Collaboration and Communication PT0-003 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A penetration tester has completed a draft of the engagement report. According to best practices, what is the primary purpose of conducting a peer review of this report before delivering it to the client?

   • ATo ensure the report is formatted according to the tester's personal preferences.
   • BTo shorten the report so it is easier for the client to read.
   • CTo confirm that the report contains no findings that could embarrass the client.
   • DTo identify any technical inaccuracies, missing evidence, or unclear recommendations that could mislead the client.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration testing team is starting a new engagement with a client in the energy sector. The client has provided a detailed scope, but the team lead notices that the scope does not include a specific subsidiary that was mentioned in the original proposal. What is the most appropriate action for the team lead?

   • ATest the subsidiary but only for low-impact vulnerabilities to avoid causing disruption.
   • BContact the client to clarify whether the subsidiary is in scope before testing begins.
   • CProceed with the written scope and exclude the subsidiary to avoid any legal issues.
   • DInclude the subsidiary in the testing because it was mentioned in the proposal.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A penetration tester is scoping an engagement for a healthcare client. The client's compliance officer states that the primary objective is to validate that patient data cannot be accessed by unauthorized internal users. The IT director, however, expects the test to focus on external perimeter defenses. The tester has limited time and budget. Which action best aligns the engagement with stakeholder expectations?

   • AProceed with external testing and note the compliance officer's concern in the final report.
   • BConduct a kickoff meeting to reconcile the conflicting objectives and document an agreed-upon scope before testing begins.
   • CAsk the IT director to approve the compliance officer's scope in writing.
   • DPerform both internal and external tests by reducing the depth of each assessment to fit the budget.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When presenting a vulnerability to a client, which element is most important for enabling the client to assess the risk and decide on a response?

   • AThe number of other clients who have experienced the same vulnerability.
   • BThe exact command used to exploit the vulnerability.
   • CThe likelihood of exploitation and the potential impact on the organization.
   • DThe name of the vulnerability scanner used to detect the issue.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration tester is presenting the final report to a client's board of directors. The report includes a finding that the client's customer database is exposed to the internet. The board members are not technical. One board member asks, 'Can't we just put a firewall in front of it?' The tester knows that the database also has weak authentication and unpatched software. What is the most effective response?

   • ALet me explain the technical details of the vulnerability to you in more depth.
   • BNo, a firewall won't help. The only solution is to completely rebuild the database application.
   • CYes, a firewall would be a good first step, but it's not a complete solution. The database also has weak authentication and missing patches, which could still allow an attacker to gain access.
   • DA firewall is a good idea, but you should also consider hiring more security staff to monitor the system.
   Reveal Solution Discussion Select an answer first