The correct answer is 'Raw output and logs from testing tools'. The appendix is designed to offer additional documentation that supports the core findings but is not crucial to the main narrative of the report. Raw output and logs provide detailed proof of the discovered vulnerabilities and can be used for further analysis by the technical team, yet they are too detailed and specific for the main body of the report. 'Scope details' outlines the boundaries of the engagement and should be included in the main content of the report. 'Security policy recommendations' are ordinarily part of the 'Remediation' section, and 'Business impact of each finding' should be included in the 'Findings' section as they both directly relate to the core insights of the penetration test. 'Conclusion' is also part of the main content and wraps up the report. Therefore, including raw data in the appendix is the best choice among the given options for additional supporting documents.