Question

An information security manager plans to commission an annual penetration test of a customer-facing application. The application is hosted in a third-party cloud provider's environment under a shared responsibility model. Before the test begins, what is the MOST important action the security manager should take?

Accepted Answer

Obtain the cloud provider's written authorization and confirm the scope permitted under the contract

Answer

Ensure the penetration testers hold recognized industry certifications

Answer

Schedule the test during off-peak hours to minimize business disruption

Answer

Require the testers to sign a non-disclosure agreement covering findings