CompTIA® PenTest+Certified Penetration Tester

Three months after a pentest concludes, a client reports being breached through a vector not identified in your report and demands an explanation. What is the appropriate response?

• ALaunch a new security analysis to identify the original attack path
• BEscalate the matter directly to your legal department
• CAccept liability and offer to cover the client's losses
• DDirect the client to the scope disclaimers in the testing agreementCorrect

Why: Testing agreements and scope documents include disclaimers clarifying that results reflect the environment at a specific point in time, and that methodology and scope choices affect test comprehensiveness. Pointing the client to these disclaimers is the correct first response. Accepting financial liability would be costly and inappropriate. Escalating to legal counsel is a secondary step if the client disputes after reviewing the disclaimers.