Before performing a network pen test, what is essential to secure with the network owner/organization?

• A. Official, written permission
• B. Only verbal approval
• C. Just a legal disclaimer
• D. No permission needed for internal testing

Answer: (A)

Securing official, written permission from the network owner is essential before any testing. A written authorization creates a formal agreement that clearly defines what will be tested, when, how, and under what constraints, and it provides legal protection for both the tester and the organization. Verbal approval can be misremembered or disputed and does not establish a verifiable record or precise scope. A standalone legal disclaimer does not authorize activities or define the engagement details. Even for internal testing, written permission and a defined scope are needed to protect everyone involved and ensure compliance. In practice, the written authorization (often part of a formal rules of engagement or engagement letter) is the foundation that makes the test legitimate and controlled.