PT0-002 Reporting and Communication — 20 Questions

Question 1

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

Accepted Answer

Immediately notify the client of the critical finding and provide initial remediation steps.. Critical findings should be communicated to the client immediately to allow them to take urgent action, even before the formal report is delivered.

Answer

Document the finding and inform the client only after verifying with a second tester.

Answer

Wait until the end of the test to include it in the final report.

Answer

Exploit the vulnerability to demonstrate the full impact before notifying the client.

Question 2

When writing the executive summary of a penetration test report, which of the following is the most appropriate language to use?

Accepted Answer

Business-oriented language focusing on risk, impact, and high-level recommendations.. The executive summary should be written in business language, avoiding technical jargon, to convey the overall risk and strategic recommendations to non-technical stakeholders.

Answer

A list of all vulnerabilities sorted by CVSS score without context.

Answer

Raw output from scanning tools and network packet captures.

Answer

Detailed technical descriptions of each vulnerability and exploit code used.

Question 3

A penetration tester is preparing a remediation recommendation for a SQL injection vulnerability found in a legacy application. The development team cannot immediately update the framework due to compatibility issues. What should the tester recommend as a compensating control?

Accepted Answer

Implement a web application firewall (WAF) with rules to block SQL injection attempts.. When a full fix is not immediately possible, compensating controls such as a WAF can provide temporary protection.

Answer

Disable the affected functionality until the framework can be updated.

Answer

Conduct manual code reviews to identify and fix the vulnerability immediately.

Answer

Upgrade the database to a newer version to prevent SQL injection.

Question 4

A penetration tester is calculating the severity of a vulnerability using the DREAD model. Which of the following factors is assessed under the 'Damage' category?

Accepted Answer

The potential data loss or system damage that could result from exploitation.. In the DREAD model, the 'Damage' category specifically assesses the potential harm from a successful exploit, such as data loss, system corruption, or service disruption. Option B correctly captures this by focusing on the impact to confidentiality, integrity, or availability, which is the core of the Damage factor.

Answer

The likelihood that an attacker can reproduce the exploit.

Answer

How easy it is for an attacker to discover the vulnerability.

Answer

The number of users affected by the vulnerability.

Question 5

In a penetration test report, which section should contain detailed technical information such as affected systems, proof-of-concept code, and remediation steps?

Accepted Answer

Technical findings. The technical findings section is where detailed vulnerability descriptions, evidence, and remediation steps are documented.

Answer

Appendices

Answer

Executive summary

Answer

Methodology

Question 6

During a penetration test, the tester discovers evidence of an ongoing cyber attack by an external threat actor on the client's network. What is the tester's responsibility?

Accepted Answer

Immediately report the evidence to the client and recommend involving law enforcement.. Option C is correct because the tester's primary responsibility is to protect the client's assets and data. Upon discovering evidence of an ongoing cyber attack, immediate notification allows the client to activate incident response procedures, potentially containing the threat and minimizing damage. Recommending law enforcement involvement is appropriate when criminal activity is suspected, as the tester is not authorized to conduct forensic investigation or engage with the attacker.

Answer

Document the evidence and include it in the final report without immediate notification.

Answer

Attempt to trace and engage the attacker to gather more information.

Answer

Ignore the evidence and continue with the planned test scope.

Question 7

A penetration tester is presenting findings to a mixed audience of technical staff and executives. The executives seem confused about the risk ratings. How should the tester adjust the presentation?

Accepted Answer

Explain the risk ratings in terms of business impact and likelihood, avoiding technical jargon.. When communicating to a mixed audience, the tester should tailor the message to each group's needs, focusing on risk and business impact for executives.

Answer

Ask the executives to leave and schedule a separate meeting with them later.

Answer

Provide the executives with a separate written report and continue the technical presentation.

Answer

Skip the technical details and focus only on the executive summary.

Question 8

A penetration tester is prioritizing remediation recommendations in a report. Which of the following should be considered first?

Accepted Answer

Critical and high severity vulnerabilities, especially those that are easy to fix.. Critical and high severity vulnerabilities that pose immediate risk should be prioritized first, along with quick wins that can be implemented rapidly.

Answer

Vulnerabilities that require significant code changes first.

Answer

Vulnerabilities with the lowest CVSS scores to clear many issues quickly.

Answer

All vulnerabilities in the order they were discovered.

Question 9

In a penetration test report, the tester includes a screenshot of a successful exploit. What metadata should the screenshot include to ensure proper evidence documentation?

Accepted Answer

A timestamp and the IP address or hostname of the affected system.. Screenshots should include timestamps and relevant context such as the affected system to provide clear evidence.

Answer

Only the exploit output without any timestamps or identifiers.

Answer

A diagram of the network architecture instead of the exploit screenshot.

Answer

The tester's name and the date of the test, but not the system details.

