Which of the following should a penetration tester do when conducting post-engagement cleanup?

Question

Options

• AReturn the system to its original state.
• BClose any open ports.
• CShut down the infected system.
• DDelete all activity logs.

• A
  89% (24)
• C
  4% (1)
• D
  7% (2)

Explanation

Post-Engagement Cleanup Explanation

Returning the system to its original state (A) is the ethical and professional obligation of a penetration tester after completing an engagement. This means removing any tools, backdoors, test accounts, or malware that were deployed during the test, ensuring the client's environment is exactly as it was before the assessment began.

Why the other options are wrong:

• B (Close open ports): Ports may have been open before the engagement began - closing them could actually alter the system's configuration and disrupt legitimate services, violating the "original state" principle.
• C (Shut down the infected system): Shutting down a system is disruptive and not a standard cleanup step; it could cause business interruption and doesn't actually remediate anything.
• D (Delete all activity logs): Deleting logs would destroy critical evidence and documentation needed for the final report, and could also be considered evidence tampering - the opposite of what a professional tester should do.

Memory Tip: Think of a penetration tester like a house inspector - they examine everything, document what they find, but leave the house exactly as they found it when they walk out the door.

No community discussion yet for this question.