Which Document Resolves Client Rejection of a Penetration Test Report?

PT0-002 By islever Editorial Last updated

Short answer

C Statement of work

Question

Which of the following documents should be consulted if a client has an issue accepting a penetration test report that was provided?
  1. Rules of engagement
  2. Signed authorization letter
  3. Statement of work Correct Answer
  4. Non-disclosure agreement

Key Takeaways

This question tests your ability to distinguish between pre-engagement documents; the common trap is selecting Rules of Engagement when the acceptance criteria for deliverables are actually defined in the Statement of Work.

When a client refuses to accept a penetration test report, the Statement of Work (SOW) is the authoritative document because it defines deliverables and acceptance criteria. While many learners consider the Rules of Engagement, the SOW specifically outlines the conditions for report acceptance.

Common mistake: The most common wrong answer is A, Rules of Engagement, because it defines the scope and rules for the test, but it does not formally establish the acceptance criteria for the final report; those are contractual deliverables in the SOW.

Expert Analysis

Why the Answer Is Correct

The Statement of Work (SOW) is the contractual document that details the project's objectives, deliverables, and acceptance criteria. When a client disputes the report's acceptability, the SOW specifies what constitutes a completed and accepted deliverable, so it is the appropriate reference. A top-voted comment (C) echoes this, noting that the SOW 'defines the criteria that should be met in order for the assessment to be considered complete.'

Why the Other Options Are Wrong

Rules of Engagement (A) defines the boundaries, timing, and authorization for the test, but not the formal report acceptance criteria. The signed authorization letter (B) grants permission to test, while the non-disclosure agreement (D) governs confidentiality. None of these documents directly address the acceptance of the final report as a deliverable. One commenter argued for RoE, saying it covers 'expectations, limitations, deliverables,' but the SOW is the controlling document for deliverable acceptance.

Community Comment Notes

The community is split, with 71% choosing C and 29% A, and commenters provided thoughtful justifications for both. Comment 1 strongly supports C by pointing to acceptance criteria in the SOW. Comment 3 defends A, claiming RoE includes deliverables and interpretation, but this conflates operational rules with contractual acceptance. Comment 2 criticizes the question's wording as vague, highlighting that real-world practice may require multiple documents, but on the exam you must pick the document specifically associated with acceptance criteria.

Exam Strategy

When encountering document-related questions, remember the SOW defines deliverables and acceptance criteria, while RoE defines how the test is conducted. Read the question for keywords like 'issue accepting the report' and immediately think of acceptance criteria, which lives in the SOW.

Community Votes

C
71%
A
29%

71% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. BlackSkullz 👍 3 Answered C
    I believe it is C. SOW The Statement of Work outlines the objectives and goals of the engagement, along with deliverables and the acceptance criteria. I believe that if there was conflict in the acceptance of the report, the acceptance criteria outlined in the Statement of Work shoud be consulted, as it defines the criteria that should be met in order for the assessment to be considered complete and acceptable
  2. Nikamy 👍 2 Answered A
    The Rules of Engagement (RoE) document outlines the agreed-upon terms and scope of the penetration test, including expectations, limitations, deliverables, and how the results will be shared and interpreted. If a client has issues with the penetration test report, the RoE should be consulted to verify whether the report aligns with what was agreed upon.
  3. Learner213 👍 2 Answered C
    This question leaves a lot to the imagination. Is this a real test question? Written by a drunken leprechaun.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide