What is the essential step to ensure the target environment is restored after a penetration test, according to standard best practices?

• A. Remove tester-created credentials
• B. Install a backdoor for re-entry
• C. Change production data
• D. Disable logging

Answer: (A)

The essential idea is to return the target environment to its pre-test state by removing any access created for the engagement. Removing tester-created credentials is the best answer because it eliminates persistent paths an attacker could exploit after the test is finished, reducing the risk of unauthorized access and ensuring the environment isn’t left in a more vulnerable state than before.

If a backdoor were left in place, it would introduce a deliberate persistent vulnerability, defeating the purpose of the cleanup. Changing production data would compromise integrity and reliability, and disabling logging would remove critical visibility for post-test analysis and compliance. Removing the test accounts directly addresses the risk of lingering access while preserving data integrity and traceability.