An external consulting firm is hired to perform a penetration test and must keep the confidentiality of the security vulnerabilities and the private data found in a customer's systems. Which of the…

A Rules of Engagement (ROE) document outlines the scope, limitations, and authorized activities of a penetration test, but its primary focus is not on confidentiality of discovered data.

A Non-Disclosure Agreement (NDA) is a legally binding contract that establishes a confidential relationship between parties, obligating the recipient of sensitive information, such as security vulnerabilities or private data, to keep it secret and restrict its use. This directly addresses the requirement for the external consulting firm to maintain confidentiality during a penetration test.

A Memorandum of Understanding (MOU) is a formal agreement between two or more parties outlining their intentions and understanding, often preceding a more formal contract, but it does not specifically focus on confidentiality of sensitive data like an NDA.

A Service Level Agreement (SLA) defines the level of service expected from a vendor, specifying metrics and remedies, and does not primarily focus on the confidentiality of discovered information during a security assessment.