Question

A penetration testing firm is contracted to assess a client's web application that is hosted entirely on a third-party cloud provider's infrastructure (IaaS). The signed contract and rules of engagement between the firm and the client authorize active exploitation of the application. As the lead tester reviews the scope during pre-engagement, which action is MOST important to take before launching any testing activity?

Accepted Answer

Obtain and verify the cloud provider's authorization or confirm the testing complies with the provider's acceptable-use and penetration testing policy

Answer

Rely on the client's signed authorization letter, since the client owns the data and applications running in the cloud

Answer

Begin passive reconnaissance immediately because it does not require any provider approval

Answer

Request that the client migrate the application to on-premises infrastructure to avoid any legal complications