A penetration tester has been assigned to perform an external network penetration test with a defined scope of 203.0.113.0/28. Before beginning active scanning, what is the most critical pre-engagement step?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need written authorization that spells out scope, testing window, emergency contacts, and rules of engagement, plus proof the IPs belong to the client. Without that, you're testing someone else's network, and that's unauthorized access.
Full Explanation
Obtaining written authorization from the client specifying the exact scope, testing window, emergency contact procedures, and rules of engagement is the most critical pre-engagement step because it is a legal requirement that defines scope, timing, liability, and emergency procedures. Verifying that all IPs in the scope are owned by or assigned to the client is also critical because testing IPs that are not the client's, such as cloud IPs reassigned to another tenant, is unauthorized access. Beginning scanning immediately to prevent scope creep is wrong because scanning without authorization is illegal regardless of intent. Performing passive OSINT before active scanning to avoid needing written authorization is wrong because OSINT does not substitute for legal authorization. Notifying the local ISP of the planned test is wrong because ISP notification is typically not required for authorized penetration tests targeting the client's own assets.