Welcome to the Reporting and Communication MCQs Page

Dive deep into the fascinating world of Reporting and Communication with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Reporting and Communication, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Reporting and Communication, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Reporting and Communication. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Reporting and Communication. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Reporting and Communication MCQs | Page 6 of 7

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Penetration Testing

02

Planning and Scoping Penetration Tests 🔒

03

Information Gathering 🔒

04

Vulnerability Scanning 🔒

05

Analyzing Vulnerability Scans

06

Exploiting and Pivoting 🔒

07

Exploiting Network Vulnerabilities 🔒

08

Exploiting Physical and Social Vulnerabilities

09

Exploiting Application Vulnerabilities 🔒

10

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

11

Scripting for Penetration Testing 🔒

Q51.

Why is it often helpful to have a third party moderate the lessons learned session in a penetration testing engagement?

To provide technical insights

To disclose sensitive information

To approach the results objectively without attachment to the work

To influence the findings in favor of the client

Discuss

Answer: (c).To approach the results objectively without attachment to the work Explanation:Having a third party moderate the lessons learned session is helpful to approach the results objectively without attachment to the work and draw out details that might be obvious to the team but helpful to an outside reader.

Q52.

What might be included in follow-up actions after a penetration testing engagement?

Conducting the same tests with the same tools

Quick retests at no charge

Retesting resources with vulnerabilities to verify remediation

All of the above

Discuss

Answer: (d).All of the above Explanation:Follow-up actions may include conducting different tests, quick retests at no charge if within the original scope, and retesting resources with vulnerabilities to verify remediation.

Q53.

When might a formal attestation of findings be requested in a penetration testing engagement?

As part of the lessons learned session

When the client requests additional tests

When the test is conducted for regulatory or contractual commitments

When there are no vulnerabilities found

Discuss

Answer: (c).When the test is conducted for regulatory or contractual commitments Explanation:A formal attestation of findings might be requested when the test is conducted for regulatory or contractual commitments.

Q54.

What does the level of detail in a formal attestation of findings depend on?

The number of team members involved

The purpose of the request

The duration of the penetration test

The client's technical knowledge

Discuss

Answer: (b).The purpose of the request Explanation:The level of detail in a formal attestation of findings depends on the purpose of the request.

Q55.

What should testers observe regarding data retention and destruction at the conclusion of a penetration testing engagement?

Preserve all data for future use

Retain any data without client confirmation

Carefully observe the requirements stated in the statement of work

Securely destroy all data after a long retention period

Discuss

Answer: (c).Carefully observe the requirements stated in the statement of work Explanation:Testers should carefully observe the requirements stated in the statement of work regarding data retention and destruction.

Q56.

What type of report is the client requesting when they ask for a letter documenting the penetration test results for compliance files?

Executive summary

Penetration testing report

Written testimony

Attestation of findings

Discuss

Answer: (d).Attestation of findings Explanation:An attestation of findings is a certification provided by the penetration testers to document that they conducted a test and the results for compliance purposes.

Q57.

Wendy is reviewing the results of a penetration test and learns that her organization uses the same local administrator password on all systems. Which one of the following tools can help her resolve this issue?

LAPS

Nmap

Nessus

Metasploit

Discuss

Answer: (a).LAPS Explanation:The Local Administrator Password Solution (LAPS) from Microsoft provides a method for randomizing local administrator account credentials through integration with Active Directory.

Q58.

Which one of the following is not a normal communication trigger for a penetration test?

Discovery of a critical finding

Completion of a testing stage

Documentation of a new test

Identification of prior compromise

Discuss

Answer: (c).Documentation of a new test Explanation:The three common triggers for communication during a penetration test are the completion of a testing stage, the discovery of a critical finding, and the identification of indicators of prior compromise.

Q59.

Gary ran an Nmap scan of a system and discovered that it is listening on port 22 despite the fact that it should not be accepting SSH connections. What finding should he report?

Shared local administrator credentials

Unnecessary open services

SQL injection vulnerability

No multifactor authentication

Discuss

Answer: (b).Unnecessary open services Explanation:The only conclusion that Gary can draw from this information is that the server is offering unnecessary services because it is listening for SSH connections when it should not be supporting that service.

Q60.

Tom’s organization currently uses password-based authentication and would like to move to multifactor authentication. Which one of the following is an acceptable second factor?

Security question

Smartphone app

Passphrase

Discuss

Answer: (c).Smartphone app Explanation:Passphrases, security questions, and PINs are all examples of knowledge-based authentication and would not provide multifactor authentication when paired with a password. Smartphone apps are an example of "something you have" and are an acceptable alternative.

Page 6 of 7

Planning and Scoping Penetration Tests 🔒

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Reporting and Communication MCQs Page

Reporting and Communication MCQs | Page 6 of 7

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Penetration Testing

Analyzing Vulnerability Scans

Exploiting Physical and Social Vulnerabilities

Suggested Topics

Digital Communication

C# programming

Wireless and Mobile Communications

Systems Programming

Computer Architecture

Cryptography and Network Security

HTML

DBMS

Object Oriented Programming Using C++