69 questions · Ptp Reporting topic · All types, answers revealed
A penetration tester uses the DREAD model to assess a vulnerability. The tester assigns the following scores: Damage=8, Reproducibility=10, Exploitability=9, Affected users=7, Discoverability=6. What is the overall DREAD risk rating?
Average of the scores is 8.0.
Why this answer
DREAD rating is the average of the five scores: (8+10+9+7+6)/5 = 40/5 = 8.0.
A penetration tester is creating a report and needs to include evidence of a cross-site scripting vulnerability. Which TWO of the following are appropriate types of evidence? (Choose two.)
Shows the vulnerability in action.
Why this answer
Screenshots with proof of execution and the actual payload used are standard evidence. The exploit code should not be destructive, and a video is not required; raw scanner output alone may not show exploitation.
A penetration tester is following responsible disclosure timelines. Which TWO of the following actions align with responsible disclosure practices?
Correct. Vendor should be informed first.
Why this answer
Responsible disclosure involves notifying the vendor and providing a reasonable time to fix before public disclosure.
During a penetration test, the tester discovers evidence of an ongoing cyber attack by an external threat actor on the client's network. What is the tester's responsibility?
This is the correct course of action to address the active threat.
Why this answer
Option C is correct because the tester's primary responsibility is to protect the client's assets and data. Upon discovering evidence of an ongoing cyber attack, immediate notification allows the client to activate incident response procedures, potentially containing the threat and minimizing damage. Recommending law enforcement involvement is appropriate when criminal activity is suspected, as the tester is not authorized to conduct forensic investigation or engage with the attacker.
Exam trap
The trap here is that candidates may confuse the tester's role with that of a law enforcement officer or incident responder, incorrectly believing they should investigate or engage the attacker, when in fact the tester must stop all testing and immediately notify the client.
How to eliminate wrong answers
Option A is wrong because delaying notification until the final report could allow the attack to cause significant harm, violating the tester's duty of care and potentially breaching the rules of engagement that typically require immediate reporting of critical findings. Option B is wrong because attempting to trace or engage the attacker exceeds the scope of a penetration test, could be illegal under laws like the Computer Fraud and Abuse Act (CFAA), and risks escalating the incident or destroying forensic evidence. Option D is wrong because ignoring evidence of an active attack is unethical and negligent, as the tester has a professional obligation to report any signs of compromise that fall outside the agreed test scope.
Which of the following is an example of a responsible remediation recommendation?
Specific and actionable.
Why this answer
Option A is correct because it provides a specific, actionable remediation: upgrading Apache to version 2.4.51, which is known to address a particular vulnerability (e.g., CVE-2021-41773 or CVE-2021-42013 for path traversal). A responsible recommendation must include a concrete version number or patch identifier to ensure the fix is verifiable and not ambiguous.
Exam trap
Cisco often tests the distinction between a specific, actionable remediation (with version numbers) and a generic security policy statement, trapping candidates who choose broad advice like 'apply patches regularly' instead of a precise fix.
How to eliminate wrong answers
Option B is wrong because 'Apply security patches regularly' is a general policy statement, not a specific remediation for the identified vulnerability; it lacks the version or patch details needed for immediate action. Option C is wrong because 'Update the web server software' is too vague—it does not specify the target version or the exact vulnerability being fixed, leaving room for incomplete or incorrect updates. Option D is wrong because 'Configure the firewall to block all incoming traffic' is an overly restrictive and impractical measure that would break legitimate web services; it is a workaround, not a responsible remediation that addresses the root cause.
Which of the following is the correct CVSS metric that describes the level of access an attacker needs to exploit a vulnerability?
AV describes the context in which exploitation is possible.
Why this answer
The Attack Vector (AV) metric describes how the vulnerability can be exploited (e.g., network, adjacent, local).
During a penetration test, a tester discovers evidence of an ongoing live exploitation by an unknown third party. Which of the following should the tester do first?
The client needs to know about active exploitation to respond.
Why this answer
If there is evidence of criminal activity or live exploitation, the tester should inform the client immediately so they can take appropriate action.
