CompTIA PenTest+ (PT0-003)Engagement ManagementHard
A tester's Rules of Engagement explicitly prohibit denial-of-service testing. While using Metasploit to exploit a vulnerable service, an exploit module unexpectedly crashes the target application, causing an outage. What is the tester's correct immediate action?
- AAttempt to quietly restart the crashed service using the compromised access before anyone notices
- BImmediately halt testing of the affected system and notify the client's point of contact
- CContinue testing other systems and mention the crash only in the final report
- DWait until the scheduled weekly status call to mention the incident
Show answer & explanationAnswer & explanation
Correct answer: B. Immediately halt testing of the affected system and notify the client's point of contact
When an adverse event such as an unintended outage occurs, especially one that violates the RoE's prohibition on DoS conditions, the tester must immediately stop testing the affected system and notify the client through the agreed communication plan so the client can respond appropriately. Delaying disclosure or trying to fix it covertly breaches ethical and contractual obligations.
Why the other options are wrong
- A. Attempting to covertly fix the issue using unauthorized access could cause further harm and is unethical.
- C. Continuing testing while delaying disclosure risks further damage and violates transparency obligations.
- D. Waiting for a scheduled call unnecessarily delays the client's ability to respond to a live outage.
Adverse Event Handling
The required immediate response when testing unintentionally causes harm, such as a service outage, including halting activity and prompt client notification.
- RoE typically requires immediate notification of adverse events
- Testing on the affected system should stop right away
- Should never be concealed or delayed until a routine check-in
Memory trick: Stop, Call, Log, Assess, Resume-with-OK — the five-step adverse event drill.