Which of the following is the best way to communicate a critical vulnerability to the technical team responsible for fixing it?

Provide the technical details, including the affected systems and recommended patch

Wait until the next quarterly meeting to discuss it

Only mention the vulnerability in the executive summary

Summarize the vulnerability in one sentence without technical details

Which of the following is the primary reason for documenting key events during a penetration test?

To justify the cost of the penetration test to the client

To track the tester's productivity for performance reviews

To provide evidence of the attack path for the final report

To create a marketing case study for the testing company

During a penetration test, a tester successfully exploits a vulnerability and gains access to a database containing customer records. Which of the following actions is most appropriate to document as a key event?

The exact time and method of the successful exploitation

The tester's personal notes about the difficulty of the exploit

The number of hours spent on the entire engagement

The brand of the database server hardware

A penetration tester found that a critical server is running an outdated operating system with known vulnerabilities. The server hosts a customer-facing application and cannot be taken offline during business hours. What should the tester document as the impact of this finding?

The impact is limited to the server itself, with no effect on the application or customers.

The server is not at risk because the vulnerabilities are only theoretical.

The impact is low because the server is not directly accessible from the internet.

The server is at risk of being compromised, which could lead to a data breach and service disruption.

CompTIAPenTest+

Domain 5Objective 2

Documentation PT0-003 Practice Questions (Page 5)

Part of the Post-exploitation and lateral movement domain, which accounts for 14% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~9–15 in this domain), expect 5–8 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

14%of the exam

Questions 21–24

21foundation · easy
Which of the following is the best way to communicate a critical vulnerability to the technical team responsible for fixing it?
Select an answer first
22foundation · easy
Which of the following is the primary reason for documenting key events during a penetration test?
Select an answer first
23foundation · easy
During a penetration test, a tester successfully exploits a vulnerability and gains access to a database containing customer records. Which of the following actions is most appropriate to document as a key event?
Select an answer first
24application · medium
A penetration tester found that a critical server is running an outdated operating system with known vulnerabilities. The server hosts a customer-facing application and cannot be taken offline during business hours. What should the tester document as the impact of this finding?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.