Report Writing and Post-Testing Actions CPENT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a web application penetration test, you discovered a SQL injection vulnerability in a login form that allows authentication bypass, and a separate cross-site scripting (XSS) flaw that only affects a low-privilege user's session. The client's risk matrix rates likelihood and impact on a 1–5 scale. You assigned the SQL injection a likelihood of 4 and impact of 5, and the XSS a likelihood of 3 and impact of 2. How should you prioritize these findings in the report?

   • AList XSS as High because it is easier to exploit, and SQL injection as Medium due to authentication bypass complexity.
   • BList SQL injection as High and XSS as Low, with remediation steps ordered accordingly.
   • CList both as High because any vulnerability in a web application is a critical risk.
   • DList both as Medium because the client's risk matrix is subjective and should not drive prioritization.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   Your penetration test found a critical vulnerability in a legacy application that the client cannot patch because the vendor no longer supports it. The application is internet-facing and processes customer orders. The client asks for remediation recommendations that balance risk reduction with business continuity. What should you recommend?

   • ARecommend taking the application offline immediately to eliminate the risk.
   • BRecommend implementing compensating controls such as a web application firewall, network segmentation, and enhanced monitoring, while planning a migration to a supported platform.
   • CRecommend replacing the application immediately with a new system, regardless of cost.
   • DRecommend patching the application with a vendor-supplied patch, even though it is unsupported.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are writing the executive summary for a report where the client's board of directors will decide whether to fund a major security remediation program. The test found multiple critical vulnerabilities, but the client's security team has already remediated two of them during the testing window. The remaining critical issues require significant investment. How should the executive summary present the risk posture?

   • AHighlight the remaining critical risks and the need for investment, while acknowledging the remediation already completed to show progress.
   • BFocus only on the remaining critical risks to emphasize the urgency of funding.
   • CDescribe the technical details of the remaining vulnerabilities so the board understands the complexity.
   • DState that the risk posture is acceptable because two critical issues were already fixed.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   After a penetration test, your team identifies that the cleanup process was incomplete because the tester forgot to remove a temporary file that contained credentials. The client discovered the file and is concerned about residual risk. What is the most appropriate lesson-learned action?

   • AImplement a cleanup checklist that must be signed off by a second team member before the engagement is closed.
   • BApologize to the client and promise to be more careful in future tests.
   • CRemove the file immediately and do not mention it in the lessons-learned review.
   • DBlame the tester and require additional training for that individual only.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration test found a critical vulnerability in a legacy system that cannot be patched because the vendor no longer supports it. The system is critical to business operations. What is the most appropriate remediation recommendation?

   • ARecommend accepting the risk because the system is critical and cannot be changed.
   • BRecommend compensating controls, such as network segmentation and strict access controls, to reduce the risk.
   • CRecommend replacing the legacy system immediately, regardless of business impact.
   • DRecommend disconnecting the system from the network until it can be replaced.
   Reveal Solution Discussion Select an answer first