Exam PT0-002 topic 1 question 30 discussion

B. Establish the threshold of risk to escalate to the client immediately. The most important thing for the penetration tester to define first is the threshold of risk to escalate to the client immediately. The client has stated that it wants to fix any findings, except for critical issues, after the service is made public. Therefore, it's important for the penetration tester to establish with the client the level of risk that would warrant an immediate escalation, so that the client can take action to fix the issue before the service is made public. This will help to mitigate the impact of any potential vulnerabilities on the new service and its users. Establishing the format required by the client (Option A) and the method of potential false positives (Option C) are important as well, but it is secondary to the threshold of risk escalation. Establishing the preferred day of the week for reporting (Option D) is also important but it is not as critical as establishing the threshold of risk escalation.

B. Threshold of Risk: Since the client is planning to fix only critical issues before making the service public and the rest after, it is crucial to define what constitutes a “critical issue” and the threshold at which findings must be escalated immediately. This ensures that any severe vulnerabilities that could jeopardize the service’s security are addressed promptly. Analysis of Other Options: A. Establish the format required by the client: While important, the format of the report is secondary to understanding the criticality of issues that need immediate attention. C. Establish the method of potential false positives: Handling false positives is important for accurate reporting, but it comes after ensuring critical issues are promptly identified and escalated. D. Establish the preferred day of the week for reporting: Regular reporting is necessary, but it is more important to know when to escalate critical issues outside of regular reporting schedules.

The most important thing for the penetration tester to define first is B. Establish the threshold of risk to escalate to the client immediately. This will ensure that any findings that need to be fixed urgently are communicated to the client right away, and all other findings can be reported in a single report at the end of the assessment.

Critical on the CVSS score is 9-10 it states CRITICAL

bbbbbbbbbbbbbbbb

The requierment of the client makes it clear that need the critical vulnerabilities to be reported a.s.a.p for it to be able to fix before launch date if possible

"except for critical issues" in the question makes me think B.

Answer is D