Exam PT0-002 topic 1 question 397 discussion

I am going D. A pentester doesn't care what the businesses goals are and that doesn't affect the criticality of the vulnerabilities.

Gotta prioritise vulnerabilities based on the companies goals (i.e. making money - critical devices like webservers that host shops or databases with customer info / inventing things - research data must be protected above webservers). This would be discussed during the initial meeting, defining what is 'critical' or 'severe' depends on the business missions and goats.

you have to remember you are not the CEO of the company but the security tester. it doesn't make sense for a tester (not to mention a 3rd party tester) to consider business goals.

You would prioritize findings based on how the vulnerabilities impact that client's business mission and goals, so I'm going with A

Seems to make more sense

makes better sense

Aligning security findings with the organization's business mission and goals ensures that vulnerabilities posing the greatest risk to critical operations are addressed first. This approach considers the potential impact of each vulnerability on the organization's objectives, enabling informed decision-making.

I'm vote for A. not all cyber threats are match with business mission

I would think business missions and goals would influence prioritization

Penetration testing is all about identifying vulnerabilities. So D, prioritising by cyber threats makes sense to me.