Which statement about obtaining permission before password testing is correct?

• A. It is unnecessary.
• B. It is always required.
• C. It is optional in some cases.
• D. It is strongly recommended and required in practice.

Answer: (D)

Obtaining permission before password testing is essential because testing credentials involves accessing systems and could disrupt services or expose data. Without written authorization, such activity can violate laws, policies, and privacy plus expose you to legal and contractual risk. In practice, you obtain explicit permission that defines the scope, methods, and timing, which protects both you and the organization and ensures you’re operating within legal and policy boundaries. That’s why this statement is best: permission is strongly recommended and required in practice. It isn’t correct to say it’s unnecessary, and while some people phrase things as “always,” the practical standard is that you must have formal authorization before testing.