Collaboration and Communication PT0-003 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A penetration tester has identified a critical vulnerability in a web application that could allow an attacker to access other customers' data. The client's project manager, who is non-technical, asks, 'Is this a big deal?' Which response best articulates the risk to the project manager?

   • AYes, it's a critical finding with a CVSS score of 9.8, and it needs to be fixed immediately.
   • BIt's a medium risk. We can discuss the technical details in the final report.
   • CDon't worry, this is common in most web applications and is unlikely to be exploited.
   • DIt's a serious issue. An attacker could potentially access and steal your customers' personal data, which could lead to a data breach, regulatory fines, and loss of customer trust.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A penetration tester is working on an engagement and discovers that a specific test is causing the client's web application to become unresponsive. The tester has already tried to reduce the intensity of the test, but the problem persists. The rules of engagement state that the tester should avoid causing denial of service. What is the most appropriate action?

   • ASwitch to a different tool that might be less disruptive to the application.
   • BContinue the test but use a slower timing to see if the application recovers.
   • CDocument the issue in the final report and recommend the client fix the application's stability.
   • DStop the test immediately and inform the client's technical point of contact.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During the planning phase of a penetration test, a security tester meets with the client's management team. The management team expects the test to prove that their current security controls are impenetrable. What is the most appropriate way for the tester to align the engagement objectives with stakeholder expectations?

   • AAdjust the test scope to focus only on controls that are likely to pass, so the results are favorable to management.
   • BProceed with the test without discussing expectations, and let the final report speak for itself.
   • CPromise that the test will prove the security controls are effective if the scope is limited to non-critical systems.
   • DExplain that a penetration test identifies exploitable weaknesses and cannot prove that a system is completely secure, then set realistic objectives.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester has identified a vulnerability that could allow an attacker to deface the client's public website. The client's marketing manager is concerned about the impact on the company's reputation. The IT manager is concerned about the technical effort required to fix it. How should the tester present this finding to ensure both concerns are addressed?

   • AExplain the potential for reputational damage to the marketing manager and the technical remediation steps to the IT manager in separate conversations.
   • BPresent the finding to both managers together, explaining the business impact (reputational damage) and the technical remediation effort, and facilitate a discussion on prioritization.
   • CFocus on the technical details of the vulnerability and the exact steps to remediate it.
   • DRecommend that the website be taken offline until the vulnerability is fixed.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   During a peer review of a penetration test methodology, a reviewer notices that the tester used a tool in a way that is not consistent with the engagement rules of engagement. What is the most appropriate action for the reviewer to take?

   • AImmediately stop the entire engagement and inform the client.
   • BIgnore the issue because the tool was used successfully and the test is almost complete.
   • CDocument the deviation and discuss it with the tester to determine if it was intentional and whether it needs to be reported.
   • DModify the rules of engagement to match the tester's actions.
   Reveal Solution Discussion Select an answer first