Which of the following situations would require a penetration tester to notify the emergency contact for the engagement?

Exploiting a critical server is often an expected part of a penetration test, assuming it's within the agreed-upon scope and rules of engagement, and is a finding rather than an emergency requiring immediate stop-the-world notification.

Exfiltrating PII or credit card data, if within scope to demonstrate impact, would be a significant finding but might not always trigger an emergency notification unless it was unintentional or exceeded agreed parameters.

Losing remote access to the network is a technical challenge for the penetration testing team, affecting their ability to continue, but does not typically pose an immediate, uncontained threat to the client's systems necessitating an emergency contact notification.

Discovering another actor (i.e., a real attacker) on a system within the target network indicates a live security incident or compromise that is outside the scope of the penetration test's simulated activities. This situation represents an immediate and active threat to the client and requires urgent notification to the emergency contact so the client's incident response team can take appropriate action.