Post Engagement Cleanup & Retesting

1. What timeline should be established for remediation and retesting?

Agreed schedule based on vulnerability severity

Immediately after the engagement

Six months later

Only when the client requests it

Submit

5. What is the primary risk of incomplete cleanup?

Backdoors or artifacts remain, creating security risks

The client pays less for services

The engagement report becomes invalid

Future penetration tests are unnecessary

6. How should sensitive engagement data be securely destroyed?

Secure deletion methods, encryption, or physical destruction

Standard delete function

Moving files to a recycle bin

Sharing with team members for backup

7. What should be included in a post-engagement report? (Select all that apply)

Summary of findings and remediation status

Cleanup procedures performed

Retesting results and verification

Personal opinions about the client

Submit

8. True or False: Post-engagement reports should exclude details about cleanup procedures.

True

False

9. A penetration tester discovers that a patched vulnerability is still exploitable. What should they do?

Document and report the finding immediately

Assume the patch was incomplete and wait

Remove evidence and continue testing

Contact the vendor directly

10. During retesting, what should the penetration tester verify?

Vulnerabilities are fixed and no new issues were introduced

Only that critical findings are gone

The client's system performance

Network bandwidth usage

11. What is the primary goal of post-engagement cleanup?

Remove all testing tools and artifacts from client systems

Generate a final invoice for services

Schedule the next engagement

Archive all findings immediately

12. Which vulnerabilities typically require immediate retesting? (Select all that apply)

Critical and high-severity findings

Issues affecting authentication mechanisms

All low-severity findings

Vulnerabilities in exposed services

Submit

13. What is the purpose of retesting after remediation?

Verify that vulnerabilities have been fixed

Generate additional billing hours

Create new test accounts

Document all system configurations

14. True or False: Test accounts should remain on systems for future reference.

True

False

15. What documentation should be created during post-engagement cleanup?

Cleanup checklist, evidence inventory, and system restoration logs

Only the final report

Billing records and invoices

Client contact information

16. Match each cleanup task with its description:

Artifact removal

Account cleanup

Log sanitization

Configuration restoration

Submit

17. When should evidence collection occur relative to cleanup?

Before cleanup begins

During cleanup procedures

After cleanup is complete

Evidence is not needed after cleanup

18. What is the proper chain of custody in evidence handling?

Collection, documentation, storage, transfer with accountability

Collection, transfer, storage, deletion

Documentation, collection, deletion, archival

Transfer, storage, documentation, collection

19. True or False: Evidence preservation should occur after system cleanup.

True

False

20. Which of the following should be included in cleanup procedures? (Select all that apply)

Remove shells and backdoors

Delete temporary files and test accounts

Reset modified configurations

Increase firewall rules

Submit

PenTest+ Post Engagement Cleanup and Retesting Quiz

1. What timeline should be established for remediation and retesting?

2.

What first name or nickname would you like us to use?

2. Before conducting retesting, the penetration tester should confirm that ____ have been applied and deployed.

3. A ____ is a record documenting every action taken during cleanup to ensure accountability.

4. The process of verifying that security patches address vulnerabilities is called ____.

5. What is the primary risk of incomplete cleanup?

6. How should sensitive engagement data be securely destroyed?

7. What should be included in a post-engagement report? (Select all that apply)

8. True or False: Post-engagement reports should exclude details about cleanup procedures.

9. A penetration tester discovers that a patched vulnerability is still exploitable. What should they do?

10. During retesting, what should the penetration tester verify?

11. What is the primary goal of post-engagement cleanup?

12. Which vulnerabilities typically require immediate retesting? (Select all that apply)

13. What is the purpose of retesting after remediation?

14. True or False: Test accounts should remain on systems for future reference.

15. What documentation should be created during post-engagement cleanup?

16. Match each cleanup task with its description:

17. When should evidence collection occur relative to cleanup?

18. What is the proper chain of custody in evidence handling?

19. True or False: Evidence preservation should occur after system cleanup.

20. Which of the following should be included in cleanup procedures? (Select all that apply)