A penetration tester discovers evidence of an advanced persistent threat on the network that is being tested. Which of the following should the tester do next?

The correct answer is A. Report the finding. Upon discovering evidence of an advanced persistent threat (APT) on the network, the penetration tester should report the finding immediately. Advanced Persistent Threat (APT): Definition: APTs are prolonged and targeted cyberattacks in which an intruder gains access to a…

Submitted by carter_n· Mar 6, 2026Engagement Management

Question

Options

AReport the finding.
BAnalyze the finding.
CRemove the threat.
DDocument the finding and continue testing.

How the community answered

(47 responses)

A
55% (26)
B
15% (7)
C
6% (3)
D
23% (11)

Explanation

Upon discovering evidence of an advanced persistent threat (APT) on the network, the penetration tester should report the finding immediately. Advanced Persistent Threat (APT): Definition: APTs are prolonged and targeted cyberattacks in which an intruder gains access to a network and remains undetected for an extended period. Significance: APTs often involve sophisticated tactics, techniques, and procedures (TTPs) aimed at stealing data or causing disruption. Immediate Reporting: Criticality: Discovering an APT requires immediate attention from the organization's security team due to the potential impact and persistence of the threat. Chain of Command: Following the protocol for reporting such findings ensures that appropriate incident response measures are initiated promptly.

Topics

#APT#incident response#reporting findings

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice