Your ethical hacking firm has been hired to conduct a penetration test.

The correct answer is D, Terms of engagement. In CEH penetration testing methodology, testing must be performed only within the boundaries agreed upon with the client before the assessment begins. The engagement terms define what systems, networks, applications, IP ranges, testing methods, time windows, attack types, and operational limits are authorized. CEH-aligned penetration testing guidance emphasizes that the pre-attack phase includes agreeing on rules of engagement, understanding client requirements, finalizing test scope, and signing contracts before testing begins. It also states that scope should be discussed, reviewed with the customer, and described in writing, including which assets and processes are tested and how testing is performed. PCI-DSS is a payment-card security standard, not a pen-test scope document. A nondisclosure agreement protects confidential information discovered during the test. A memorandum of understanding may describe cooperation between parties but is not the best answer for limiting specific testing activities. Therefore, the terms of engagement are the document that limits the scope of your activities.