PT0-002 Practice Test 31 — 15 Questions

Question 1

A penetration tester is writing a report and needs to classify vulnerabilities by risk level. The client has a formal risk acceptance process. Which of the following best describes the purpose of including a risk acceptance section in the report?

Accepted Answer

To record vulnerabilities the client has decided not to fix, with justification. Option C is correct because the risk acceptance section formally documents which vulnerabilities the client chooses not to remediate, providing a clear record for compliance and future audits. Option A is incorrect because risk acceptance is about accepting risk, not documenting all findings. Option B is incorrect as it is part of the remediation plan, not acceptance. Option D is incorrect because it is for client's decision, not tester's justification.

Answer

To provide step-by-step remediation instructions

Answer

To justify why the tester did not exploit certain vulnerabilities

Answer

To document all vulnerabilities found during the test

Question 2

A penetration tester discovers a critical vulnerability in a client's production environment. What is the BEST immediate course of action before including this finding in the final report?

Accepted Answer

Immediately communicate the finding to the client's point of contact.. Option B is correct because ethical obligations require immediate notification of critical findings to allow the client to take protective measures. Option A is wrong because delaying report generation could leave the client vulnerable. Option C is wrong because simply including it in the final report may be too late. Option D is wrong because halting the test without communication is not productive.

Answer

Wait until the final report is complete to include all findings together.

Answer

Include the finding only in the technical appendix of the final report.

Answer

Stop the penetration test and wait for further instructions.

Question 3

Refer to the exhibit. A penetration tester gained a Meterpreter session on a Windows server. Which of the following should the tester include in the report to provide the most actionable remediation advice?

Accepted Answer

That SYSTEM-level access was achieved on the server.. Option B is correct because the session shows SYSTEM level access, indicating a critical compromise. Option A is wrong because merely listing commands is not actionable. Option C is wrong because the user details from getuid are shown. Option D is wrong because architecture is system info.

Answer

The command used to gain the session.

Answer

The username 'NT AUTHORITY\SYSTEM' as a local user.

Answer

The operating system and architecture details.

Question 4

You are writing the final report for a penetration test. The client has requested that the report be delivered in an encrypted format. Additionally, the client wants to include raw screenshots and command outputs for evidence. The tester has captured screenshots that show user credentials in clear text from a successful phishing attack. What is the BEST way to handle this?

Accepted Answer

Redact or obfuscate the credentials in the screenshots before including them. Option B is correct. Redacting or obfuscating sensitive data like credentials protects confidentiality while still providing evidence. Option A is wrong because exposing credentials in raw screenshots violates data protection best practices. Option C is wrong because removing the evidence may weaken the report's credibility. Option D is wrong because unencrypted delivery defeats the purpose of encryption and exposes data.

Answer

Exclude the evidence and only describe the finding

Answer

Provide the screenshots in a separate unencrypted file

Answer

Include the raw screenshots as requested

Question 5

A client requests that the penetration tester deliver the final report in an encrypted format via email. Which encryption method should the tester use to ensure confidentiality?

Accepted Answer

Use S/MIME or PGP to encrypt the email message. Option A is correct because S/MIME or PGP encrypts the email content and attachments end-to-end. Option B (SSL/TLS) protects in transit but not at endpoints. Option C (HTTPS) only applies to web delivery. Option D (ZIP with password) is weaker as passwords are often transmitted separately.

Answer

Rely on TLS encryption for the email transport

Answer

Upload the report to a web server using HTTPS

Answer

Compress the report in a password-protected ZIP file

Question 6

After a penetration test, the client requests that the tester remove certain findings from the final report because they reveal sensitive information about a new product. What is the BEST response from the tester?

Accepted Answer

Agree to remove the findings but note in the report that they were omitted.. Option D is correct because the client owns the data and can decide what is included, but the tester should ensure the report accurately reflects risks. Option A is wrong because refusing cooperation could damage the relationship. Option B is wrong because the client has the right to manage their information. Option C is wrong because omitting findings undermines the report's integrity; instead, document the decision.

Answer

Remove the findings entirely and do not mention them.

Answer

Refuse to remove the findings and threaten to disclose them publicly.

Answer

Insist on including the findings but obfuscate the sensitive details.

Question 7

During a penetration test, a tester discovers a critical vulnerability that could lead to data exposure. The tester plans to include a screenshot of the exploit in the report. What is the most important step to take before inserting the screenshot?

Accepted Answer

Sanitize any sensitive data displayed in the screenshot. Option D is correct because testers must sanitize any sensitive data (e.g., real usernames, session tokens) from screenshots before including them in reports to protect client confidentiality. Option A is unnecessary if data is sanitized. Option B is not required by policy. Option C is incorrect as the tester should not remove the finding but sanitize the evidence.

Answer

Obtain explicit permission from the client to use the screenshot

Answer

Remove the finding from the report to avoid sharing sensitive information

Answer

Check the company policy on screenshot use

Question 8

Which TWO of the following actions are appropriate when handling personally identifiable information (PII) discovered during a penetration test?

