Question
Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?
- A. Preserving artifacts Correct
- B. Reverting configuration changes
- C. Keeping chain of custody
- D. Exporting credential data
Explanation
Before tools, accounts and files are removed from the target environment, the tester preserves the artifacts (screenshots, logs, captured output, evidence of findings) so the results needed for the report survive the cleanup. Reverting configuration changes is part of the cleanup itself and does not protect the outputs. Chain of custody documents who handled evidence but does not stop it from being deleted. Exporting credential data covers only one narrow output and handling credentials that way is itself a risk.
