PT0-002 Practice Question: During a penetration test, the tester discovers…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Document the evidence and ignore it

  Why it's wrong here

  Recording the evidence without escalating leaves the client's network actively compromised while the tester passively observes, violating the core incident-response duty to minimize harm. In a live-attack scenario, the tester's obligation shifts from assessment to responsible disclosure, and ignoring the activity could allow data exfiltration or lateral movement to continue unchecked.

• ✗

  Attempt to block the attacker's activities

  Why it's wrong here

  Taking defensive actions such as blocking IPs or terminating processes exceeds the penetration test's scope and can disrupt the attacker's activities, destroying forensic evidence and potentially causing unintended denial-of-service to client systems. Furthermore, the tester lacks authority to make incident-response decisions; only the client's designated response team should contain the threat, and the tester's role is to report and stand down.

• ✓

  Immediately notify the client and stop testing

  Why this is correct

  When evidence indicates an ongoing attack, the tester must immediately stop testing to avoid compounding the incident and notify the client so they can activate their incident response plan. Continuing to test could interfere with forensic preservation or accidentally interact with the attacker's C2 infrastructure, so halting all intrusive actions and delivering a clear, time-sensitive briefing is the only defensible course.

• ✗

  Continue testing and include the finding in the final report

  Why it's wrong here

  Deferring notification to a final report leaves the client blind to an active compromise, enabling the attacker to persist and potentially spread while the engagement continues. The final report is a post-engagement artifact; a live attack demands real-time escalation, so waiting not only violates incident-handling norms but also exposes the tester to legal and ethical liability for damages incurred during the delay.

Go deeper

Related to this question