and destructive techniques are not performed. Exploitation stops at proof of impact, which on a network test means demonstrating the access and stopping, not using it.
Third-party and shared infrastructure stays out until the provider has authorized testing in writing. Your signature covers your systems; it does not cover your hosting provider's.