A penetration tester is preparing a report that includes technical findings. Which TWO of the following should be included in each technical finding? (Select TWO.)
Specific actionable remediation steps are required.
Why this answer
Each technical finding should include remediation steps and evidence such as screenshots.
A penetration tester is presenting findings to a mixed audience of technical staff and executives. The executives seem confused about the risk ratings. How should the tester adjust the presentation?
This helps executives understand the ratings without overwhelming them.
Why this answer
When communicating to a mixed audience, the tester should tailor the message to each group's needs, focusing on risk and business impact for executives.
A penetration tester is preparing a presentation for both technical and executive audiences. Which TWO of the following are effective strategies for communicating findings to an executive audience?
Correct. Executives care about risk to the business.
Why this answer
Executives need high-level overviews and business impact, not technical details.
A penetration tester is prioritizing remediation recommendations. Which approach is most aligned with industry best practices?
Correct. This is standard prioritization.
Why this answer
Prioritization should address critical/high vulnerabilities first, including quick wins that can be implemented rapidly.
A client requests that the penetration test report include raw output from the scanning tools used. Where should this output be placed in the report?
Appendices are the appropriate place for raw data.
Why this answer
Raw tool output is typically included in appendices to avoid cluttering the main findings.
During a penetration test, the tester encounters a situation where the scope of the test is ambiguous. Which TWO actions should the tester take to clarify the situation?
This provides a clear record for both parties.
Why this answer
When scope is unclear, the tester should communicate with the client and document the assumptions to avoid misunderstandings.
During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?
Immediate notification allows the client to mitigate the risk promptly.
Why this answer
Critical findings should be communicated to the client immediately to allow them to take urgent action, even before the formal report is delivered.
A penetration tester has completed the test and is preparing the final report. The client asks the tester to include a section that describes the scope, methodology, and tools used. In which section should this information be placed?
Appendices contain supporting details.
Why this answer
Appendices are the appropriate place for supplementary information such as scope, methodology, and tools used.
A penetration tester discovers a critical vulnerability during an assessment. According to best practices, when should the tester communicate this finding to the client?
Critical findings should be communicated immediately to the client.
Why this answer
Critical findings should be reported immediately to allow the client to take urgent action.
A penetration tester needs to assign a severity rating to a vulnerability based on business context. Which model uses Impact and Likelihood to determine the risk?
Custom severity ratings often incorporate impact and likelihood.
Why this answer
Custom severity ratings often use a matrix of Impact and Likelihood to assess business risk.
When a client disagrees with a finding's severity rating, what is the best approach for the penetration tester?
Allows for constructive discussion and potential adjustment if justified.
Why this answer
The tester should listen to the client's perspective and discuss the risk assessment, providing rationale to explain the rating.
A penetration tester is documenting evidence for a finding. Which of the following is the least appropriate type of evidence to include?
Destructive proof-of-concept is irresponsible and should be avoided.
Why this answer
Proof-of-concept code should demonstrate exploitability without causing harm. Including a fully functional exploit that could cause harm is irresponsible.
Which TWO of the following are components of the DREAD model for risk assessment? (Select TWO.)
Reproducibility is a DREAD component.
Why this answer
DREAD stands for Damage, Reproducibility, Exploitability, Affected users, Discoverability.
Which THREE items are typically included in the appendices of a penetration test report?
Scope is often documented in the appendices.
Why this answer
Appendices contain supplementary information such as scope, methodology, and raw data.
A penetration tester is writing a report and needs to assign a severity rating to a vulnerability that has a CVSS base score of 7.5. According to CVSS v3.1, which severity level does this score correspond to?
7.5 falls in the High range (7.0-8.9).
Why this answer
CVSS v3.1 defines scores from 0.0 to 10.0: 0.0 = None, 0.1-3.9 = Low, 4.0-6.9 = Medium, 7.0-8.9 = High, 9.0-10.0 = Critical.
A penetration tester is presenting findings to a technical audience. Which THREE practices are MOST appropriate for this setting? (Select THREE.)
Showing how the vulnerability is exploited is valuable for technical staff.
Why this answer
Technical audiences benefit from details about exploitation, technical steps, and evidence.
