exam questions

Exam PT1-002 All Questions

View all questions & answers for the PT1-002 exam

Exam PT1-002 topic 1 question 56 discussion

Actual exam question from CompTIA's PT1-002
Question #: 56
Topic #: 1
[All PT1-002 Questions]

A company becomes concerned when the security alarms are triggered during a penetration test. Which of the following should the company do NEXT?

  • A. Halt the penetration test.
  • B. Conduct an incident response.
  • C. Deconflict with the penetration tester.
  • D. Assume the alert is from the penetration test.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
tahagoksoy
Highly Voted 3 years, 1 month ago
I think the answer is C here. Since they need to validate with pentester if the pentester triggered alarms or not
upvoted 12 times
Adonist
3 years, 1 month ago
I would go for C as well to validade if it's not caused by the penetration tester first then do a incident response if it's not.
upvoted 7 times
...
...
shakevia463
Most Recent 2 years, 3 months ago
Selected Answer: C
No incident if they deconflict first
upvoted 3 times
...
BinarySoldier
3 years, 2 months ago
I agree with B
upvoted 4 times
RVP20
3 years, 2 months ago
Shouldn't be A? I am confused between A & B but i will go with A.
upvoted 1 times
brandonl
3 years, 1 month ago
The company is not doing the penetration test, the penetration tester is. Incident response occurs after verifying there is an incident. Deconfliction occurs to prevent incident response by verifying what happened was not malicious.
upvoted 5 times
isaphiltrick
1 year, 8 months ago
Nicely said. I agree with C - deconflict
upvoted 1 times
...
...
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago