Which standard should a consultant use to rank web pen test findings by criticality?

PT0-002 By islever Editorial Last updated

Short answer

A OWASP

Question

After performing a web penetration test, a security consultant is ranking the findings by criticality. Which of the following standards or methodologies would be best for the consultant to use for reference?
  1. OWASP Correct Answer
  2. MITRE ATT&CK
  3. PTES
  4. NIST

Key Takeaways

The exam tests your ability to match the right security framework to the task: OWASP is specifically designed for web app risk ranking, while MITRE ATT&CK focuses on adversary tactics and techniques.

For ranking web application penetration test findings by criticality, OWASP is the best reference because its Top 10 list classifies the most critical web risks. The community unanimously chose OWASP over MITRE ATT&CK, PTES, and NIST for this purpose.

Common mistake: Choosing MITRE ATT&CK is the most common trap because it is a popular framework, but it does not provide a severity or criticality ranking for vulnerabilities—it maps attack techniques, not risk levels.

Expert Analysis

Why the Answer Is Correct

OWASP (Open Web Application Security Project) provides the OWASP Top 10, which is a widely recognized list of the most critical web application security risks. This makes it the most appropriate reference for ranking findings from a web penetration test by criticality. The OWASP Testing Guide also offers detailed methodology for assessing web vulnerabilities, reinforcing its suitability.

Why the Other Options Are Wrong

MITRE ATT&CK is a knowledge base of adversary tactics and techniques, not a severity ranking system—it is better suited for red team exercises and threat modeling. PTES (Penetration Testing Execution Standard) provides a framework for conducting penetration tests but does not focus on ranking findings. NIST offers general security and risk management guidelines, but it is not web-specific and lacks a Top 10 criticality list for web vulnerabilities.

Community Comment Notes

Comment 1 explains that OWASP is renowned for its comprehensive web application security documentation and that the Top 10 outlines the most critical risks. Comment 2 observes that MITRE ATT&CK doesn't show criticality like a CVE score, and that OWASP makes more sense because the top 10 is ranked by importance. Comment 3 reinforces that MITRE ATT&CK is for tactics and techniques used in red team exercises, not for vulnerability severity ranking.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks about ranking web pen test findings, immediately consider OWASP because it maintains the Top 10 critical web risks. Eliminate MITRE ATT&CK if the context is about severity or prioritization, since that framework is for understanding attacker behavior, not scoring vulnerabilities.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. PhillyCheese 👍 2 Answered A
    After performing a web penetration test, using the OWASP (Open Web Application Security Project) standards or methodologies would be the best choice for ranking the findings by criticality. OWASP is renowned for its comprehensive documentation and guidelines on web application security, including the well-known OWASP Top 10 list, which outlines the ten most critical web application security risks. This makes it an ideal reference for categorizing and prioritizing vulnerabilities discovered during a web penetration test. While MITRE ATT&CK, PTES (Penetration Testing Execution Standard), and NIST (National Institute of Standards and Technology) provide valuable frameworks and methodologies for cybersecurity, OWASP's focus on web applications specifically makes it the most suitable for this context.
  2. r3vrnd 👍 1
    CVE stands for Common Vulnerabilities and Exposures. CVE is a glossary that classifies vulnerabilities. The glossary analyzes vulnerabilities and then uses the Common Vulnerability Scoring System (CVSS) to evaluate the threat level of a vulnerability. A CVE score is often used for prioritizing the security of vulnerabilities. The CVE glossary is a project dedicated to tracking and cataloging vulnerabilities in consumer software and hardware. It is maintained by the MITRE Corporation with funding from the US Division of Homeland Security. Vulnerabilities are collected and cataloged using the Security Content Automation Protocol (SCAP). OWASP ranks their top 10, but Mitre provides a scoring system for all known vulns making it the best choice to compare and rank the vulns found The Answer is B
  3. narst 👍 1
    Answer A probably MITRE ATTACK doesn't really show criticality the same as a CVE. theyre different. OWASP makes more sinse and should probably have the highest rate of exploits for OWASP as most critical. they are ranked in owasp top 10
  4. PMann 👍 1 Answered A
    Mitre is for tips and tactics for red team exercises.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide