A township requires immediate notification if critical findings appear during testing. How should the tester treat that expectation?
Select an answer to reveal the explanation.
Short Explanation
If the house is on fire, you do not wait for the glossy after-action brochure. Call the named contact when something critical shows up. That is professionalism, not panic.
Full Explanation
If a township requires immediate notification for critical findings, the tester must treat real-time critical-finding notification as a professional engagement practice defined in the RoE—not as optional content to withhold until the final PDF. Holding everything for a closing meeting can leave the municipality exposed for days. Posting exploits to a public paste site is unethical disclosure and can endanger residents and systems. Notifying only a random ticket requester while bypassing the designated security contact violates the agreed escalation path. Exam caveat: 'critical' should be predefined (for example, active compromise of confidential data or domain-wide impact) so notification thresholds are clear for township staff. Operational check: use the named on-call channel as soon as criteria are met, capture time-stamped evidence, continue only as RoE allows, and mirror the notice in the working findings log for the township CISO or security lead. Keep the explanation tied to authorized civic scope, documented rules of engagement, and evidence that a reviewer can reproduce without guessing. Prefer precise technical language over slogans, and separate what was observed from what was successfully exploited under permission.