Which of the following scenarios would most likely lead a client to reprioritize goals after...

During an active PenTest+ engagement, goal changes are most commonly driven by new, material risk that affects the client’s threat landscape or business exposure. A publicly disclosed zero-day vulnerability can immediately change what the organization considers most critical because it may be actively exploited in the wild, may impact internet-facing systems, and may require urgent validation of compensating controls, patch readiness, or exposure level. In PenTest+ planning and scoping practices, the tester and client may revisit priorities mid-engagement when emerging threats create a higher likelihood of compromise or when leadership requires rapid answers (for example, “Are we vulnerable?” and “Can you prove impact?”).

Decommissioning an end-of-life server (A) typically reduces scope rather than reprioritizing goals, and it is a routine operational change. Not capturing artifacts (C) is a tester process/quality issue addressed through engagement management, not a client-driven reprioritization trigger. Assigning a new lead tester (D) is a staffing change and should not alter the client’s goals unless scope and requirements change. The zero-day disclosure is the clearest driver for reprioritization.