PT0-002 Reporting and Communication Practice Test 5 — 15 Questions

Question 1

A client asks why a medium-severity finding should be remediated before a high-severity finding. The medium finding is internet-facing and actively exploited; the high finding is isolated in a lab subnet. What is the best explanation?

Accepted Answer

Prioritization should account for exposure and active exploitation, not only the scanner severity.. Option A is correct because risk-based prioritization must consider real-world factors like internet exposure and active exploitation, not just the CVSS base score. A medium-severity finding that is internet-facing and actively exploited poses a higher immediate risk to the organization than a high-severity finding isolated in a lab subnet, which has no external attack surface. This aligns with industry frameworks like CVSS environmental metrics and the FIRST CVSS v3.1 specification, which allow adjusting severity based on attack vector, complexity, and environmental context.

Answer

Medium findings must always be fixed before high findings.

Answer

The high finding should be ignored permanently because it is in a lab.

Answer

Only CVSS base score matters for remediation order.

Question 2

Drag and drop the steps to perform a man-in-the-middle (MITM) attack using ARP spoofing with Bettercap into the correct order.

Question 3

Drag and drop the steps to perform privilege escalation on a Linux system using kernel exploit enumeration into the correct order.

Question 4

Match each scanning technique to its description.

Question 5

Match each evasion technique to its description.

Question 6

A penetration tester is preparing a report for a client. The client's C-suite executives need a high-level overview of the engagement results without technical jargon. Which section of the report is most appropriate for this audience?

Accepted Answer

Executive summary. Option B is correct because the executive summary is designed for non-technical stakeholders, providing a high-level overview of findings and recommendations. Option A (Technical findings) contains detailed technical explanations not suitable for executives. Option C (Methodology) describes testing approach, not prioritized for executives. Option D (Appendices) contain raw data not summarized.

Answer

Technical findings and remediation steps

Answer

Appendices with raw scan data

Answer

Methodology section

Question 7

During a penetration test, a tester discovers a critical vulnerability that could lead to data exposure. The tester plans to include a screenshot of the exploit in the report. What is the most important step to take before inserting the screenshot?

Accepted Answer

Sanitize any sensitive data displayed in the screenshot. Option D is correct because testers must sanitize any sensitive data (e.g., real usernames, session tokens) from screenshots before including them in reports to protect client confidentiality. Option A is unnecessary if data is sanitized. Option B is not required by policy. Option C is incorrect as the tester should not remove the finding but sanitize the evidence.

Answer

Obtain explicit permission from the client to use the screenshot

Answer

Remove the finding from the report to avoid sharing sensitive information

Answer

Check the company policy on screenshot use

Question 8

A penetration tester is writing a report and needs to classify vulnerabilities by risk level. The client has a formal risk acceptance process. Which of the following best describes the purpose of including a risk acceptance section in the report?

Accepted Answer

To record vulnerabilities the client has decided not to fix, with justification. Option C is correct because the risk acceptance section formally documents which vulnerabilities the client chooses not to remediate, providing a clear record for compliance and future audits. Option A is incorrect because risk acceptance is about accepting risk, not documenting all findings. Option B is incorrect as it is part of the remediation plan, not acceptance. Option D is incorrect because it is for client's decision, not tester's justification.

Answer

To provide step-by-step remediation instructions

Answer

To justify why the tester did not exploit certain vulnerabilities

Answer

To document all vulnerabilities found during the test

Question 9

A penetration tester is conducting an internal network test. During the engagement, the tester discovers a critical vulnerability that could be exploited to gain domain admin privileges. According to best practices, how should the tester communicate this finding to the client?

Accepted Answer

Immediately notify the client's point of contact via a secure channel. Option A is correct because critical findings should be communicated immediately to allow the client to take urgent action, rather than waiting for the formal report. Option B is too slow. Option C delays communication. Option D is inappropriate as testers should not remediate without authorization.

