Collaboration and Communication PT0-003 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A penetration testing firm is negotiating a contract with a new client. The client wants a 'full-scope' test that includes social engineering, physical security, and network penetration. The testing firm knows that the client's budget is limited and that the client's primary concern is a recent ransomware attack. The firm also knows that the client's physical security is managed by a third party. What is the most appropriate scoping recommendation?

   • ARecommend focusing on physical security since it is managed by a third party and represents an unknown risk.
   • BRecommend prioritizing the network penetration test to address the ransomware risk, and suggest deferring social engineering and physical security to a later phase.
   • CRefuse the engagement because the client's budget is insufficient for the requested scope.
   • DAgree to the full scope and adjust the depth of testing in each area to fit the budget.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester has just completed a complex network penetration test. Before writing the final report, the tester asks a colleague to review the raw scan data and exploitation notes. What is the primary goal of this review?

   • ATo check the notes for any spelling or grammar errors before they are included in the report.
   • BTo verify that the findings are accurate, reproducible, and that no critical steps were missed during the test.
   • CTo ensure the tester's notes are formatted correctly for the company's documentation standards.
   • DTo help the tester estimate the total hours spent on the engagement for billing purposes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A junior penetration tester has created a custom script to automate a portion of the testing. Before using it on a client engagement, the tester asks a senior colleague to review the script. What is the primary purpose of this peer review?

   • ATo confirm the script is complex enough to be considered a professional deliverable.
   • BTo check that the script adheres to the company's coding style guide.
   • CTo ensure the script is efficient and runs quickly.
   • DTo verify the script performs as intended and does not have unintended side effects on the target environment.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A penetration tester encounters a situation where a vulnerability they are testing appears to have a much larger impact than originally assessed. The tester is unsure whether to continue or stop. What is the most appropriate escalation pathway to use?

   • AContact the tester's direct supervisor and ask for guidance on how to proceed.
   • BContinue testing because the rules of engagement allow all testing within the defined scope.
   • CStop testing immediately and refuse to continue until the client provides a new authorization.
   • DModify the test plan to avoid the vulnerability and test something else.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A penetration testing firm is scoping a large engagement for a multinational client. The client's CISO wants a comprehensive test of all external and internal systems. The client's legal team requires that all testing be performed from within the client's own country to comply with data sovereignty laws. The client's budget is fixed and cannot cover a full test of every system. The testing team must decide on a scope that satisfies the CISO's objective while respecting the legal and budget constraints. What is the most appropriate approach?

   • APerform a limited internal test from a local office and a limited external test from a cloud server in a neighboring country to maximize coverage.
   • BAsk the CISO to approve a larger budget to cover the full scope of testing.
   • CConduct a risk-based scoping session with the CISO and legal team to prioritize the most critical systems that can be tested within the budget and legal constraints.
   • DPerform a full external test from a cloud-based server located in the client's country and skip internal testing to stay within budget.
   Reveal Solution Discussion Select an answer first