Question 10

Which of the following is an example of a responsible remediation recommendation?

Accepted Answer

Upgrade Apache to version 2.4.51 to fix the vulnerability.. Option A is correct because it provides a specific, actionable remediation: upgrading Apache to version 2.4.51, which is known to address a particular vulnerability (e.g., CVE-2021-41773 or CVE-2021-42013 for path traversal). A responsible recommendation must include a concrete version number or patch identifier to ensure the fix is verifiable and not ambiguous.

Answer

Apply security patches regularly.

Answer

Update the web server software.

Answer

Configure the firewall to block all incoming traffic.

Question 11

A penetration tester uses the CVSS base score to rate a vulnerability. The tester finds that the vulnerability has a high CVSS score but the affected system is isolated from the internet and has no sensitive data. Which approach should the tester take when assigning an overall severity rating?

Accepted Answer

Adjust the severity lower to reflect the reduced business impact.. CVSS is a good starting point but should be adjusted based on business context such as impact and likelihood in the specific environment.

Answer

Increase the severity because the system is isolated and may be overlooked.

Answer

Remove the finding from the report since the system is isolated.

Answer

Use the CVSS score as the final severity rating.

Question 12

A client requests that the penetration test report include raw output from the scanning tools used. Where should this output be placed in the report?

Accepted Answer

In the appendices.. Raw tool output is typically included in appendices to avoid cluttering the main findings.

Answer

As a separate deliverable not included in the report.

Answer

In the executive summary.

Answer

In the technical findings section, alongside each vulnerability.

Question 13

A penetration tester is preparing to present findings to the client's technical team. Which TWO practices are most effective for this audience?

Accepted Answer

Include proof-of-concept code and remediation commands.. Technical audiences benefit from detailed explanations and evidence, including proof-of-concept code and remediation steps.

Answer

Focus on the return on investment for fixing vulnerabilities.

Answer

Use analogies to explain vulnerabilities in everyday terms.

Answer

Provide high-level business impact summaries only.

Question 14

During a penetration test, the tester encounters a situation where the scope of the test is ambiguous. Which TWO actions should the tester take to clarify the situation?

Accepted Answer

Document the ambiguity and the agreed-upon resolution in the test plan.. When scope is unclear, the tester should communicate with the client and document the assumptions to avoid misunderstandings.

Answer

Proceed with the test based on the tester's best guess.

Answer

Test all systems within the network to ensure thoroughness.

Answer

Ignore the ambiguity and continue testing the original scope.

Question 15

Which THREE items are typically included in the appendices of a penetration test report?

Accepted Answer

Scope of the test. Appendices contain supplementary information such as scope, methodology, and raw data.

Answer

Executive summary

Answer

Detailed remediation steps

Question 16

A penetration tester discovers a critical vulnerability on a client's web server and wants to communicate it immediately. Which of the following is the most appropriate action?

Accepted Answer

Notify the client's point of contact immediately.. Immediate notification of critical findings ensures the client can take urgent steps to mitigate risk.

Answer

Include the finding in the report without prior communication.

Answer

Wait until the final report is complete.

Answer

Post the findings on a public forum for disclosure.

Question 17

Which section of a penetration testing report should provide a high-level overview of the test results using business language and strategic recommendations?

Accepted Answer

Executive summary. The executive summary is designed for non-technical stakeholders to understand the overall risk and key actions.

Answer

Technical findings section

Answer

Remediation recommendations

Answer

Appendices

Question 18

During a penetration test, a tester discovers evidence of an ongoing live exploitation by an unknown third party. Which of the following should the tester do first?

Accepted Answer

Immediately inform the client's point of contact.. If there is evidence of criminal activity or live exploitation, the tester should inform the client immediately so they can take appropriate action.

Answer

Attempt to stop the exploitation on their own.

Answer

Continue the test and document the evidence.

Answer

Ignore the finding as it is out of scope.

Question 19

A penetration tester is writing a report and needs to assign a severity rating to a vulnerability that has a CVSS base score of 7.5. According to CVSS v3.1, which severity level does this score correspond to?

Accepted Answer

High. CVSS v3.1 defines scores from 0.0 to 10.0: 0.0 = None, 0.1-3.9 = Low, 4.0-6.9 = Medium, 7.0-8.9 = High, 9.0-10.0 = Critical.

Answer

Critical

Answer

Low

Answer

Medium

Question 20

A penetration tester is evaluating vulnerabilities using the DREAD model. For a specific vulnerability, the tester assigns the following scores: Damage=8, Reproducibility=7, Exploitability=9, Affected users=6, Discoverability=5. Which of the following is the overall DREAD risk rating?

Accepted Answer

7. DREAD scores are averaged across the five categories. Compute (8+7+9+6+5)/5 = 35/5 = 7.

Answer

9

Answer

8

Answer

6