A penetration tester, who is doing an assessment, discovers an administrator has been exfiltrating proprietary company information. The administrator offers to pay the tester to keep quiet. Which of…

While checking the scoping document is generally important, a discovery of illegal activity and a bribe fundamentally shifts the ethical responsibility and requires immediate reporting regardless of the initial scope.

Stopping the penetration test does not address the discovered illicit activity or the bribery attempt, which still require formal reporting to the client.

Escalating the issue is correct, but 'including the discovery and interaction in the daily report' is the most appropriate and formal method of escalation within the context of a penetration test engagement.

A penetration tester has an ethical obligation to maintain integrity and transparently report all findings, including any illegal activities discovered or attempts to compromise the test's integrity. Documenting the discovery of data exfiltration and the administrator's bribery attempt in the daily report ensures that the client is fully informed and allows for appropriate internal action by the client.