Practice questions for the CompTIA PenTest+ exam objectives

A tester discovers a critical SQL injection during an engagement. The vulnerability is in a production system and clearly exploitable to extract customer PII. What is the appropriate immediate action?

• AWait until the final report
• BStop active exploitation of the finding, notify the client point of contact immediately per the agreed escalation path in the Rules of Engagement, and document the finding for the report
• CContinue exploiting to map the full database
• DDisclose the finding publicly to pressure the client into remediating

Keyboard shortcuts: Off