Documentation PT0-003 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes the purpose of an attack narrative in a penetration test report?

   • ATo provide a chronological, step-by-step account of the actions taken during the penetration test
   • BTo provide a legal disclaimer and scope definition for the penetration test
   • CTo summarize the executive-level impact of the findings without technical detail
   • DTo list only the tools used during the test without describing how they were used
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is preparing the final report for a client. The client's executive team is primarily interested in the business impact and high-level recommendations, while the technical staff wants detailed steps and evidence. How should the tester structure the report to meet both audiences' needs?

   • ACreate two separate reports: one for executives and one for technical staff, with no overlap.
   • BInclude an executive summary at the beginning and a detailed technical appendix for the technical staff.
   • CProvide a single detailed report with all technical information, as the executives can skip to the summary.
   • DFocus on the technical details and assume the executives will rely on the technical staff to interpret the findings.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester discovered that a misconfigured S3 bucket allowed public read access to a database backup file containing customer PII. The tester downloaded the file and confirmed the data was accessible. In the report, what should the tester document as the impact of this finding?

   • AThe impact is limited to the tester's access, as no other parties are known to have accessed the data.
   • BThe impact is negligible because the tester did not modify or delete any data.
   • CThe potential for data exposure, since the tester did not verify if anyone else accessed the data.
   • DThe actual data breach, since the tester accessed the data, proving a breach occurred.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a penetration test report, what is the primary purpose of the impact analysis section?

   • ATo compare the penetration tester's skills with other testers
   • BTo list all the tools used during the penetration test
   • CTo describe the potential consequences of the exploited vulnerabilities on the organization
   • DTo provide step-by-step instructions for reproducing the attack
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is writing the final report for a client. The client's management is concerned about the risk of a specific vulnerability being exploited. The tester has determined that the vulnerability requires local access to the system. How should the tester communicate this finding to management?

   • ARecommend immediate patching, as any vulnerability is critical.
   • BState that the vulnerability is low risk because it requires local access, which is unlikely to be exploited.
   • CExplain that the vulnerability requires local access, so the risk is moderate and depends on the existing security controls.
   • DDo not include the finding in the report, as it is not exploitable remotely.
   Reveal Solution Discussion Select an answer first