A penetration tester needs to provide remediation recommendations for a critical vulnerability found on a web server. Which of the following is the most appropriate recommendation?
Specific version upgrade addresses the vulnerability.
Why this answer
Specific, actionable steps with version numbers ensure clarity and reduce ambiguity for the client.
A penetration tester is writing the executive summary of a report. Which of the following best describes the appropriate language and content for this section?
Correct. This is the standard content for an executive summary.
Why this answer
The executive summary is for non-technical stakeholders, so it should use business language and focus on overall risk, key findings, and strategic recommendations.
Which section of a penetration test report contains detailed technical information such as the vulnerability description, evidence, affected systems, and remediation steps?
This section includes all technical details about each finding.
Why this answer
The technical findings section provides in-depth details for technical teams to understand and remediate vulnerabilities.
A penetration tester is presenting findings to a group of executives. Which of the following is the most effective way to communicate a critical vulnerability?
Business impact resonates with executives.
Why this answer
Executives need to understand business impact, not technical details. Use business language and focus on risk.
A penetration tester is writing a report and wants to prioritize remediation recommendations. Which TWO factors should the tester consider when prioritizing? (Choose TWO.)
Higher severity should be addressed first.
Why this answer
Prioritization should consider severity and quick wins to address high risks and build momentum.
A penetration tester is presenting findings to a mixed audience of executives and technical staff. For the executives, the tester should focus on:
Executives need to understand risk and make decisions.
Why this answer
Executives are interested in business risk, impact, and strategic recommendations, not technical details.
A penetration tester is documenting evidence for a finding and takes a screenshot. Which of the following is the most important metadata to include with the screenshot?
Correct. Timestamps are crucial for evidence integrity.
Why this answer
Timestamps provide context and prove when the evidence was captured.
During a penetration test, a tester discovers evidence of an ongoing data exfiltration attack by an unknown third party. Which of the following should the tester do first?
The client needs to be informed so they can respond appropriately.
Why this answer
Evidence of criminal activity should be reported immediately to the client, who can then involve law enforcement if needed. The tester should not interfere directly.
Which of the following is an example of a custom severity rating based on business context?
This incorporates business context.
Why this answer
Custom severity often uses impact and likelihood to determine risk, as not all vulnerabilities affect the business equally.
A penetration tester is preparing a remediation recommendation for a SQL injection vulnerability found in a legacy application. The development team cannot immediately update the framework due to compatibility issues. What should the tester recommend as a compensating control?
A WAF can block attacks while the development team works on a permanent fix.
Why this answer
When a full fix is not immediately possible, compensating controls such as a WAF can provide temporary protection.
In a penetration test report, the tester includes a screenshot of a successful exploit. What metadata should the screenshot include to ensure proper evidence documentation?
This provides verifiable proof of the finding.
Why this answer
Screenshots should include timestamps and relevant context such as the affected system to provide clear evidence.
A penetration tester is writing a report and needs to assign a severity rating to a vulnerability. Which of the following scoring systems is specifically designed to consider Damage, Reproducibility, Exploitability, Affected users, and Discoverability?
Correct. DREAD stands for Damage, Reproducibility, Exploitability, Affected users, Discoverability.
Why this answer
The DREAD model is a risk assessment model that uses these five categories.
A penetration tester uses a custom severity rating based on business context. The tester determines the likelihood of exploitation is high and the business impact is low. According to a standard risk matrix, what should the overall severity be?
High likelihood + low impact often yields medium.
Why this answer
In many risk matrices, high likelihood combined with low impact typically results in a medium severity rating.
During a penetration test, a penetration tester discovers a critical vulnerability that could allow an attacker to gain administrative access to the client's payment processing server. According to best practices, what should the tester do?
Immediate notification allows the client to mitigate the risk promptly.
Why this answer
Option C is correct because when a critical vulnerability that could compromise a payment processing server is discovered during a penetration test, the tester must immediately notify the client point of contact (POC) per responsible disclosure and incident response best practices. This allows the client to take urgent mitigating actions, such as applying patches or isolating the server, before the vulnerability is exploited by malicious actors. Delaying notification violates ethical guidelines and could lead to severe financial and reputational damage.
