Exam PT0-001 topic 1 question 85 discussion

the report typically does contain sensitive information as its purpose is to document what was discovered

Agree with you D1960. Personally I would choose A but the book says otherwise. The question from the book is: A junior technician in an organization’s IT department runs a penetration test on a corporate web application. During testing, the technician discovers that the application can disclose a SQL table with all user account and password information. How should the technician notify management? A. The technician should connect to the SQL server using this information and change the passwords of a few noncritical accounts to demonstrate a proof of concept to management. B. The technician should document the findings using an executive summary including recommendations and screenshots to provide to management. C. The technician should notify the development team of the discovery and suggest that input validation be enforced on the web application’s SQL query strings. D. The technician should request that management create a request for proposal (RFP) to begin a formal engagement with a professional penetration testing company.