Which action is typically performed during post-engagement cleanup to ensure the environment returns to its pre-test state?

• A. Deploying additional monitoring
• B. Remediating vulnerabilities
• C. Removing tester-created credentials
• D. Documenting findings

Answer: (C)

The main idea is to restore the environment to how it was before the test by removing artifacts introduced for the engagement. The most critical step is deleting tester-created credentials—temporary accounts, API keys, SSH keys, tokens—so no backdoors or extra access remain. If these credentials are left behind, they could be exploited later and undermine security. After removing credentials, you would typically purge test data and revert any configuration changes as appropriate, but the act of removing tester-created credentials directly ensures there’s no residual access. Other actions like adding monitoring, fixing vulnerabilities, or producing a findings report are important parts of the engagement, but they don’t by themselves revert the environment to its pre-test state the way credential cleanup does.