A penetration test was performed by an on-staff junior technician. During the test, the technician discovered the web application could disclose an SQL table with user account and password…

Question

Options

• ADocument the findings with an executive summary, recommendations, and screenshots of the
• BConnect to the SQL server using this information and change the password to one or two non-
• CNotify the development team of the discovery and suggest that input validation be implemented
• DRequest that management create an RFP to begin a formal engagement with a professional

• A
  84% (26)
• B
  10% (3)
• C
  3% (1)
• D
  3% (1)

Explanation

The professional and most effective method is to document the finding formally: an executive summary communicates the business risk in non-technical language that management can understand, screenshots provide irrefutable evidence of the vulnerability, and actionable recommendations guide remediation. Option B (changing passwords) is unauthorized, destructive, and potentially illegal beyond the defined scope. Option C (notifying only the development team) bypasses management and reduces visibility of a critical finding. Option D (requesting an RFP for a formal engagement) is unnecessary when the finding has already been discovered and needs immediate communication.

No community discussion yet for this question.