CompTIA PenTest+ Practice Test

What type of activity might signal the need for the Incident Response Team's involvement during a PenTest?

1. Educational workshops

2. Indicators of prior compromise

3. Data encryption discussions

4. Scheduling conflicts

The correct answer is: Indicators of prior compromise

Indicators of prior compromise can signal a need for the Incident Response Team's involvement during a penetration test. This is because discovering signs that a system or network has been compromised can alter the focus and approach of the testing team. If such indicators are present, it may indicate that there are existing vulnerabilities or ongoing threats that are impacting the organization's security posture. The presence of these indicators demands immediate attention, as they could mean that the organization is facing a more immediate and severe risk than previously understood. Consequently, the Incident Response Team would need to assess the situation to mitigate any active threats and ensure the integrity and security of the systems before proceeding further with the penetration testing activities. In contrast, educational workshops, data encryption discussions, and scheduling conflicts are not directly relevant to identifying security incidents or vulnerabilities. These activities do not inherently necessitate a response from the Incident Response Team, as they are routine operational tasks rather than indicators of a potential security breach.