A penetration tester cannot complete a full vulnerability scan because the client's WAF is blocking communications. During which of the following activities should the penetration tester discuss this issue with the client?

When a technical control, such as a Web Application Firewall (WAF), prevents the execution of an agreed-upon testing activity, it represents a significant obstacle that impacts the engagement's scope and timeline. The correct procedure is to pause the activity and communicate with the client. This communication process is known as stakeholder alignment. It ensures that the tester and client agree on a path forward, which could involve whitelisting the tester's IP address, temporarily modifying WAF rules, or adjusting the testing methodology. This proactive communication maintains transparency and ensures the engagement proceeds according to the client's direction and the established rules of engagement.

A. Goal reprioritization: This is a potential outcome of the discussion with the stakeholder, not the initial activity itself. Alignment must happen first.
B. Peer review: This is an internal quality assurance process where another tester reviews work; it is not a client-facing communication activity.
C. Client acceptance: This is a formal step at the conclusion of the engagement to accept the final deliverables, which is too late to address a mid-test obstacle.

1. National Institute of Standards and Technology (NIST). (2008). Special Publication 800-115

Technical Guide to Information Security Testing and Assessment.

Section 3.2

"Rules of Engagement

" emphasizes the need to "...define the lines of communication between the test team and the organization... and the process for reporting and handling problems encountered during testing." A WAF blocking a scan is a "problem encountered during testing" that requires immediate communication and alignment with the client stakeholder.

2. The Penetration Testing Execution Standard (PTES). (2012). PTES Technical Guidelines.

Section "Intelligence Gathering

" and the overall standard

implicitly and explicitly detail the need for constant communication. The standard outlines a structured approach where deviations from the plan

such as being blocked by a security device

necessitate a discussion with the client to align on the next steps

reinforcing the principle of stakeholder alignment.

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2012). 15.S53 Special Seminar in Management: The Art and Science of Project Management

Fall 2012.

Lecture Notes

"Stakeholder Management

" outlines that a key project management function is to identify and manage stakeholder expectations. When an issue (WAF block) arises that creates a variance between the plan and reality

the project manager (penetration tester) must engage the stakeholders (client) to resolve the issue and align on a course of action.