Exam trap
The trap here is that candidates may think exploiting the vulnerability to demonstrate impact (Option A) is necessary for a convincing report, but the PT0-002 exam emphasizes that immediate notification of critical findings takes precedence over demonstration to prevent real-world harm.
How to eliminate wrong answers
Option A is wrong because exploiting the vulnerability without prior authorization, even for demonstration, could cause unintended service disruption or data corruption on a live payment processing server, violating the rules of engagement and potentially the Computer Fraud and Abuse Act (CFAA). Option B is wrong because waiting until the end of the test to report a critical vulnerability leaves the client exposed to exploitation during the testing period, which contradicts the principle of responsible disclosure and could result in a breach. Option D is wrong because asking for permission to continue testing after discovering a critical vulnerability is redundant; the tester already has permission to test, and the immediate priority is to alert the client to the risk, not to seek further authorization.
A penetration tester is prioritizing remediation recommendations in a report. Which of the following should be considered first?
This addresses the highest risk and provides quick wins.
Why this answer
Critical and high severity vulnerabilities that pose immediate risk should be prioritized first, along with quick wins that can be implemented rapidly.
A penetration tester is writing the executive summary of a report. Which of the following is MOST important to include?
The executive summary should present the big picture in business language.
Why this answer
The executive summary should provide a high-level overview in business language, including the overall risk rating, key findings, and strategic recommendations.
A penetration tester receives pushback from a client's technical team regarding a finding, claiming it is not exploitable. Which of the following is the best response?
Demonstration proves exploitability.
Why this answer
Providing evidence and offering to demonstrate helps validate the finding and address concerns professionally.
Which section of a penetration testing report should include screenshots, affected systems, and remediation steps?
Correct. This section includes detailed evidence and remediation.
Why this answer
Technical findings contain detailed information for each vulnerability.
A penetration tester is recommending remediation for a critical vulnerability. Which of the following is the best example of a specific, actionable remediation step?
Correct. This is specific and actionable.
Why this answer
Effective remediation should be specific, including exact versions or commands.
Which of the following is the primary audience for the executive summary of a penetration test report?
The executive summary is tailored for non-technical decision-makers.
Why this answer
The executive summary is written for non-technical stakeholders such as executives and managers, using business language and focusing on risk and strategic recommendations.
A penetration tester is writing a report and needs to assign a custom severity rating for a vulnerability that has high business impact but low likelihood of exploitation. Using a custom severity based on business context (impact + likelihood), which rating is most appropriate?
Correct. High impact + low likelihood balances to medium.
Why this answer
High impact but low likelihood typically results in a medium severity when combining both factors.
During a penetration test, the tester discovers evidence that an external attacker is actively exploiting a vulnerability in the client's environment. Which of the following is the MOST appropriate action?
The tester should stop testing and inform the client of the live attack.
Why this answer
If there is evidence of a live attack or criminal activity, the tester should stop testing and immediately notify the client so they can take appropriate action.
When writing the executive summary of a penetration test report, which of the following is the most appropriate language to use?
This aligns with the needs of executives who need to understand risk and make decisions.
Why this answer
The executive summary should be written in business language, avoiding technical jargon, to convey the overall risk and strategic recommendations to non-technical stakeholders.
A penetration tester discovers a critical vulnerability on a client's web server and wants to communicate it immediately. Which of the following is the most appropriate action?
This aligns with responsible disclosure and client expectations.
Why this answer
Immediate notification of critical findings ensures the client can take urgent steps to mitigate risk.
A penetration tester is preparing a report and wants to include proof-of-concept code to demonstrate a vulnerability. Which of the following is the best practice for including such code?
Responsible disclosure shows exploitability without damage.
Why this answer
Proof-of-concept code should prove the vulnerability is exploitable without causing harm to the client's environment.
Which of the following should be included in the appendix section of a penetration testing report?
Correct. Raw output is typically placed in an appendix.
Why this answer
Appendices contain supporting details like scope, methodology, and raw tool output.
