Collaboration and Communication PT0-003 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A penetration tester needs to explain a critical vulnerability to a client's non-technical executives. What is the most effective way to articulate the risk so that they can make an informed decision?

   • ARecommend immediate remediation without explaining why the vulnerability is a risk.
   • BProvide a list of all affected systems and their IP addresses.
   • CFocus on the potential business impact, such as financial loss, reputational damage, and regulatory penalties.
   • DDescribe the vulnerability using technical jargon and detailed exploit steps.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A penetration tester is preparing an engagement for a client. The client's primary objective is to meet regulatory compliance requirements, while the tester's standard methodology focuses on exploiting high-impact vulnerabilities. What is the best way to align the testing objectives with the client's expectations?

   • AAsk the client to change their objective to focus on high-impact vulnerabilities instead of compliance.
   • BReview the compliance requirements with the client and tailor the test objectives to include both compliance checks and vulnerability exploitation.
   • CConduct the test without discussing objectives, assuming the client will be satisfied with any findings.
   • DPerform the test using the tester's standard methodology and include a compliance mapping in the final report.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is conducting an assessment and discovers that the client's firewall is blocking all outbound traffic from the tester's IP address, preventing the test from proceeding. The tester has already tried contacting the client's technical contact, but the contact is unavailable. What is the most appropriate next step?

   • AWait for the technical contact to become available and pause the test.
   • BTry to bypass the firewall using a different technique or tool.
   • CEscalate the issue to the client's primary point of contact or project manager to get the firewall rule changed.
   • DStop the engagement and report the client as uncooperative.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A senior penetration tester is leading a team on a complex engagement. A junior tester has produced a detailed report on a web application vulnerability. The senior tester's peer review reveals that the junior tester misinterpreted the business logic and the vulnerability is actually a low-risk issue, not a critical one. The client is expecting a preliminary report in two hours. What is the most appropriate action for the senior tester?

   • AEscalate the issue to the client's project manager and ask for an extension.
   • BWork with the junior tester to correct the report and ensure the final version accurately reflects the true risk before sending it to the client.
   • CApprove the report as-is to meet the deadline, as the technical details are correct.
   • DSend the report to the client with a note that the risk rating is under review.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During a penetration test, a tester discovers that a critical system has been inadvertently disrupted, causing a service outage. According to the engagement plan, what is the first step the tester should take to resolve this issue?

   • ADocument the issue in the final report and continue testing other systems.
   • BWait to see if the system recovers on its own before taking any action.
   • CAttempt to fix the system immediately without informing anyone.
   • DFollow the escalation pathway defined in the rules of engagement to notify the appropriate incident response contact.
   Reveal Solution Discussion Select an answer first