Which of the following situations would cause a penetration tester to communicate with a system owner/ client during the course of a test? (Select TWO.)

Discovering PII on a system is a notable finding to document in the final report but does not typically require immediate out-of-band escalation during the test, as encountering sensitive data is an expected and authorized outcome of the assessment.

Evidence of a prior unauthorized compromise indicates an active or historical breach by a third party outside the engagement scope, which is a critical incident requiring immediate client notification so proper incident response procedures can be initiated.

A lack of system hardening is a standard vulnerability finding that belongs in the final penetration test report rather than being escalated as an emergency requiring immediate client contact.

If a system becomes unavailable as a result of an attempted exploit, the tester must immediately notify the client because this is an unintended outage that could impact business operations and may require rapid recovery actions outside the tester's authority.

A finding on an out-of-scope system should be noted, excluded from active exploitation, and disclosed in the final report or a brief notification - it does not represent the same urgency as an active service outage or evidence of an external breach.