Which of the following is the MOST important action to take when engaging third party consultants to conduct an attack and penetration test?

A.
Request a list of the software to be used

B.
Provide clear directions to IT staff

C.
Monitor intrusion detection system (IDS) and firewall logs closely

D.
Establish clear rules of engagement

Explanation:
It is critical to establish a clear understanding on what is permissible during the engagement. Otherwise, the tester may inadvertently trigger a system outage or inadvertently corrupt files. Not as important, but still useful, is to request a list of what software will be used. As for monitoring the intrusion detection system (IDS) and firewall, and providing directions to IT staff, it is better not to alert those responsible for monitoring (other than at the management level), so that the effectiveness of that monitoring can be accurately assessed.