Penetration Test Reports PT0-003 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration test identified a vulnerability in a company's internal HR system that could allow an attacker to access employee PII. The system is not internet-facing, but an attacker could exploit it after gaining a foothold on the internal network. The company is concerned about regulatory compliance. What is the most important impact to articulate in the report?

   • AThe vulnerability could lead to a data breach of employee PII, resulting in regulatory fines and reputational damage.
   • BThe vulnerability is in an internal system and is not directly exploitable from the internet.
   • CThe vulnerability has a CVSS score of 7.5, indicating high severity.
   • DThe HR system should be patched immediately.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the key characteristic of an actionable remediation recommendation?

   • AIt provides specific, concrete steps that can be implemented to fix the vulnerability
   • BIt is written in highly technical jargon that only security experts can understand
   • CIt is vague and general, such as 'improve security'
   • DIt only states the risk without suggesting any fix
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of non-technical language suitable for an executive audience?

   • AThe Metasploit module 'exploit/multi/http/tomcat_mgr_upload' was used to gain a shell on the server.
   • BA weakness in the login page could allow an unauthorized person to gain access to sensitive customer information.
   • CThe SQL injection vulnerability in the login form allows an attacker to bypass authentication and access the database.
   • DThe web application is vulnerable to CVE-2024-1234, which has a CVSS score of 9.8.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A penetration tester is writing the executive summary for a report. The test found a critical vulnerability in a customer-facing application that could allow data exfiltration. However, the tester also found that the application is scheduled to be replaced in three months. The client's CEO is concerned about the cost of an immediate fix. How should the tester present this finding in the executive summary?

   • ADownplay the severity of the finding because the application will be replaced soon.
   • BHighlight the critical risk of data exfiltration and recommend immediate remediation, while noting the upcoming replacement as a factor to consider in the remediation timeline.
   • CRecommend deferring remediation until the replacement is deployed, to save costs.
   • DState that the application must be fixed immediately, without mentioning the replacement.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A penetration test identified a critical vulnerability in a legacy application that is no longer supported by the vendor. The application is critical to business operations and cannot be taken offline. The tester must provide remediation recommendations. Which recommendation is most appropriate?

   • AImplement network segmentation to isolate the application and restrict access to only those who need it.
   • BUpgrade the application to the latest version from the vendor.
   • CAccept the risk and document it in the report.
   • DDecommission the application immediately.
   Reveal Solution Discussion Select an answer first