What action should occur after exploitable vulnerabilities are found during penetration testing?

What action should occur after exploitable vulnerabilities are found during penetration testing?

• A. Document only
• B. Notify vendors only
• C. Ignore them
• D. Correct and repeat testing to verify

Answer: (D)

When exploitable vulnerabilities are found, the right move is to fix them and then re-run testing to confirm the fixes worked. This verification step is essential because it proves the vulnerability is actually closed and that the remediation didn’t cause new issues. Merely documenting the findings leaves risk in the environment, and ignoring them is clearly inappropriate. Retesting ensures the system meets security requirements and provides evidence that remediation was effective, which is a standard expectation in PCI DSS assessments.

When exploitable vulnerabilities are found, the right move is to fix them and then re-run testing to confirm the fixes worked. This verification step is essential because it proves the vulnerability is actually closed and that the remediation didn’t cause new issues. Merely documenting the findings leaves risk in the environment, and ignoring them is clearly inappropriate. Retesting ensures the system meets security requirements and provides evidence that remediation was effective, which is a standard expectation in PCI DSS assessments.