Eight months after the completion of a penetration test, the client emails the penetration tester to debate the validity of several findings. The findings are now posing a hindrance to compliance…

Question

Options

• ATesting methodology
• BTerms of use
• CBusiness impact analysis
• DClient acceptance

• A
  83% (25)
• B
  3% (1)
• C
  10% (3)
• D
  3% (1)

Explanation

Explanation

Testing Methodology is correct because it serves as the documented record of how the penetration test was conducted, what tools were used, and how findings were identified and validated. When a client disputes findings months later, the tester can reference this documentation to objectively demonstrate the legitimacy and accuracy of each finding, de-escalating the conflict through evidence rather than argument.

Terms of Use (B) outlines the legal boundaries and permissions of the engagement but doesn't speak to the technical validity of specific findings. Business Impact Analysis (C) assesses risk to the organization and isn't a record of how testing was performed. Client Acceptance (D) refers to sign-off at the end of the engagement, which may help confirm the client acknowledged findings, but doesn't provide the technical justification needed to defend those findings.

Memory Tip: Think "Methodology = My proof" - when someone challenges your work, your documented methodology is your receipts. It's the "how I did it" document that proves findings were legitimate, not fabricated or flawed.

No community discussion yet for this question.