Answer

Only communicate it if the client asks for a status update

Answer

Wait until the end of the test to include it in the formal report

Answer

Exploit the vulnerability to demonstrate impact and then fix it before reporting

Question 10

After completing a penetration test, a tester needs to dispose of test data securely. Which of the following methods is most appropriate for this purpose?

Accepted Answer

Use a secure data destruction tool that overwrites data multiple times. Option C is correct because secure data destruction, such as using degaussing or secure erase tools, ensures data cannot be recovered. Option A (deleting files) leaves recoverable traces. Option B (formatting) may not wipe all sectors. Option D (storing indefinitely) violates data handling policies.

Answer

Delete the data using standard operating system commands

Answer

Format the storage device once

Answer

Keep the data encrypted for future reference

Question 11

A penetration tester is writing a report that includes a vulnerability with a CVSS score of 9.8. The client's security team argues that the score should be lower due to compensating controls. How should the tester respond in the report?

Accepted Answer

Report the base CVSS score and include a note about the compensating controls. Option B is correct because the CVSS base score reflects intrinsic characteristics of the vulnerability; the tester should include the base score and note the compensating controls but allow the client to adjust the risk in their own risk management process. Option A is incorrect because base score should not be changed arbitrarily. Option C is incorrect as reporting multiple scores can confuse. Option D is incorrect because the tester's job is to report objectively, not to change scores to please the client.

Answer

Report both scores and let the client decide

Answer

Remove the CVSS score entirely to avoid disagreement

Answer

Adjust the CVSS score lower to reflect the client's compensating controls

Question 12

A client requests that the penetration tester deliver the final report in an encrypted format via email. Which encryption method should the tester use to ensure confidentiality?

Accepted Answer

Use S/MIME or PGP to encrypt the email message. Option A is correct because S/MIME or PGP encrypts the email content and attachments end-to-end. Option B (SSL/TLS) protects in transit but not at endpoints. Option C (HTTPS) only applies to web delivery. Option D (ZIP with password) is weaker as passwords are often transmitted separately.

Answer

Rely on TLS encryption for the email transport

Answer

Upload the report to a web server using HTTPS

Answer

Compress the report in a password-protected ZIP file

Question 13

Which of the following metrics is most useful for demonstrating the overall security posture improvement after remediation in a penetration test report?

Accepted Answer

Number of critical vulnerabilities before and after remediation. Option D is correct because comparing the number of critical vulnerabilities before and after remediation provides a clear metric for improvement. Option A (vulnerabilities found) does not show change. Option B (test duration) is irrelevant. Option C (attack surface) is not directly measurable in a single test.

Answer

Total hours spent testing

Answer

The size of the attack surface

Answer

Total number of vulnerabilities found

Question 14

During a penetration test for a financial institution, the tester discovers that a third-party vendor's system is vulnerable and could expose customer PII. The tester is unsure if the vendor is within scope. How should the tester proceed?

Accepted Answer

Communicate with the client to clarify whether the vendor is in scope. Option B is correct because the tester should immediately contact the client to clarify scope; reporting an out-of-scope finding could violate boundaries. Option A is premature and could cause legal issues. Option C is too passive. Option D is incorrect because the tester should not test out-of-scope systems.

Answer

Perform additional testing on the vendor system to confirm the vulnerability

Answer

Ignore the finding since it is out of scope

Answer

Include the vulnerability in the final report as a high-risk finding

Question 15

Which TWO of the following should be included in the methodology section of a penetration test report?

Accepted Answer

The specific tools and commands used during testing. The methodology section of a penetration test report documents the testing approach and the specific techniques used to ensure reproducibility and transparency. Option D is correct because listing the specific tools and commands (e.g., Nmap with `-sV -sC`, Metasploit modules, or custom scripts) allows the client to understand exactly how each test was performed. Option E is correct because stating the testing approach (e.g., black-box, white-box, or gray-box) defines the scope and context of the engagement, which is a core part of the methodology.

Answer

List of vulnerabilities discovered

Answer

Step-by-step remediation instructions

Answer

The client's network diagram