A school district's rules of engagement forbid intentional denial-of-service during the assessment. A tester finds a path that would likely crash a critical student portal. What is the correct action?
Select an answer to reveal the explanation.
Short Explanation
If the RoE says no DoS, that is a hard stop — not a hint. You can still warn about the risk with evidence that stays inside the lines. Crashing a student portal for a cooler screenshot is how engagements go sideways.
Full Explanation
Rules of engagement may prohibit destructive or availability-impacting tests even when such tests would be informative. Ethical testers respect those limits, document suspected risks with non-destructive evidence where possible, and escalate through agreed channels. Verbal overrides from non-authorizing staff and informal 'best practice' substitutions do not replace written RoE. Severity can be argued without causing outages.