Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?

A live demonstration might occur as part of initial findings review or final presentation, but it's not the next formal step after initial review; the report is the primary deliverable.

Scheduling follow-up actions and retesting typically occurs after the final report has been delivered and the client has had time to implement remediations, not immediately after initial findings review.

Following the initial review of findings, the next critical step is the formal attestation and delivery of the comprehensive penetration test report. This report details all vulnerabilities, their impact, and recommended remediations, serving as the official record for the client.

A review of lessons learned during the engagement (a post-mortem) is usually conducted internally by the penetration testing team or with the client much later, often after remediation and retesting, not as the immediate next step after initial findings review.