nerdexam
CompTIA

PT0-002 · Question #149

A new client hired a penetration-testing company for a month-long contract for various security assessments against the client's new service. The client is expecting to make the new service publicly…

The correct answer is B. Establish the threshold of risk to escalate to the client immediately. Given the client's expectation to delay fixing most issues until after public launch but to address critical issues immediately, the most important initial step is to define the threshold for immediate risk escalation. This ensures that truly critical vulnerabilities are…

Planning and Scoping

Question

A new client hired a penetration-testing company for a month-long contract for various security assessments against the client’s new service. The client is expecting to make the new service publicly available shortly after the assessment is complete and is planning to fix any findings, except for critical issues, after the service is made public. The client wants a simple report structure and does not want to receive daily findings. Which of the following is most important for the penetration tester to define FIRST?

Options

  • AEstablish the format required by the client.
  • BEstablish the threshold of risk to escalate to the client immediately.
  • CEstablish the method of potential false positives.
  • DEstablish the preferred day of the week for reporting.

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    76% (25)
  • C
    6% (2)
  • D
    15% (5)

Why each option

Given the client's expectation to delay fixing most issues until after public launch but to address critical issues immediately, the most important initial step is to define the threshold for immediate risk escalation. This ensures that truly critical vulnerabilities are communicated and remediated before the service goes live, minimizing immediate risk.

AEstablish the format required by the client.

While establishing the report format is important, defining the escalation threshold for critical risks directly impacts the client's ability to fix pre-launch issues, making it a higher priority.

BEstablish the threshold of risk to escalate to the client immediately.Correct

Since the client explicitly states they plan to fix critical issues immediately *before* the service goes public, it is paramount to define what constitutes a 'critical issue' and establish a clear threshold of risk for immediate escalation. This agreement ensures that severe vulnerabilities are identified and communicated promptly, allowing the client to address them within their desired timeframe and mitigate significant pre-launch risks.

CEstablish the method of potential false positives.

Establishing a method for handling potential false positives is a good practice, but it is secondary to defining what risks necessitate immediate action, especially with a critical pre-launch timeline.

DEstablish the preferred day of the week for reporting.

Defining the preferred day for reporting is an administrative detail that can be handled later, after more critical parameters like risk escalation are established.

Concept tested: Penetration testing scope and communication - critical findings

Topics

#Risk Escalation#Client Communication#Engagement Planning#Critical Findings

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-002 Practice