What Should a Tester Do After Discovering an Unauthenticated File Upload?

PT0-002 By islever Editorial Last updated Aug 29, 2026

Short answer

C Notify the primary contact immediately.

Question

During an assessment, a penetration tester found a web component with no authentication requirements. The web component also allows file uploads and is hosted on one of the target public web servers. Which of the following actions should the penetration tester perform next?

Continue the assessment and mark the finding as critical.
Attempt to remediate the issue temporarily.
Notify the primary contact immediately. Correct Answer
Shut down the web server until the assessment is finished.

Key Takeaways

The exam is testing your understanding of proper incident notification for critical findings during a penetration test, with the common trap being to assume documentation alone is the correct immediate action.

When a penetration test reveals an unauthenticated file upload on a public server, the tester should notify the primary contact immediately rather than wait for the final report. Community votes and comments overwhelmingly agree that urgent notification is the required next step for critical findings.

Common mistake: Choosing A (continue and mark as critical) is the most common wrong answer because testers often focus on documentation; however, immediate notification to the primary contact is required for a critical unauthenticated file upload vulnerability.

Expert Analysis

Why the Answer Is Correct

An unauthenticated file upload on a public web server is a critical finding because it can allow an attacker to host malicious content, execute code, or compromise the server. The penetration tester must immediately notify the primary contact so the organization can take urgent action to mitigate the risk — such as isolating the component or applying temporary controls. This aligns with the ethical and contractual obligation to report high-risk vulnerabilities as soon as they are discovered, not only in the final report.

Why the Other Options Are Wrong

Option A is not explicitly wrong as a long-term step, but it is insufficient as the 'next' action: the finding must be communicated immediately, not merely documented. Option B is incorrect because penetration testers are not authorized to remediate issues themselves; doing so can break functionality and fall outside scope. Option D is the most dangerous choice, as shutting down a public web server would cause an outage and is typically not within the tester's authority.

Community Comment Notes

Comments from the community overwhelmingly favor C, with one commenter explaining that immediate notification enables the organization to mitigate the severe security risk without delay (comment [1]). Another commenter directly contrasts options A and C, noting that while continuing the assessment and documenting is important, the primary contact must be informed right away (comment [2]). A minority view suggested that if the vulnerability is not actively being exploited, the tester should document it as critical and continue (comments [3], [4]); however, the accepted answer and best practice require immediate notification for critical findings.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question presents a critical vulnerability, choose the action that involves immediate reporting to the primary contact before any other step. Avoid options that perform remediation or system shutdown, because testers lack authority to modify or stop production systems.

Community Votes

75%

25%

75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

041ba31 👍 4 Answered C

When a penetration tester discovers a significant vulnerability such as a web component that allows file uploads without any authentication requirements, it poses an immediate and severe security risk. Notifying the primary contact immediately is critical to ensure that the organization is aware of the vulnerability and can take swift action to mitigate the risk. This approach prioritizes the security of the organization's systems and data, and it allows the appropriate personnel to assess the situation and decide on the best course of action, such as temporary remediation or further investigation.
Etc_Shadow28000 👍 2 Answered C

C. Notify the primary contact immediately: This is the most appropriate action. The primary contact needs to be informed about this significant security risk as soon as possible so that they can take immediate action to mitigate the risk. • A. Continue the assessment and mark the finding as critical: While it is important to continue the assessment and document the finding as critical, immediate notification is necessary due to the high risk involved. • B. Attempt to remediate the issue temporarily: The penetration tester’s role typically does not involve making changes or remediating issues on the client’s systems without prior approval. • D. Shut down the web server until the assessment is finished: Shutting down the server is an extreme measure that should only be taken by the client or with the client’s explicit authorization.
PMann 👍 1 Answered A

Since it’s not currently being exploited, should be documented at critical for the report and moved on in the test.
outnumber_gargle024 👍 1 Answered A

see PMann's comment

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PT0-002 Study Guide