A penetration tester uses the CVSS base score to rate a vulnerability. The tester finds that the vulnerability has a high CVSS score but the affected system is isolated from the internet and has no sensitive data. Which approach should the tester take when assigning an overall severity rating?
The risk is lower because the system is isolated and data is not sensitive.
Why this answer
CVSS is a good starting point but should be adjusted based on business context such as impact and likelihood in the specific environment.
A penetration tester is compiling evidence for a critical-severity SQL injection vulnerability. Which of the following is the most important piece of evidence to include in the report to demonstrate exploitability while remaining responsible?
This demonstrates exploitability without accessing sensitive data.
Why this answer
Proof-of-concept code should demonstrate the vulnerability without causing harm or exposing sensitive data.
A penetration tester is presenting findings to a mixed audience of technical staff and executives. Which THREE of the following should the tester do to effectively communicate to both groups? (Choose THREE.)
Technical staff need evidence to validate findings.
Why this answer
Effective communication to mixed audiences requires adjusting language, providing separate summaries, and using clear visuals.
Which of the following is the most appropriate evidence to include in a penetration testing report for a SQL injection vulnerability?
Screenshots demonstrate proof of exploitability.
Why this answer
Screenshots with timestamps provide clear visual evidence of the exploitation and help validate the finding.
A penetration tester is writing a report and wants to provide a remediation recommendation for an outdated Apache server. Which of the following is the most specific and actionable recommendation?
Specifies exact versions, making it actionable.
Why this answer
Option C is the most specific and actionable recommendation because it explicitly states the exact version to upgrade from (2.4.41) and to (2.4.54), which eliminates ambiguity. In penetration testing reports, vague terms like 'latest version' or 'patches' can lead to incomplete remediation, whereas a precise version number ensures the system administrator knows exactly what action to take to address the vulnerability.
Exam trap
The trap here is that candidates often choose a vague but technically correct-sounding option like 'Update to the latest version' (Option D) without realizing that the PT0-002 exam requires recommendations to be specific, actionable, and verifiable—exact version numbers are the gold standard for remediation in penetration testing reports.
How to eliminate wrong answers
Option A is wrong because 'Reconfigure Apache to be more secure' is too generic and does not address the outdated software; configuration changes alone cannot fix known vulnerabilities in the codebase. Option B is wrong because 'Apply security patches to Apache' is ambiguous—patches may not be available for version 2.4.41, and the term 'patches' could refer to hotfixes rather than a full version upgrade, which is the standard remediation for outdated software. Option D is wrong because 'Update the Apache software to the latest version' is not specific enough; 'latest version' could change over time, and without a target version number, the recommendation lacks the precision needed for verifiable remediation in a penetration test report.
A penetration tester discovers a critical vulnerability that cannot be fully remediated immediately. The client asks for recommendations. Which THREE of the following should the tester include?
Correct. Compensating controls provide interim protection.
Why this answer
When full remediation is not possible, recommend compensating controls, prioritize critical fixes, and offer retesting.
A penetration tester is writing remediation recommendations. Which THREE practices should the tester follow? (Select THREE.)
Specific version numbers provide clear guidance.
Why this answer
Good remediation recommendations are specific, prioritized, and offer alternatives if full fixes are impossible.
During a penetration test, a tester discovers a critical vulnerability that could allow remote code execution on an internet-facing server. According to best practices, what is the most appropriate immediate action?
Correct. Critical findings should be reported promptly.
Why this answer
Critical findings should be communicated immediately so the client can take urgent action.
During a penetration test, a client asks the tester to clarify the scope of the test. Which of the following is the best approach for the tester?
Documented communication maintains a clear record.
Why this answer
Clarifying scope questions helps ensure the test stays within agreed boundaries and avoids misunderstandings.
A penetration tester is presenting findings to a group of IT administrators. One administrator questions the validity of a finding, claiming it is not exploitable. How should the tester respond?
Correct. Evidence helps validate the finding.
Why this answer
The tester should provide evidence to support the finding rather than being defensive or dismissive.
Which section of a penetration testing report should provide a high-level overview of the test results using business language and strategic recommendations?
