In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: . Which of the following would be the best action for the tester to take NEXT with this information? A) Create a custom password dictionary as preparation for password spray testing. B) Recommend using a password manage/vault instead of text files to store passwords securely. C) Recommend configuring password complexity rules in all the systems and applications. D) Document the unprotected file repository as a finding in the penetration-testing report.

Question

In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: <name-serial_number> . Which of the following would be the best action for the tester to take NEXT with this information?
A) Create a custom password dictionary as preparation for password spray testing.
B) Recommend using a password manage/vault instead of text files to store passwords securely.
C) Recommend configuring password complexity rules in all the systems and applications.
D) Document the unprotected file repository as a finding in the penetration-testing report.

Quizplus · Accepted Answer

The tester should document the unprotected file repository as a finding in the penetration-testing report to ensure that the issue is formally recognized and addressed by the organization.

In an Unprotected Network File Repository, a Penetration Tester Discovers