easyMultiple Choice
PT0-002 Practice Question: A penetration tester discovers a critical…
A penetration tester discovers a critical vulnerability in a client's production environment. What is the BEST immediate course of action before including this finding in the final report?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately communicate the finding to the client's point of contact.
The correct option is A: immediately communicate the finding to the client's point of contact. For a critical vulnerability in a production environment, prompt notification lets the client begin containment and remediation before the issue is exploited, and it aligns with standard penetration-testing ethics and rules of engagement that require timely disclosure of high-risk findings. Waiting until the final report (B) or burying the finding in a technical appendix (C) delays the client's ability to respond and could leave production systems exposed. Stopping the test entirely (D) is not required and may not be the best action, since the tester can still report the finding while following the agreed scope and escalation procedures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Immediately communicate the finding to the client's point of contact.
Why this is correct
Critical production vulnerabilities demand immediate verbal or written disclosure to the client's point of contact, enabling urgent remediation before the report is finalised. Delaying notification until report delivery breaches the tester's duty to warn and could expose the client to active exploitation.
- ✗
Wait until the final report is complete to include all findings together.
Why it's wrong here
Deferring disclosure until the final report leaves a critical production vulnerability unaddressed for the whole engagement, contradicting the immediate-notification requirement. The option tempts because reports normally consolidate findings, but critical issues demand prompt escalation outside the reporting cycle. Final reports suit routine, non-urgent findings.
- ✗
Include the finding only in the technical appendix of the final report.
Why it's wrong here
Restricting a critical finding to the technical appendix hides it from executive readers who authorise remediation funding and delays action. The option tempts because appendices hold detailed technical evidence, yet critical risks belong in the executive summary with immediate verbal notification. Appendices suit supporting detail, not urgent escalation.
- ✗
Stop the penetration test and wait for further instructions.
Why it's wrong here
Stopping the test halts authorised work without notifying the client, delaying remediation of a live production risk. The tester should report the critical finding immediately through the agreed escalation channel while continuing the engagement. Halting suits a scope breach or safety incident, not a vulnerability discovery within the authorised scope.
Go deeper
Related to this question
Learn chapter
Technical vs Executive Report Sections
Key term
Rules of engagement
Rules of engagement are the documented guidelines that define the scope, boundaries, and authorized actions a security tester may take during a penetration test or security assessment.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 777 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.