The executive summary uses business language and provides strategic recommendations.
Why this answer
The executive summary is designed for non-technical stakeholders to understand the overall risk and key actions.
During a penetration test, the tester discovers evidence of an ongoing ransomware attack on the client's network. Which of the following is the most appropriate action?
Correct. Immediate notification is critical for incident response.
Why this answer
Evidence of criminal activity must be reported immediately to the client and may require law enforcement involvement.
A penetration tester is calculating the severity of a vulnerability using the DREAD model. Which of the following factors is assessed under the 'Damage' category?
Damage assesses the impact of exploitation.
Why this answer
In the DREAD model, the 'Damage' category specifically assesses the potential harm from a successful exploit, such as data loss, system corruption, or service disruption. Option B correctly captures this by focusing on the impact to confidentiality, integrity, or availability, which is the core of the Damage factor.
Exam trap
The trap here is confusing the 'Damage' category with 'Affected Users' (Option D), as both involve impact, but Damage focuses on the severity of harm to data or systems, while Affected Users counts the number of individuals or systems impacted.
How to eliminate wrong answers
Option A is wrong because the likelihood of reproducing an exploit is assessed under the 'Reproducibility' category, not Damage. Option C is wrong because the ease of discovering a vulnerability falls under the 'Discoverability' category, which evaluates how easily an attacker can find the flaw. Option D is wrong because the number of users affected is considered under the 'Affected Users' category, which measures the scope of impact, not the direct damage to data or systems.
A penetration tester is preparing to present findings to the client's technical team. Which TWO practices are most effective for this audience?
This provides actionable information for the technical team.
Why this answer
Technical audiences benefit from detailed explanations and evidence, including proof-of-concept code and remediation steps.
A penetration tester discovers a vulnerability that cannot be immediately remediated. Which TWO compensating controls should the tester recommend? (Choose TWO.)
Segmentation reduces the attack surface.
Why this answer
Network segmentation (C) is a compensating control that limits the blast radius by isolating the vulnerable system from critical assets, reducing the likelihood of lateral movement. An IDS (D) provides detection and alerting for exploitation attempts, enabling a rapid response even when the root vulnerability cannot be patched immediately. Both controls reduce risk without requiring an immediate fix.
Exam trap
The trap here is that candidates often confuse compensating controls with remediation actions, selecting 'upgrade the software immediately' (E) even though the scenario explicitly states the vulnerability cannot be immediately remediated.
A penetration tester is handling a client's pushback on a finding. Which THREE approaches are appropriate? (Select THREE.)
The tester should be open to adjusting based on new facts.
Why this answer
When handling pushback, the tester should listen, provide evidence, and possibly adjust the report if valid points are made.
A penetration tester is evaluating vulnerabilities using the DREAD model. For a specific vulnerability, the tester assigns the following scores: Damage=8, Reproducibility=7, Exploitability=9, Affected users=6, Discoverability=5. Which of the following is the overall DREAD risk rating?
The average is 7.
Why this answer
DREAD scores are averaged across the five categories. Compute (8+7+9+6+5)/5 = 35/5 = 7.
In a penetration test report, which section should contain detailed technical information such as affected systems, proof-of-concept code, and remediation steps?
This section contains the detailed technical information for each vulnerability.
Why this answer
The technical findings section is where detailed vulnerability descriptions, evidence, and remediation steps are documented.
During a penetration test, the tester discovers a critical SQL injection vulnerability. The client cannot deploy the full fix (parameterized queries) immediately due to legacy code. Which THREE actions should the tester recommend as compensating controls? (Choose three.)
Limits potential damage.
Why this answer
Compensating controls reduce risk while the full fix is pending. WAF rules, input validation, and restricted DB privileges are appropriate. Disabling error messages is not a direct compensating control, and patching the DBMS may not address the injection.
A penetration tester is preparing the executive summary. Which THREE elements should be included? (Choose three.)
Highlights important issues.
Why this answer
Executive summary should include overall risk rating, key findings, and strategic recommendations. Technical details and methodology are not appropriate for this section.
Ready to test yourself?
Try a timed practice session using only Ptp Reporting questions.