A municipal team asks the tester to change production firewall rules mid-engagement 'to help secure them.' What is the appropriate response?
Select an answer to reveal the explanation.
Short Explanation
Testers are the inspectors, not the midnight construction crew — unless the contract says otherwise. Write down what is wrong and how to fix it; do not freestyle production changes. Change control exists for painful reasons.
Full Explanation
Engagement norms typically authorize testing and documentation, not unilateral remediation on production systems. Unsanctioned changes can cause outages, obscure evidence, and violate change-control policy. Findings and remediation guidance should flow through agreed client processes. Quiet edits or credential sprawl create additional risk rather than reducing it.