mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has completed the test and…
A penetration tester has completed the test and is writing the findings section. For a critical vulnerability, the tester wants to provide a clear and actionable remediation recommendation. Which of the following is the best practice for writing this recommendation?
⚠ Common exam trap
It's easy for candidates to choose Option A or C because they seem efficient, but the exam emphasizes that a penetration test report must be actionable and specific, not generic or reliant on external parties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provide a step-by-step guide including commands, patches, and configuration changes
A penetration test report must provide actionable remediation that the client can implement immediately. A step-by-step guide with specific commands, patch identifiers, and configuration changes ensures the client can verify and apply the fix without ambiguity, which is critical for a high-severity vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
State 'Upgrade the software to the latest version'
Why it's wrong here
A directive to 'upgrade to the latest version' is overly generic and leaves the client without critical details such as the exact version number, the specific CVE addressed, or any compatibility considerations. It also fails to provide steps for performing the upgrade, testing it, or rolling back if needed, which introduces operational risk. A remediation recommendation must be unambiguous and reversible to be effective in a real environment.
- ✓
Provide a step-by-step guide including commands, patches, and configuration changes
Why this is correct
Providing a step-by-step guide with exact commands, patch identifiers, and configuration changes gives the client a clear, repeatable path to close the vulnerability. This specificity reduces the chance of misinterpretation and allows the client to verify the fix via retesting, which is a key requirement of a professional pentest report. It also enables junior staff to execute the remediation with confidence, minimizing errors and downtime.
- ✗
Recommend applying vendor-supplied patches but do not include specific versions
Why it's wrong here
Recommending vendor patches without specifying version numbers or CVE mappings is dangerous because the client cannot determine which patch is correct. They might apply an outdated patch that fails to fix the issue, or a patch that introduces new incompatibilities, and they will have no way to verify effective remediation. A proper recommendation must include the exact patch name, version, and a checksum or link to the vendor advisory.
- ✗
Suggest hiring a third-party consultant to fix the issue
Why it's wrong here
Suggesting a third-party consultant as the sole remediation step is not an actionable solution; it delegates the problem without giving the client immediate technical guidance, potentially delaying the fix while the client evaluates vendors. It also fails to address the underlying vulnerability in a way the client's internal team can learn from, and it may be perceived as the tester avoiding the responsibility of providing concrete recommendations. At minimum, this suggestion should be accompanied by specific technical steps the consultant would need to perform.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Remediation recommendation
A remediation recommendation is a prioritized, actionable suggestion for fixing a security vulnerability, misconfiguration, or compliance gap identified during an assessment or scan.
Key term
Remediation
Remediation is the process of fixing or eliminating vulnerabilities, misconfigurations, or security weaknesses in an IT environment.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.