Collaboration and Communication PT0-003 Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A penetration tester is preparing the executive summary of a report for a retail client. The client's CEO is the primary audience. Which of the following is the most effective way to present a critical finding about a SQL injection vulnerability?

   • AExplain that the vulnerability could allow an attacker to steal customer payment information, leading to a data breach, regulatory fines, and reputational damage.
   • BState that the vulnerability has a high CVSS score and is in the OWASP Top 10.
   • CRecommend a specific code fix and suggest the development team review the application's input validation.
   • DProvide the exact URL, parameter, and SQL payload used to exploit the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A penetration tester is planning a social engineering engagement for a client. The client's marketing department is concerned that the planned phishing emails might damage the company's brand if they are seen by customers. The client's security team wants a realistic test. What is the most appropriate way to align these expectations?

   • AProceed with the test as planned and explain the results to the marketing department after it is complete.
   • BAsk the security team to approve the test and inform the marketing department of the decision.
   • CWork with both departments to design a test that is realistic but uses a controlled scenario, such as targeting a specific internal group with a fake internal announcement, to minimize external visibility.
   • DCancel the social engineering test to avoid any risk to the brand.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During an active penetration test, a tester discovers what appears to be a live database containing unencrypted credit card numbers. The tester is concerned about the potential for data exposure if the test continues. The engagement's rules of engagement do not explicitly cover this scenario. What is the most appropriate immediate action for the tester to take?

   • ADocument the finding and include it in the final report without interrupting the test.
   • BContinue testing to fully map the extent of the data exposure before reporting it.
   • CDelete the data to prevent it from being stolen by an actual attacker.
   • DPause testing on that system and immediately escalate the situation to the client's primary point of contact.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A penetration tester has completed a draft of a penetration test report for a financial client. The report contains a critical finding, but the tester is unsure if the business impact section is clearly articulated for a non-technical audience. According to best practices for quality assurance, what should the tester do before delivering the report?

   • ARun a spell-check and verify that all technical commands are formatted correctly.
   • BRewrite the entire report in simpler language to ensure the client understands it.
   • CRequest a peer review from a colleague to check the technical accuracy and the clarity of the business impact for a non-technical reader.
   • DSubmit the report to the client immediately to meet the deadline and avoid delays.
   Reveal Solution Discussion Select an answer first