Question

a tester is in the middle of performing a penetration test when her client asks her to also check the security of an additional server. which of the following documents does she need to submit before performing the additional task?

• scope of work
• rules of engagement
• change order
• permission to test

Explanation:

When a penetration test's scope is expanded mid-project to include an additional server, a change order is required to formally modify the original agreement, documenting the new task, timeline, and terms. A scope of work defines initial parameters, rules of engagement set testing constraints, and permission to test is initial authorization—none address mid-project scope changes like a change order.

Answer:

C. Change order