Question

During a black-box external penetration test governed by a signed statement of work, a tester discovers what appears to be evidence of a prior, unauthorized breach in the client's web server logs — including malware and command-and-control artifacts unrelated to the current engagement. The contract contains no specific provision addressing this situation. What is the MOST appropriate immediate action for the tester to take?

Accepted Answer

Preserve the evidence without altering it and promptly notify the client's designated point of contact through the agreed communication channel

Answer

Continue testing as scoped and document the finding in the final report so as not to disrupt the engagement timeline

Answer

Immediately remediate the malware and remove the command-and-control artifacts to protect the client's environment

Answer

Report the suspected breach directly to law enforcement before informing the client to ensure legal compliance