PT0-002 Engagement Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Continue the test as planned and include the findings in the final report

  Why it's wrong here

  Continuing the test as planned while possessing evidence of criminal activity violates the fundamental incident-handling principle that certain findings require immediate escalation, not deferred reporting. The Rules of Engagement (RoE) typically specify a mandatory notification trigger for illegal content or acts, and postponing that notification until the final report could allow ongoing harm or the destruction of forensic evidence. Moreover, the tester's continued activity might contaminate the crime scene, jeopardizing any subsequent legal investigation and potentially exposing the tester or client to liability for failure to act.

• ✓

  Notify the client's emergency contact and follow the agreed-upon incident response procedures

  Why this is correct

  This is the correct action because a penetration test is executed under a contractual RoE that defines an explicit escalation path for exceptional findings. The tester must activate the client's named emergency contact and follow the incident response procedures to preserve evidence, contain the situation, and coordinate any law enforcement referral through the client's legal counsel. This approach balances the tester's legal duty to report criminal activity with the client's ownership of the systems and their authority to control external communications, ensuring the response is both lawful and consistent with the engagement's scope.

• ✗

  Document the evidence and destroy it after the engagement to protect the client

  Why it's wrong here

  Destroying evidence after documenting it is a severe breach of forensic best practices and legal obligations, as it destroys any potential chain of custody and renders the evidence inadmissible in court. A penetration tester's role includes preserving artifacts that may be relevant to criminal investigations, not unilaterally deciding to dispose of them. Furthermore, such destruction could constitute spoliation, exposing the test firm and client to legal penalties and damaging the client's ability to pursue remediation or prosecution, so the only proper course is to secure and hand over the evidence intact.

• ✗

  Immediately stop testing and notify law enforcement without client approval

  Why it's wrong here

  Unilaterally stopping the test and contacting law enforcement bypasses the client's authority and the agreed-upon incident response framework, potentially breaching confidentiality and the RoE. In a penetration test, the client is the legal owner of the environment and the party entitled to make decisions about external notifications, especially since apparent 'criminal' activity could, in some cases, be a previously authorized test component or a false positive. The tester should instead escalate through the designated emergency contact, allowing the client's incident response team to verify the finding, preserve evidence, and engage law enforcement through proper legal channels while maintaining chain of custody.

Go deeper

Related to this question