Report Writing and Post-Testing Actions CPENT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   After completing a penetration test, you discover that a tester left an SSH key on a compromised server that was used for persistence. The tester is on vacation and cannot be reached. The client's server is critical to production and cannot be taken offline. What is the most appropriate cleanup action?

   • ADisable the SSH service on the server to prevent access.
   • BRemove the SSH key from the authorized_keys file, verify no other persistence mechanisms exist, and document the action in the post-testing section.
   • CLeave the SSH key in place until the tester returns to remove it themselves.
   • DChange the server's host key to invalidate the tester's SSH key.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   You are preparing a penetration test report for a client that will be audited by an external regulator. The regulator requires that the report clearly show the testing scope, methodology, and evidence for each finding. The client also wants the report to be concise for internal distribution. How should you format the report?

   • AUse a separate report for the regulator and a different one for internal distribution.
   • BPut all findings, methodology, and evidence in the appendix, and keep the main body as a cover letter.
   • CKeep the report to a single page with only the executive summary and a list of findings.
   • DInclude a detailed methodology section and an evidence appendix, with a summary table of findings in the main body.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   Your penetration test identified a critical SQL injection vulnerability in a customer-facing application and a low-severity information disclosure in an internal tool. The client has limited development resources this quarter. What is the most appropriate remediation recommendation?

   • AFix both vulnerabilities in the same sprint to ensure all findings are resolved quickly.
   • BRecommend purchasing a web application firewall as a complete solution for both vulnerabilities.
   • CFix the information disclosure first because it is easier to remediate.
   • DPrioritize fixing the SQL injection immediately, and schedule the information disclosure fix for the next quarter.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Why is it important to maintain confidentiality when writing a penetration testing report?

   • ATo avoid having to write detailed explanations
   • BTo make the report more interesting to read
   • CTo comply with the tester's personal preferences
   • DTo protect sensitive information from unauthorized disclosure
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the key characteristic of an effective remediation recommendation in a penetration testing report?

   • AIt is vague to allow flexibility
   • BIt is written only for executives
   • CIt only mentions the vendor patch number
   • DIt is actionable and specific to the vulnerability
   Reveal Solution Discussion Select an answer first