When Negotiating a Penetration Testing Contract with a Prospective Client

question 36

Multiple Choice

When negotiating a penetration testing contract with a prospective client, which of the following disclaimers should be included in order to mitigate liability in case of a future breach of the client's systems?

• A) The proposed mitigations and remediations in the final report do not include a cost-benefit analysis.
• B) The NDA protects the consulting firm from future liabilities in the event of a breach.
• C) The assessment reviewed the cyber key terrain and most critical assets of the client's network.
• D) The penetration test is based on the state of the system and its configuration at the time of assessment.

---

Definitions:

Experimental

Pertaining to a method of research that involves the manipulation of variables to establish cause and effect relationships.

Correlational

Relating to a statistical relationship between two or more variables, where changes in one variable are associated with changes in another, without implying causation.

Confounding Results

Outcomes in research that cannot be accurately attributed to the variables under examination because of the influence of extraneous variables.

Independent Variable

A variable that is manipulated in an experiment to investigate its effect on a dependent variable.