Which Document Resolves Client Rejection of a Penetration Test Report?
Which of the following documents should be consulted if a client has an issue accepting a penetration test report that was provided?
Community Votes
71% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your ability to distinguish between pre-engagement documents; the common trap is selecting Rules of Engagement when the acceptance criteria for deliverables are actually defined in the Statement of Work.
When a client refuses to accept a penetration test report, the Statement of Work (SOW) is the authoritative document because it defines deliverables and acceptance criteria. While many learners consider the Rules of Engagement, the SOW specifically outlines the conditions for report acceptance.
The most common wrong answer is A, Rules of Engagement, because it defines the scope and rules for the test, but it does not formally establish the acceptance criteria for the final report; those are contractual deliverables in the SOW.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Statement of Work (SOW) is the contractual document that details the project's objectives, deliverables, and acceptance criteria. When a client disputes the report's acceptability, the SOW specifies what constitutes a completed and accepted deliverable, so it is the appropriate reference. A top-voted comment (C) echoes this, noting that the SOW 'defines the criteria that should be met in order for the assessment to be considered complete.'
Why the Other Options Are Wrong
Rules of Engagement (A) defines the boundaries, timing, and authorization for the test, but not the formal report acceptance criteria. The signed authorization letter (B) grants permission to test, while the non-disclosure agreement (D) governs confidentiality. None of these documents directly address the acceptance of the final report as a deliverable. One commenter argued for RoE, saying it covers 'expectations, limitations, deliverables,' but the SOW is the controlling document for deliverable acceptance.
Community Comment Notes
The community is split, with 71% choosing C and 29% A, and commenters provided thoughtful justifications for both. Comment 1 strongly supports C by pointing to acceptance criteria in the SOW. Comment 3 defends A, claiming RoE includes deliverables and interpretation, but this conflates operational rules with contractual acceptance. Comment 2 criticizes the question's wording as vague, highlighting that real-world practice may require multiple documents, but on the exam you must pick the document specifically associated with acceptance criteria.
Official Reference
Exam Strategy
When encountering document-related questions, remember the SOW defines deliverables and acceptance criteria, while RoE defines how the test is conducted. Read the question for keywords like 'issue accepting the report' and immediately think of acceptance criteria, which lives in the SOW.