PenTest+ PT0-002 Exam Questions and Answers PDF

Client acceptance (A) is a critical post-report delivery activity that involves the client formally accepting the findings and conclusions of a penetration assessment report. This process usually includes a review of the findings by the client, discussions about the impact, and agreement on the accuracy and relevance of the reported vulnerabilities and issues. Ensuring client acceptance soon after the delivery of the report can prevent scenarios where the validity of findings is debated long after the assessment, as in the case described.

Data destruction process (B), attestation of findings (C), and lessons learned (D) are also important aspects of a penetration testing engagement, but they do not directly address the issue of the client disputing the findings well after the report has been delivered. Client acceptance ensures both parties are in agreement on the outcomes of the assessment, minimizing disputes about the findings later on.

To intercept the communications between an employee's wireless headset and smartphone, the penetration tester would likely use "Bluejacking" (B). Bluejacking involves sending unsolicited messages to Bluetooth-enabled devices, but in the context of penetration testing and security, it can also encompass techniques for intercepting or hijacking Bluetooth connections. This could allow the tester to eavesdrop on communications or even take control of the headset.

Insecure Direct Object References (IDOR) vulnerabilities occur when an application provides direct access to objects based on user-supplied input. This can allow an attacker to bypass authorization and access resources in the system directly, for example database records or files1. In this case, the penetration tester could potentially bypass the strict access controls and access the organization’s sensitive files. References: IDOR Vulnerability Overview