Penetration Test Reports PT0-003 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a business impact that should be included in an impact analysis?

   • AThe version of the operating system that is vulnerable
   • BThe potential loss of customer trust due to a data breach
   • CThe IP address of the attacker
   • DThe exact exploit code used to compromise the system
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of prioritizing findings in a penetration test report?

   • ATo rank the findings from most to least interesting for the penetration tester
   • BTo help the organization focus remediation efforts on the most critical risks first
   • CTo make the report longer and more detailed
   • DTo comply with regulatory requirements for penetration testing
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is the most appropriate content for an executive summary?

   • AA summary of the overall security posture, key risks, and recommended focus areas
   • BA narrative of the exact exploitation steps used to compromise the domain controller
   • CA detailed log of all network scans performed
   • DA list of all CVEs and their CVSS scores
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of the findings documentation section in a penetration test report?

   • ATo list the tools used during the engagement
   • BTo document each vulnerability, the exploit used, and supporting evidence
   • CTo provide a high-level summary for executives
   • DTo provide step-by-step remediation instructions
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A penetration tester is writing a report for a client. The client's executive team is non-technical, but the IT security team is highly technical. The tester needs to describe a complex attack chain that involved multiple vulnerabilities. How should the tester describe this attack chain in the executive summary?

   • ADescribe the attack chain in technical detail, including the specific vulnerabilities and exploit techniques used.
   • BAvoid describing the attack chain altogether to keep the report simple.
   • CDescribe the attack chain in simple terms, focusing on the business impact, such as 'an attacker was able to gain access to customer data'.
   • DProvide a high-level summary of the attack chain and include the technical details in the findings section.
   Reveal Solution Discussion Select an answer first