A client's systems administrator requests a copy of the report from the penetration tester, but the systems administrator is not listed as a point of contact or signatory. Which of the following is the penetration tester's BEST course of action?
A) Send the report since the systems administrator will be in charge of implementing the fixes.
B) Send the report and carbon copy the point of contact/signatory for visibility.
C) Reply and explain to the systems administrator that proper authorization is needed to provide the report.
D) Forward the request to the point of contact/signatory for authorization.

Question

Quizplus · Accepted Answer

The penetration tester should reply and explain to the systems administrator that proper authorization is needed to provide the report. This is because the systems administrator is not listed as a point of contact or signatory, and therefore does not have the authority to receive the report.

A Client's Systems Administrator Requests a Copy of the Report