Question

During the reconnaissance phase of an authorized physical and social-engineering assessment, a penetration tester reviews recovered documents from an unsecured recycling bin behind the client's corporate office. Among the papers are internal org charts, a printout of a project schedule with employee names and phone extensions, and an expired network diagram. Which conclusion best describes the value of this discovery to the engagement?

Accepted Answer

The documents provide OSINT that can be used to craft targeted pretexts and improve the credibility of social-engineering attacks against named employees.

Answer

The documents constitute an immediate critical vulnerability that must be reported as a CVE with a CVSS base score.

Answer

The expired network diagram is worthless because it no longer reflects the current environment and should be discarded without analysis.

Answer

The find proves the recycling vendor is out of scope, so all further physical testing must stop until a new authorization is signed.