Report Writing and Post-Testing Actions CPENT Practice Questions (Page 11)

Questions 51–52

1. 51application · medium

   You are documenting a critical vulnerability found in a client's application. The technical team will use the report to reproduce and fix the issue. Which set of details is essential for the technical findings section?

   • AThe business impact summary and the executive-level risk rating only.
   • BThe name of the tester who found the issue and the time spent on the assessment.
   • CThe vulnerability scanner output and the date the scan was performed.
   • DThe affected endpoint, the exact request/response that triggered the issue, a proof-of-concept, and step-by-step remediation instructions.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   After completing an internal penetration test, you created several local user accounts, modified firewall rules to allow outbound traffic, and uploaded a web shell to a test server. The client's change-management policy requires that all test artifacts be removed and systems restored to their original state. What is the most appropriate post-testing action?

   • ADocument the changes in the report and ask the client to revert them manually.
   • BRemove the web shell but leave the user accounts and firewall rules since they are not visible to end users.
   • CDelete the user accounts, revert the firewall rules, remove the web shell, and verify with the client that no residual access remains.
   • DDisable the user accounts and leave the firewall rules and web shell in place for future testing.
   Reveal Solution Discussion Select an answer first