Exam PT1-002 All Questions

View all questions & answers for the PT1-002 exam

Exam PT1-002 topic 1 question 17 discussion

Actual exam question from CompTIA's PT1-002

Question #: 17
Topic #: 1

A penetration tester is reviewing the following SOW prior to engaging with a client:
`Network diagrams, logical and physical asset inventory, and employees' names are to be treated as client confidential. Upon completion of the engagement, the penetration tester will submit findings to the client's Chief Information Security Officer (CISO) via encrypted protocols and subsequently dispose of all findings by erasing them in a secure manner.`
Based on the information in the SOW, which of the following behaviors would be considered unethical? (Choose two.)

A. Utilizing proprietary penetration-testing tools that are not available to the public or to the client for auditing and inspection
B. Utilizing public-key cryptography to ensure findings are delivered to the CISO upon completion of the engagement
C. Failing to share with the client critical vulnerabilities that exist within the client architecture to appease the client's senior leadership team
D. Seeking help with the engagement in underground hacker forums by sharing the client's public IP address
E. Using a software-based erase tool to wipe the client's findings from the penetration tester's laptop
F. Retaining the SOW within the penetration tester's company for future use so the sales team can plan future engagements

Show Suggested Answer

Suggested Answer: CD 🗳️

by BinarySoldier at Nov. 22, 2021, 8:02 p.m.

Comments

Submit Cancel

[Removed]

Highly Voted 3 years, 6 months ago

C & D would be correct

upvoted 13 times

...

jedington

Highly Voted 3 years, 4 months ago

C and D. Can't be E, as the SOW specifically tells the Pentester to wipe the data once done. F is doubtful since a SOW shouldn't have sensitive information; keeping a SOW implies the Pentester(s) will come back later for a re-assessment.

upvoted 6 times

...

MeisAdriano

Most Recent 11 months, 3 weeks ago

Selected Answer: CD

NOT A) because: in your penetration test can use all tool you are authorized to use. NOT B) because: that's ethical, not "unethical" NOT F) because: SOW it's just a document between parts, you can use it to plan future engagements. That's not unethical. it's D) because: If i ask help in underground hackers forum, sharing the public IP address, I'm sharing information about my client. Information about my client is not only "the IP address" but the question, the answer I can receive and all data and metadata about this situation. If the forum community know that Facebook is doing a pentest in night hours, maybe someone can suppose to attack facebook hiding their actions "like a pentest". That's really not ethical and without professionalism; could be illegal too violating NDA.

upvoted 1 times

MeisAdriano

11 months, 3 weeks ago

Maybe C) because: I'm testing your system, I have not to "appease" the leadership; but this answer is borderline, obviously if I don't tell your vulnerability to you that's not ethical. Maybe E) because: depends what I'm erasing. Pentest should never compromise the business continuity; if a Pentester deletes tracks about the attack ok, but if a Pentester deletes important files on the tester's laptop, that's not ethical.

upvoted 1 times

...

AaronS1990

2 years, 3 months ago

Selected Answer: CD

This is definitely C and D

upvoted 1 times

...

S_ed

2 years, 3 months ago

Thought of CD

upvoted 2 times

...

bieecop

2 years, 7 months ago

Selected Answer: CD

C D That's correct.

upvoted 4 times

...

Stache

3 years ago

Selected Answer: CD

You need to base your answers off the provided SOW, the only ones that directly go against it are C & D.

upvoted 4 times

...

willsy

3 years, 1 month ago

People use gold disc images to erase / format and rebuild laptops all the time. If it is secret or above you can technically get the client to pay for the hard drive and you add that onto the cost but we usually just software erase.

upvoted 1 times

...

kiduuu

3 years, 2 months ago

Selected Answer: CD

C and D. F is doubtful since a SOW shouldn't have sensitive information

upvoted 5 times

...

Charlieb123

3 years, 3 months ago

Selected Answer: CF

Are these two actions unethical? C: Failing to share with the client critical vulnerabilities on purpose F: Retaining the SOW in breach of the terms. Both are, in my mind

upvoted 2 times

kiduuu

3 years, 2 months ago

Only C

upvoted 2 times

...

brandonl

3 years, 3 months ago

C & E. How can it be D? It is the public IP address. Anyone and everyone knows a company's public IP, plus the question never says anything about not sharing the public IP. D certainly does sound shady, but this is no different than consulting Shodan for recon against the public IP address. E could potentially retain sensitive information, and pentesters would have no reason to keep this as a new SOW will be drafted at each arrangement.

upvoted 4 times

shakevia463

2 years, 5 months ago

`Network diagrams, logical and physical asset inventory, and employees' names are to be treated as client confidential

upvoted 1 times

...

tokhs

3 years, 3 months ago

Selected Answer: DF

correct answer d and f

upvoted 1 times

...

Davar39

3 years, 6 months ago

C, is surely correct, now D sounds unethical and shady but the question specifically asks to answer based on the information in the specific SOW. So I think that E is also correct. I will go with C and E.

upvoted 1 times

...

BinarySoldier

3 years, 7 months ago

The answer is not right. I would go with D and F. With D, Data is being exposed to a third-party which is against the agreement. And for F, retaining the SOW will be similar to keeping a copy of the data the client terms to be confidential, and since the instruction was to get rid of everything in a secure manner, not getting rid of the SOW will be a breach of that article.

upvoted 2 times

...