Welcome to the Reporting and Communication MCQs Page

Dive deep into the fascinating world of Reporting and Communication with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Reporting and Communication, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Reporting and Communication, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Reporting and Communication. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Reporting and Communication. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Reporting and Communication MCQs | Page 7 of 7

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Penetration Testing

02

Planning and Scoping Penetration Tests 🔒

03

Information Gathering 🔒

04

Vulnerability Scanning 🔒

05

Analyzing Vulnerability Scans

06

Exploiting and Pivoting 🔒

07

Exploiting Network Vulnerabilities 🔒

08

Exploiting Physical and Social Vulnerabilities

09

Exploiting Application Vulnerabilities 🔒

10

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

11

Scripting for Penetration Testing 🔒

Q61.

Which one of the following items is not appropriate for the executive summary of a penetration testing report?

Description of findings

Statement of risk

Plain language

Technical detail

Discuss

Answer: (d).Technical detail Explanation:An executive summary should be written in a manner that makes it accessible to the layperson and should not contain technical detail.

Q62.

Which one of the following activities is not commonly performed during the post-engagement cleanup phase?

Remediation of vulnerabilities

Removal of shells

Removal of tester-created credentials

Removal of tools

Discuss

Answer: (a).Remediation of vulnerabilities Explanation:Vulnerability remediation is a follow-on activity and is not conducted as part of the test. The testers should, however, remove any shells or other tools installed during testing as well as remove any accounts or credentials that they created.

Q63.

Who is the most effective person to facilitate a lessons learned session after a penetration test?

Team leader

CIO

Third party

Client

Discuss

Answer: (c).Third party Explanation:The most effective way to conduct a lessons learned session is to ask a neutral third party to serve as the facilitator, allowing everyone to express their opinions freely.

Q64.

Which one of the following is not an example of an operational control that might be implemented to remediate an issue discovered during a penetration test?

Job rotation

Time-of-day login restrictions

Network segmentation

User training

Discuss

Answer: (c).Network segmentation Explanation:Network segmentation is an example of a technical control. Time-of-day restrictions, job rotation, and user training are all examples of operational controls.

Q65.

Which one of the following techniques is not an appropriate remediation activity for a SQL injection vulnerability?

Network firewall

Input sanitization

Input validation

Parameterized queries

Discuss

Answer: (a).Network firewall Explanation:Input sanitization (also known as input validation) and parameterized queries are both acceptable means for preventing SQL injection attacks. Network firewalls generally would not prevent such an attack.

Q66.

When should system hardening activities take place?

When the system is initially built

When the system is initially built and periodically during its life

When the system is initially built and when it is decommissioned

When the system is initially built, periodically during its life, and when it is decommissioned

Discuss

Answer: (b).When the system is initially built and periodically during its life Explanation:System hardening should take place when a system is initially built and periodically during its life. There is no need to harden a system prior to decommissioning because it is being shut down at that point.

Q67.

Biometric authentication technology fits into what multifactor authentication category?

Something you know

Something you are

Somewhere you are

Something you have

Discuss

Answer: (b).Something you are Explanation:Biometric authentication techniques use a measurement of some physical characteristic of the user, such as a fingerprint scan, facial recognition, or voice analysis.

Page 7 of 7

Planning and Scoping Penetration Tests 🔒

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Reporting and Communication MCQs Page

Reporting and Communication MCQs | Page 7 of 7

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Penetration Testing

Analyzing Vulnerability Scans

Exploiting Physical and Social Vulnerabilities

Suggested Topics

SQL Server

R Programming

Computer Graphics

Software Architecture and Design

Neural Networks

Java Programming

Embedded Systems

Java Spring Framework

CompTIA PenTest+ Certification Exam PT0 002