PT0-002 Practice Question: A penetration tester discovers a critical…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Only in the final report

  Why it's wrong here

  A final report is a formal archival document intended for comprehensive record-keeping, not a real-time alerting mechanism. By the time the report is delivered, the critical vulnerability may have already been leveraged by an attacker, and the client loses precious time to deploy emergency patches, restrict network access, or activate incident response procedures. Most penetration testing standards and engagement contracts mandate prompt disclosure of severe findings as they are confirmed, precisely because the final report cannot serve as a timely warning for active exploitation.

• ✗

  After the test is complete

  Why it's wrong here

  Delaying notification until the culmination of the engagement keeps the client unaware of a high-priority risk during the continuing test, allowing potential adversaries to exploit that same window. Additionally, reporting early gives the penetration tester the chance to validate any emergency fixes while still on-site or within the active testing period, which is essential for checking whether the remediation actually neutralized the vulnerability before the engagement closes. Waiting for the end also ignores the operational reality that critical exposures often require immediate client-side decisions that cannot be deferred for weeks.

• ✓

  Immediately upon discovery

  Why this is correct

  Communicating the vulnerability as soon as it is verified is the only approach that aligns with the primary goal of penetration testing: to reduce client risk, not simply to produce a report. Immediate notification enables the client to initiate emergency change-management, quarantine affected systems, or apply compensating controls while the test is still running, and it also allows the tester to document the exact proof-of-concept and evidence while it is fresh. This direct, real-time dialogue is typically required by organizational policies, insurance policies, or industry frameworks like PTES, which emphasize timely handling of critical issues to minimize exploitation risk.

• ✗

  At the next scheduled status meeting

  Why it's wrong here

  A status meeting operates on a prearranged cadence (e.g., daily, weekly) designed to discuss progress, not to serve as a rapid response channel for emergency findings. If the meeting is even a few days away, the client remains exposed to a known critical vulnerability that could be exploited at any moment, and delaying the notification until then violates the spirit of responsible disclosure. Furthermore, critical findings often warrant an immediate conference call, escalation to incident response, or written emergency alert—none of which should be displaced by a standard status sync.

Go deeper

Related to this question