What is a crucial guideline to follow when conducting penetration testing?

Question

Options

• ATesting systems without permission
• BObtaining proper authorization before testing
• CIgnoring business impact
• DAvoiding documentation of findings

• A
  8% (3)
• B
  87% (33)
• C
  3% (1)
• D
  3% (1)

Explanation

Obtaining proper authorization before testing (B) is the foundational legal and ethical requirement of any penetration test - without written permission, the same actions that constitute authorized security work become criminal offenses under laws like the Computer Fraud and Abuse Act.

Why the distractors are wrong:

• A - Testing without permission is unauthorized access, which is illegal regardless of intent.
• C - Business impact must always be considered; uncontrolled testing can disrupt production systems and harm the organization.
• D - Documentation is essential - findings must be recorded to produce actionable reports and demonstrate scope compliance.

Memory tip: Think of penetration testing like a home inspection - you need the owner's signed permission before you enter and examine anything, and you hand over a written report when you're done. No key, no entry.

No community discussion yet for this question.