Question

During an external network penetration test, the client's IT director calls the lead tester and verbally asks them to also assess a newly deployed VPN concentrator that was not listed in the signed scope document. The director insists it is urgent and 'part of the same network anyway.' What is the MOST appropriate action for the tester to take?

Accepted Answer

Pause and route the request through the formal change-control process to obtain written authorization and update the scope before testing the new asset

Answer

Begin testing the VPN concentrator immediately since a senior client stakeholder authorized it verbally

Answer

Decline the request outright and refuse any further discussion until the current engagement ends

Answer

Add the concentrator to the report as an untested in-scope asset and note that the client requested coverage