Legal and Ethical Compliance PT0-003 Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A penetration tester is hired to test a company's network. The company is located in a country that has specific laws regarding cybersecurity testing. The tester is not familiar with these laws. What should the tester do?

   • AAsk the client to provide a legal opinion on the laws.
   • BResearch and understand the local cybersecurity laws before starting the test.
   • CProceed with the test, as the authorization letter is sufficient.
   • DRefuse to conduct the test until the client provides a legal waiver.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A penetration tester is conducting a test for a company that processes credit card payments. The tester discovers a vulnerability that could allow an attacker to access cardholder data. According to PCI DSS, what is the tester required to do?

   • AContact the payment card brands directly to report the vulnerability.
   • BReport the vulnerability only in the final report to the client.
   • CImmediately notify the client and assist in the required reporting to the payment card industry.
   • DDocument the vulnerability and include it in the final report, but do not mention it until then.
   Reveal Solution Discussion Select an answer first
3. 18foundation · easy

   During a penetration test, a tester discovers a critical vulnerability that could allow an attacker to access sensitive customer data. According to mandatory reporting requirements, what should the tester do?

   • AReport the vulnerability to the client immediately.
   • BPublish the vulnerability in a public forum.
   • CWait until the final report to disclose the finding.
   • DExploit the vulnerability to demonstrate the impact.
   Reveal Solution Discussion Select an answer first