Which statement best describes permission for password testing on company systems?

• A. It is not necessary to obtain permission.
• B. It is always required to obtain explicit permission.
• C. It is optional in some cases.
• D. It is strongly recommended and required in practice.

Answer: (B)

Before doing password testing on any company system, you must have explicit authorization from the system owner in writing. This is not merely a courtesy; it’s a legal and contractual requirement. Having explicit permission sets the scope, rules of engagement, timing, and data handling, and it protects both you and the organization from accusations of illegal access or harm caused during testing.

That’s why the best choice is to assert that explicit permission is always required. It leaves no ambiguity about what’s allowed and prevents security testing from crossing legal or policy boundaries. Saying it’s optional or merely recommended in practice would ignore the legal and organizational safeguards that ensure any testing is legitimate and properly controlled.