mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has completed testing and…
A penetration tester has completed testing and identified several vulnerabilities: a critical SQL injection (CVSS 9.8), a medium stored XSS (CVSS 6.1), and a low self-signed certificate (CVSS 3.7). The client's security manager asks for a simplified way to prioritize remediation. Which of the following is the most effective approach for the tester to present the findings?
⚠ Common exam trap
A common mix-up: candidates assume CVSS scores are the definitive prioritization metric, but PT0-002 emphasizes that risk-based communication (using likelihood and impact) is the most effective approach for client remediation discussions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provide a risk matrix that maps likelihood and impact for each finding.
A risk matrix that maps likelihood and impact for each finding provides a more nuanced prioritization than raw CVSS scores alone. CVSS scores reflect intrinsic severity but do not account for the client's specific threat environment, asset criticality, or compensating controls. By presenting a risk matrix, the tester enables the security manager to make informed decisions based on the actual risk to the organization, which is the core goal of the reporting and communication domain in PT0-002.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
List all vulnerabilities in descending order of CVSS score only.
Why it's wrong here
CVSS scores are a useful standard but lack business context. A critical SQL injection might be in a low-impact system, while a medium XSS could affect a high-value customer-facing application. Ordering solely by CVSS may lead to misprioritization.
- ✓
Provide a risk matrix that maps likelihood and impact for each finding.
Why this is correct
A risk matrix allows the tester to rate each finding based on the likelihood of exploitation and the potential business impact. This gives the client a clear, actionable prioritization that accounts for their specific environment and risk tolerance.
- ✗
Present only the critical SQL injection finding because it overshadows the others.
Why it's wrong here
Reporting only the single critical SQL injection suppresses material findings that may be independently exploitable, such as chained vulnerabilities or medium-severity issues affecting internet-facing assets, thereby leaving the client with an incomplete remediation roadmap. It also violates standard penetration testing reporting practices and engagement deliverables, which require all discovered vulnerabilities be documented with severity and contextual risk. A critical flaw does not negate the existence or potential business impact of other weaknesses.
- ✗
Calculate a single overall risk score for the entire engagement by averaging all CVSS scores.
Why it's wrong here
Averaging CVSS scores into one aggregate number is statistically flawed because CVSS uses an ordinal scale, not an interval scale, so arithmetic mean calculations have no valid mathematical meaning. More importantly, the average masks outlier severity: one 10.0 finding averaged with several 2.0 findings produces a deceptively moderate overall score, obscuring the urgent remediation priority. This approach provides no actionable per-vulnerability direction, which is the actual purpose of a penetration test report.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of security vulnerabilities on a scale from 0 to 10.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.