Penetration Testing Guidelines and Recommendations EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A penetration tester is conducting an assessment for a healthcare provider. The tester discovers a critical vulnerability that could allow unauthorized access to patient records. What is the most appropriate immediate action?

   • ANotify the client immediately with details and a recommended mitigation.
   • BWait until the final report is delivered to avoid interrupting the test.
   • CDocument the finding and continue testing other systems.
   • DExploit the vulnerability further to demonstrate the full impact.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration testing team is preparing the final report for a client. The team wants to ensure that the report is useful for both technical staff and management. What should the report include?

   • AA detailed log of all commands used during the test.
   • BAn executive summary, a technical findings section, and remediation recommendations.
   • COnly a list of vulnerabilities and their CVSS scores.
   • DA summary of the tester's qualifications and tools used.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester is documenting findings from a web application assessment. The client wants a report that clearly shows the business impact of each vulnerability and provides actionable remediation steps. Which approach best meets this requirement?

   • AInclude only vulnerabilities that were successfully exploited
   • BPrioritize findings by CVSS score and include a remediation plan for each
   • CList all vulnerabilities alphabetically with raw proof-of-concept code
   • DProvide only the executive summary to avoid overwhelming technical staff
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A penetration testing team is planning an assessment for a client that has a tight budget and a short timeline. The client wants to maximize coverage but also needs a clear remediation roadmap. Which approach best balances these constraints?

   • ATest all systems equally to ensure complete coverage
   • BFocus only on external systems and skip internal testing
   • CUse automated tools only to save time and money
   • DPrioritize high-risk systems and provide a phased remediation plan
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A penetration tester is engaged to test a company's internal network. During the reconnaissance phase, the tester discovers a third-party vendor's system that is connected to the client's network but is not mentioned in the scope. What should the tester do?

   • AStop testing that system and report the discovery to the client for scope clarification.
   • BInclude the system in the final report as a finding without testing it.
   • CTest the system because it is connected to the client's network.
   • DIgnore the system and continue testing the in-scope targets.
   Reveal Solution Discussion Select an answer first