Penetration Test Reports PT0-003 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A penetration tester is writing the executive summary for a report to be presented to the board of directors. The most critical finding is a SQL injection vulnerability in a customer-facing web application that could allow an attacker to access the customer database. The board members are not technical. Which approach best communicates the impact of this finding to the board?

   • ARecommend immediate patching of the web application and provide the exact patch name and version.
   • BDescribe the vulnerability as a 'critical SQL injection flaw' and explain the technical exploit steps in detail.
   • CList the CVSS score and the CWE identifier for the vulnerability, and note that it is 'high severity'.
   • DState that the vulnerability could allow unauthorized access to customer data, potentially leading to a data breach and regulatory fines, and emphasize the business risk.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration test identified a vulnerability in a company's VPN gateway that could allow an attacker to bypass authentication. The company relies on this VPN for remote work. What is the most important impact to articulate in the report?

   • AThe vulnerability has a CVSS score of 9.8.
   • BAn attacker could gain unauthorized access to the internal network, potentially leading to data theft or ransomware.
   • CThe VPN gateway is running an outdated firmware version.
   • DThe VPN gateway should be replaced with a newer model.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary benefit of using charts, graphs, and tables in a penetration test report?

   • AThey are required by the CompTIA PenTest+ certification
   • BThey replace the need for written explanations
   • CThey make the report look more professional and visually appealing
   • DThey allow complex data and findings to be presented in a clear and easily digestible format
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A penetration tester is creating a report for a client. The report includes 20 findings with varying severity levels. The client's management team wants to understand which vulnerabilities pose the greatest risk to the organization. Which visual representation is most effective for this purpose?

   • AA pie chart showing the percentage of findings by severity.
   • BA heatmap showing the likelihood and impact of each finding.
   • CA bar chart showing the number of findings by severity level.
   • DA table listing all 20 findings with their CVSS scores.
   Reveal Solution Discussion Select an answer first