PT0-002 Reporting and Communication — Timed 10 Questions

Question 1

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

Accepted Answer

Immediately notify the client of the critical finding and provide initial remediation steps.. Critical findings should be communicated to the client immediately to allow them to take urgent action, even before the formal report is delivered.

Answer

Document the finding and inform the client only after verifying with a second tester.

Answer

Wait until the end of the test to include it in the final report.

Answer

Exploit the vulnerability to demonstrate the full impact before notifying the client.

Question 2

When writing the executive summary of a penetration test report, which of the following is the most appropriate language to use?

Accepted Answer

Business-oriented language focusing on risk, impact, and high-level recommendations.. The executive summary should be written in business language, avoiding technical jargon, to convey the overall risk and strategic recommendations to non-technical stakeholders.

Answer

A list of all vulnerabilities sorted by CVSS score without context.

Answer

Raw output from scanning tools and network packet captures.

Answer

Detailed technical descriptions of each vulnerability and exploit code used.

Question 3

A penetration tester is preparing a remediation recommendation for a SQL injection vulnerability found in a legacy application. The development team cannot immediately update the framework due to compatibility issues. What should the tester recommend as a compensating control?

Accepted Answer

Implement a web application firewall (WAF) with rules to block SQL injection attempts.. When a full fix is not immediately possible, compensating controls such as a WAF can provide temporary protection.

Answer

Disable the affected functionality until the framework can be updated.

Answer

Conduct manual code reviews to identify and fix the vulnerability immediately.

Answer

Upgrade the database to a newer version to prevent SQL injection.

Question 4

A penetration tester is calculating the severity of a vulnerability using the DREAD model. Which of the following factors is assessed under the 'Damage' category?

Accepted Answer

The potential data loss or system damage that could result from exploitation.. In the DREAD model, the 'Damage' category specifically assesses the potential harm from a successful exploit, such as data loss, system corruption, or service disruption. Option B correctly captures this by focusing on the impact to confidentiality, integrity, or availability, which is the core of the Damage factor.

Answer

The likelihood that an attacker can reproduce the exploit.

Answer

How easy it is for an attacker to discover the vulnerability.

Answer

The number of users affected by the vulnerability.

Question 5

In a penetration test report, which section should contain detailed technical information such as affected systems, proof-of-concept code, and remediation steps?

Accepted Answer

Technical findings. The technical findings section is where detailed vulnerability descriptions, evidence, and remediation steps are documented.

Answer

Appendices

Answer

Executive summary

Answer

Methodology

Question 6

During a penetration test, the tester discovers evidence of an ongoing cyber attack by an external threat actor on the client's network. What is the tester's responsibility?

Accepted Answer

Immediately report the evidence to the client and recommend involving law enforcement.. Option C is correct because the tester's primary responsibility is to protect the client's assets and data. Upon discovering evidence of an ongoing cyber attack, immediate notification allows the client to activate incident response procedures, potentially containing the threat and minimizing damage. Recommending law enforcement involvement is appropriate when criminal activity is suspected, as the tester is not authorized to conduct forensic investigation or engage with the attacker.

Answer

Document the evidence and include it in the final report without immediate notification.

Answer

Attempt to trace and engage the attacker to gather more information.

Answer

Ignore the evidence and continue with the planned test scope.

Question 7

A penetration tester is presenting findings to a mixed audience of technical staff and executives. The executives seem confused about the risk ratings. How should the tester adjust the presentation?

Accepted Answer

Explain the risk ratings in terms of business impact and likelihood, avoiding technical jargon.. When communicating to a mixed audience, the tester should tailor the message to each group's needs, focusing on risk and business impact for executives.

Answer

Ask the executives to leave and schedule a separate meeting with them later.

Answer

Provide the executives with a separate written report and continue the technical presentation.

Answer

Skip the technical details and focus only on the executive summary.

Question 8

A penetration tester is prioritizing remediation recommendations in a report. Which of the following should be considered first?

Accepted Answer

Critical and high severity vulnerabilities, especially those that are easy to fix.. Critical and high severity vulnerabilities that pose immediate risk should be prioritized first, along with quick wins that can be implemented rapidly.

Answer

Vulnerabilities that require significant code changes first.

Answer

Vulnerabilities with the lowest CVSS scores to clear many issues quickly.

Answer

All vulnerabilities in the order they were discovered.

Question 9

In a penetration test report, the tester includes a screenshot of a successful exploit. What metadata should the screenshot include to ensure proper evidence documentation?

Accepted Answer

A timestamp and the IP address or hostname of the affected system.. Screenshots should include timestamps and relevant context such as the affected system to provide clear evidence.

Answer

Only the exploit output without any timestamps or identifiers.

Answer

A diagram of the network architecture instead of the exploit screenshot.

Answer

The tester's name and the date of the test, but not the system details.

Question 10

Which of the following is an example of a responsible remediation recommendation?

Accepted Answer

Upgrade Apache to version 2.4.51 to fix the vulnerability.. Option A is correct because it provides a specific, actionable remediation: upgrading Apache to version 2.4.51, which is known to address a particular vulnerability (e.g., CVE-2021-41773 or CVE-2021-42013 for path traversal). A responsible recommendation must include a concrete version number or patch identifier to ensure the fix is verifiable and not ambiguous.

Answer

Apply security patches regularly.

Answer

Update the web server software.

Answer

Configure the firewall to block all incoming traffic.