The penetration testing program must specify retention of results and remediation activities. Which option best reflects this requirement?

• A. No retention
• B. Retention of results and remediation activities
• C. Only remediation
• D. Only results

Answer: (B)

The key idea is that a penetration testing program must document and keep records of both what was found and what was done to fix it. Retaining the results shows exactly what vulnerabilities were discovered, while retaining the remediation activities shows the actions taken, who was responsible, and whether fixes were implemented. Together, they provide a complete, auditable trail that demonstrates progress and compliance, and it supports verification in future testing.

That’s why the best option includes retention of both results and remediation activities. If you only keep results, you can’t prove that remediation occurred. If you only keep remediation, you lose the ability to show what was originally found. No retention would leave no verifiable record at all. Keeping only one part misses a crucial half of the evidence required for effective security governance.