CISSP Practice Question: During a penetration test, the tester gains…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Exfiltrate the data to demonstrate the risk

  Why it's wrong here

  Exfiltrating sensitive data, even to demonstrate risk, constitutes an unauthorized data breach and falls outside the ethical and legal boundaries of a penetration test. Unless explicitly defined within the Statement of Work (SOW) with specific, controlled conditions (e.g., dummy data), such actions violate privacy regulations, client trust, and could lead to severe legal repercussions for both the tester and the client organization. The purpose of a pen test is to identify vulnerabilities, not to cause actual harm or unauthorized data movement.

• ✗

  Delete the data to prevent exposure

  Why it's wrong here

  Deleting data, even with the intention of preventing further exposure, is a highly destructive and unethical action for a penetration tester. This act destroys critical forensic evidence necessary for the client's incident response team to understand the attack vector, scope of compromise, and implement effective remediation. Furthermore, it violates the principle of non-disruption and could lead to significant data loss for the client, exceeding the authorized scope and potentially causing more harm than the original vulnerability.

• ✗

  Continue testing to find more vulnerabilities

  Why it's wrong here

  Continuing to test for more vulnerabilities after gaining access to sensitive data is a misprioritization and significantly increases the risk to the organization. Once a critical compromise like sensitive data access is achieved, the immediate focus must shift from discovery to containment and reporting. Further probing could inadvertently corrupt data, trigger security alerts, or broaden the exposure of the sensitive information, escalating the incident rather than helping to mitigate it.

• ✓

  Report the finding immediately and secure the data

  Why this is correct

  Immediately reporting the finding and coordinating to secure the data is the paramount ethical and professional responsibility of a penetration tester upon discovering sensitive data access. This action adheres to responsible disclosure principles, enabling the client's incident response team to swiftly contain the breach, conduct forensics, and remediate the vulnerability before further damage occurs. Securing the data, often in collaboration with the client, might involve isolating the compromised system or revoking the unauthorized access path, ensuring the integrity and confidentiality of the information.

Go deeper

Related to this question