A penetration tester used an ASP.NET web shell to gain access to a web application, which allowed the tester to pivot in the corporate network. Which of the following is the MOST important follow-up…

Removing shells is a critical cleanup task but should be completed before or during report delivery, not positioned as the primary follow-up after the report has already been submitted.

Obtaining client acceptance is part of the close-out process but is formalized through the attestation of findings, making it a component of option E rather than a separate follow-up priority.

Removing tester-created credentials is important for operational cleanup but, like shell removal, should occur before or alongside report delivery rather than as the chief post-report activity.

Documenting lessons learned is a valuable internal improvement exercise for the testing team but does not fulfill the client-facing obligation that attestation of findings addresses.

Attestation of findings is a signed declaration confirming that the penetration tester has accurately reported all discovered vulnerabilities and that the client has received and acknowledged them. This document formally closes the engagement and provides legal protection for both parties, particularly important when invasive artifacts like the ASP.NET web shell used for pivoting were deployed. Without attestation, there is no documented proof that sensitive findings were properly communicated and accepted by the authorizing organization.