Which Contact Should Be Notified First When a Critical System Goes Down After Hours?
A penetration tester is conducting a test after hours and notices a critical system was taken down. Which of the following contacts should be notified first?
Community Votes
65% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your understanding of escalation and contact procedures during a penetration test, specifically the difference between routine primary contacts and emergency contacts when an incident occurs outside normal business hours.
In a penetration test, when a critical system goes down after hours, the emergency contact should be notified first. Community votes favor the emergency contact over the primary contact, citing the urgency and after-hours nature of the incident.
Choosing D (Primary) is the most common mistake—test takers assume the primary contact is always the first point of contact, but for after-hours critical incidents, the emergency contact is the designated escalation path.
Community Discussion (12 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B (Emergency) is correct because the scenario explicitly states the test is being conducted "after hours" and a "critical system" has been taken down. In penetration testing, the emergency contact is specifically designated for urgent situations that occur outside normal business hours or when a critical impact is observed. Commenter [4] correctly notes that after hours, the primary may not be available and the on-call emergency contact should be reached. The purpose of an emergency contact is to handle exactly this type of scenario, as commenter [6] points out: "What's the point of having an emergency contact if you're not going to contact them when there's an emergency?"Why the Other Options Are Wrong
Option D (Primary) is plausible because the primary contact is responsible for overseeing the test, but that role typically applies during normal working hours and for routine communication. After hours, the emergency contact is the designated first stop, and they can then escalate to the primary or technical team as needed. Option A (Secondary) is a backup contact, not the first choice. Option C (Technical) is not the first point of contact; you first need to notify the emergency contact who will coordinate with technical staff. Commenter [7] argues for primary, but their reasoning fails to account for the after-hours condition, which is a critical detail.Community Comment Notes
Community votes favor B (65 votes) over D (35 votes), showing that most test takers recognize the emergency contact is the right call. Comments like [2] emphasize "because it's after hours," and [10] and [11] note that a critical system breakdown is itself an emergency. The comments supporting D often overlook the "after hours" qualifier, or assume the primary contact is still the main point of contact regardless of time. The better reasoning is presented by comments [4] and [9], which combine the after-hours factor with the critical-system impact to arrive at the emergency contact.Official Reference
Exam Strategy
When answering questions about contacts or escalation, always look for keywords like 'after hours,' 'critical,' or 'emergency.' If the scenario includes an urgent condition outside normal business hours, the emergency contact is almost always the correct first notification; reserve the primary contact for routine coordination during business hours.