Report Writing and Post-Testing Actions CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the most appropriate way to handle sensitive data collected during a penetration test?

   • AShare it with other clients to demonstrate expertise
   • BKeep it on the tester's personal device for future reference
   • CInclude all raw data in the report for transparency
   • DStore it securely and only include necessary details in the report
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   You discovered a critical vulnerability that allows an attacker to access sensitive customer data. The client's legal team has asked you to exclude the specific data samples from the report to avoid disclosure, but the technical team needs the evidence to reproduce the issue. How should you document the finding?

   • AInclude redacted evidence in the report and provide the full evidence to the technical team through a secure, access-controlled channel.
   • BProvide the full evidence only to the legal team and let them decide what to share.
   • CExclude all evidence from the report and only describe the vulnerability in general terms.
   • DInclude the full evidence in the report because the technical team needs it.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You are writing the executive summary for a penetration test report. The test found a critical remote code execution vulnerability in a public-facing web server and several medium-severity misconfigurations in internal systems. The audience is the client's board of directors, who are not technical. What should the executive summary emphasize?

   • AA list of all vulnerabilities sorted by severity with no additional context.
   • BThe overall risk posture, the critical vulnerability's business impact, and the need for immediate remediation.
   • CThe exact CVSS scores and exploit code used to demonstrate the vulnerabilities.
   • DThe methodology used to conduct the test, including tool versions and scanning parameters.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a penetration testing report, how should remediation recommendations be prioritized?

   • ABased on the tester's personal preference
   • BBased on the order in which the vulnerabilities were discovered
   • CBased on the risk rating of the associated vulnerability
   • DBased on the cost of remediation
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a post-testing cleanup action?

   • ARemoving temporary user accounts created during the test
   • BDeleting the client's production data to test recovery
   • CLeaving a backdoor for future testing
   • DChanging the administrator password to a new one
   Reveal Solution Discussion Select an answer first