Penetration Test Reports PT0-003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which section of a penetration test report should contain the detailed technical description of a vulnerability and how it was exploited?

   • ARecommendations
   • BMethodology
   • CExecutive summary
   • DFindings
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which factor is most commonly used to prioritize findings in a penetration test report?

   • AThe ease of exploitation
   • BThe number of tools that detected the vulnerability
   • CThe risk and impact of each vulnerability on the organization
   • DThe order in which the vulnerabilities were discovered
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is the most appropriate visual representation to show the number of vulnerabilities found at each severity level (Critical, High, Medium, Low)?

   • AA bar chart
   • BA line graph
   • CA pie chart
   • DA scatter plot
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is documenting a finding for a client. The finding is a cross-site scripting (XSS) vulnerability in a web application. The tester has a screenshot of the XSS payload executing in a browser. The client's development team is responsible for fixing the issue. What is the most important information to include in the finding documentation?

   • AThe exact URL where the XSS occurs, the payload used, and a step-by-step reproduction guide.
   • BA general description of XSS and its potential impact on the organization.
   • CThe screenshot of the XSS payload executing, without any additional context.
   • DThe CVSS score and a recommendation to use a web application firewall (WAF).
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a penetration test, a tester discovers a misconfigured S3 bucket that allows public write access. The tester successfully uploads a test file to prove the issue. What should the tester include in the findings documentation for this vulnerability?

   • AThe IP address of the tester's machine and the timestamp of the upload.
   • BThe bucket name, the exact permissions that allowed write access, and a screenshot of the uploaded test file.
   • CThe CVSS score and a recommendation to rotate access keys.
   • DA general statement that the S3 bucket is insecure and should be fixed.
   Reveal Solution Discussion Select an answer first