A client claims that a ransomware attack has crippled its corporate network following a penetration test assessment. Which of the following is the most likely root cause of this issue?

Client reluctance to accept findings might lead to unaddressed vulnerabilities in the future, but it would not directly cause a ransomware attack immediately after the test concludes unless the test itself introduced the vulnerability.

Lack of attestation refers to the absence of a third-party declaration of compliance or findings, which is an administrative issue and does not directly cause a technical compromise like a ransomware attack.

An incomplete data destruction process typically relates to the secure erasure of sensitive data, not the creation of persistent access points that could lead to a network compromise post-test.

During a penetration test, testers often create temporary accounts, backdoors, or leave tools on the network to simulate real-world attacks. If these artifacts, especially credentials or access points, are not thoroughly removed and secured post-assessment, they can be exploited by threat actors who may discover and leverage them to launch attacks like ransomware.