PT0-001 · Question #80
A software development team recently migrated to new application software on the on-premises environment Penetration test findings show that multiple vulnerabilities exist If a penetration tester…
The correct answer is A. Unsecure service and protocol configuration. When replicating a vulnerable application environment in a VM for penetration testing, confirming that unsecure service and protocol configurations are accurately reproduced is the most critical step.
Question
A software development team recently migrated to new application software on the on-premises environment Penetration test findings show that multiple vulnerabilities exist If a penetration tester does not have access to a live or test environment, a test might be better to create the same environment on the VM. Which of the following is MOST important for confirmation?
Options
- AUnsecure service and protocol configuration
- BRunning SMB and SMTP service
- CWeak password complexity and user account
- DMisconfiguration
How the community answered
(41 responses)- A73% (30)
- B7% (3)
- C2% (1)
- D17% (7)
Why each option
When replicating a vulnerable application environment in a VM for penetration testing, confirming that unsecure service and protocol configurations are accurately reproduced is the most critical step.
Unsecure service and protocol configurations - such as unencrypted protocols like Telnet or FTP, or improperly configured services - are the root cause of the vulnerabilities identified in the penetration test findings. Accurately replicating these insecure configurations in the VM environment ensures the tester can safely reproduce and validate the same vulnerabilities without affecting the production system.
Verifying that services like SMB and SMTP are running is relevant but insufficient - confirming they are configured insecurely as found in the original findings is what enables meaningful vulnerability reproduction.
Weak password complexity is a contributing factor but is a narrower subset of the overall insecure configuration problem and does not address service-level vulnerability replication.
Misconfiguration is too broad and non-specific to serve as a precise confirmation step compared to explicitly verifying unsecure service and protocol configurations.
Concept tested: Replicating vulnerable service configurations in isolated VM
Source: https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/README
Topics
Community Discussion
No community discussion yet for this question.