A company's incident response team determines that a breach occurred because a penetration tester left a web shell. Which of the following should the penetration tester have done after the engagement?

The correct answer is B. Remove utilized persistence mechanisms on client systems. The immediate and mandatory post-engagement action after completing an authorized penetration test is to remove any accounts, implants, backdoors, web shells, scheduled tasks, or other persistence mechanisms that were created or used during the test. Leaving persistence (a web…

Submitted by chen.hong· Mar 6, 2026Engagement management

Question

Options

AEnable a host-based firewall on the machine
BRemove utilized persistence mechanisms on client systems
CRevert configuration changes made during the engagement
DTurn off command-and-control infrastructure

How the community answered

(32 responses)

A
6% (2)
B
88% (28)
C
3% (1)
D
3% (1)

Explanation

The immediate and mandatory post-engagement action after completing an authorized penetration test is to remove any accounts, implants, backdoors, web shells, scheduled tasks, or other persistence mechanisms that were created or used during the test. Leaving persistence (a web shell in this case) is exactly what caused the breach and is an unacceptable post-test lapse. Persistence mechanisms provide continued unauthorized access and are a direct security risk if not removed. Removing them returns the environment to its pre-test security posture and prevents later compromise by third parties.

Topics

#post-engagement cleanup#persistence mechanisms#web shells#ethical hacking

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice