Pen Testing for large scale I.T department based Merchants

Technical Q&A
1

I have a client with a very large I.T based infrastructure department. I understand Pen Testing can be performed on Shopify stores but is it necessary considering the CNAME and A records are pointing to shopify’s IP’s. Would there be any benefit to doing this considering your basically rendering your WAF obsolete when connecting the domain name?