Accepted Answer

Securely delete any PII that is not required for reporting. Options B and D are correct. PII should not be included in reports; instead, use redacted evidence (B). If PII is accidentally collected, it must be securely deleted (D). Option A violates protection. Option C is acceptable but not the best practice; redaction is preferred over anonymization when evidence is needed. Option E is incorrect because it transfers risk inappropriately.

Answer

Include raw PII in the report as proof of access

Answer

Transfer PII to the client's secure storage for inclusion in the report

Answer

Anonymize PII by replacing with fake data in the report

Question 9

Refer to the exhibit. A penetration tester performed an initial nmap scan and recorded the above output. The tester wants to include this in the report. What additional information should the tester add to make the finding more useful for remediation?

Accepted Answer

The version of services running on each port.. Option C is correct because service version information is critical for identifying vulnerable versions. Option A is wrong because open ports are already shown. Option B is wrong because OS detection is not always reliable and not shown here. Option D is wrong because UDP scan results are not shown.

Answer

The list of open ports only.

Answer

The operating system of each host.

Answer

The result of a UDP scan for these ports.

Question 10

During a penetration test, the tester discovers a critical vulnerability that could lead to a data breach. The tester needs to communicate this to the client's management, who are non-technical. What is the BEST way to communicate this finding?

Accepted Answer

High-level summary with business impact and recommended timeline for fix. Option C is correct because communicating a high-level summary with business impact and recommended timeline is most effective for non-technical management. Option A is wrong because technical details may overwhelm them. Option B is wrong because a subject line alone doesn't convey the context. Option D is wrong because waiting for the final report delays critical communication.

Answer

Include the finding only in the final report

Answer

Email with subject 'URGENT' and no further details

Answer

Detailed technical exploit steps

Question 11

A penetration tester is preparing a report for a client. The client's C-suite executives need a high-level overview of the engagement results without technical jargon. Which section of the report is most appropriate for this audience?

Accepted Answer

Executive summary. Option B is correct because the executive summary is designed for non-technical stakeholders, providing a high-level overview of findings and recommendations. Option A (Technical findings) contains detailed technical explanations not suitable for executives. Option C (Methodology) describes testing approach, not prioritized for executives. Option D (Appendices) contain raw data not summarized.

Answer

Technical findings and remediation steps

Answer

Appendices with raw scan data

Answer

Methodology section

Question 12

Which of the following metrics is most useful for demonstrating the overall security posture improvement after remediation in a penetration test report?

Accepted Answer

Number of critical vulnerabilities before and after remediation. Option D is correct because comparing the number of critical vulnerabilities before and after remediation provides a clear metric for improvement. Option A (vulnerabilities found) does not show change. Option B (test duration) is irrelevant. Option C (attack surface) is not directly measurable in a single test.

Answer

Total hours spent testing

Answer

The size of the attack surface

Answer

Total number of vulnerabilities found

Question 13

During a penetration test for a financial institution, the tester discovers that a third-party vendor's system is vulnerable and could expose customer PII. The tester is unsure if the vendor is within scope. How should the tester proceed?

Accepted Answer

Communicate with the client to clarify whether the vendor is in scope. Option B is correct because the tester should immediately contact the client to clarify scope; reporting an out-of-scope finding could violate boundaries. Option A is premature and could cause legal issues. Option C is too passive. Option D is incorrect because the tester should not test out-of-scope systems.

Answer

Perform additional testing on the vendor system to confirm the vulnerability

Answer

Ignore the finding since it is out of scope

Answer

Include the vulnerability in the final report as a high-risk finding

Question 14

Which THREE of the following are best practices when communicating findings to stakeholders during a penetration test?

Accepted Answer

Provide regular status updates to the client point of contact. Options A, B, and D are correct. Regular status updates (A) keep stakeholders informed. Immediate notification of critical findings (B) allows timely action. Tailoring communication to audience (D) ensures understanding. Option C is wrong because technical details may be omitted for non-technical audience. Option E is wrong because evidence should be sanitized, not raw.

Answer

Share raw exploit code and logs without sanitization

Answer

Always include full technical details in every communication

Question 15

A penetration tester is finalizing a report and needs to ensure that sensitive data discovered during the test (e.g., password hashes, PII) is handled appropriately. Which of the following is the BEST practice?

Accepted Answer

Sanitize the data by redacting or replacing with placeholders.. Option B is correct because sensitive data should be sanitized (e.g., redacted, hashed) in the report to protect confidentiality. Option A is wrong because including raw data increases risk. Option C is wrong because destroying all data may be counterproductive if the client needs it. Option D is wrong because leaving it out entirely might hide important context.

Answer

Destroy all copies of sensitive data after the test and do not include any.

Answer

Present the data only in the oral debrief, not in written form.

Answer

Include the raw data in an encrypted appendix for the technical team.