Question

During an internal network penetration test, you discover an actively exploited vulnerability on a domain controller, along with evidence suggesting a previously unknown third-party breach. The rules of engagement specify weekly status reports and a named technical point of contact. What is the most appropriate immediate action?

Accepted Answer

Immediately halt related testing activity and invoke the emergency communication and escalation procedures defined in the rules of engagement

Answer

Continue testing as planned and document the finding in the next scheduled weekly status report

Answer

Attempt to remediate the vulnerability yourself to contain the potential ongoing breach before notifying anyone

Answer

Report the suspected breach directly to law enforcement before informing the client