During a security review, you have discovered that there are no documented security policies for...

The correct answer is C. Identify and evaluate current practices. In CEH-aligned security assessment concepts, a security audit/review is used to verify whether security policies and procedures are in place and being followed. If documented policies do not exist, the ethical hacker or auditor should not stop the audit or create policies during testing, because policy creation is a management/governance responsibility, not an assessor’s role. Instead, the assessor should identify the organization’s current practices, actual controls, informal procedures, and operational behavior, then evaluate them against accepted standards, baselines, legal requirements, and security best practices. CEH material also emphasizes that information security policies are a fundamental component of the security infrastructure and define requirements, rules, and controls for protecting organizational resources. The absence of policies should be documented as a finding, but the review can still continue by assessing what is currently being done in practice. Increasing testing does not address the governance gap. Thus, the best course is to identify and evaluate current practices.