Which statement best defines authorization in a penetration test?

• A. Written permission from client to perform testing within defined scope.
• B. Assumed permission based on relationship.
• C. Testing any system as long as you think it's related.
• D. Authorization is not needed if it's your own system.

Answer: (A)

Authorization in a penetration test means obtaining explicit, written permission from the client to perform testing within a clearly defined scope. This formal agreement sets what is allowed, which systems are in, the testing methods, timelines, and boundaries, helping to prevent legal issues and unintended disruption. Relying on relationship or assumed access is unreliable and can be misinterpreted as permitted activity, which is not acceptable. Even on systems you own, formal written permission helps align expectations, policies, and liability, ensuring the engagement is lawful and properly scoped. In practice, this is documented in an engagement letter or contract that outlines the rules of engagement and constraints before any testing begins.