What Is the Next Step After Finding an EOL Vulnerable Web App During Recon?

PT0-002 By islever Editorial Last updated

Short answer

D Exploit the vulnerability to gam access to the web application’s back-end systems

Question

A penetration tester is conducting an engagement for a company and has identified a vulnerable web application. During the reconnaissance phase the tester discovers that the internal web application contains end-of-life components. Which of the following is the most appropriate next step?
  1. Report the vulnerability to the company’s IT department and provide the department with detailed information for patching the application
  2. Perform a brute-force attack on the web application’s log-in page to test the strength of user passwords
  3. Launch a denial-of-service attack against the web application to disrupt its availability and expose potential vulnerabilities
  4. Exploit the vulnerability to gam access to the web application’s back-end systems Correct Answer

Key Takeaways

The exam tests the phases of penetration testing: after reconnaissance, the tester must exploit discovered vulnerabilities; the common trap is confusing the tester's role with IT support or incident response.

In a penetration test, discovering an end-of-life vulnerable web application during reconnaissance should lead to the next step: exploiting the vulnerability to gain access. Discussion consensus strongly favors option D, because findings are documented and reported after the test, rather than patched or disclosed mid-engagement.

Common mistake: A is the most common wrong answer because testers may feel they should report immediately, but during an engagement you should complete exploitation and include fixes in the final report; also end-of-life components often cannot be patched.

Expert Analysis

Why the Answer Is Correct

Once a penetration tester identifies a vulnerable end-of-life component during reconnaissance, the standard process moves to the exploitation phase. Gaining access demonstrates the real impact of the vulnerability and supports a strong final report. Option D is the only answer that follows the penetration testing methodology.

Why the Other Options Are Wrong

A is incorrect because a tester does not remediate or notify IT mid-test; findings are reported at the end, and EOL components are not supported for patching. B is unrelated to the identified vulnerability and could be out of scope. C is a denial-of-service action that is not a valid penetration test technique and can violate the rules of engagement.

Community Comment Notes

Commenters clearly favor D, with one explaining that you would exploit the vulnerability and include it in your report at the end of your assessment. Another comment adds that you cannot patch end-of-life components, eliminating A. The comment about the reconnaissance phase reinforces that exploitation is the next logical phase, while another commenter expresses the same confusion many students have.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Remember the penetration testing life cycle: plan/scoping, reconnaissance, scanning/enumeration, exploitation, post-exploitation, and reporting. When a vulnerability is discovered, your job is to exploit it and document the outcome; never perform DoS or patch systems during an assessment.

Community Votes

D
80%
A
20%

80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. IamBlackFire 👍 4
    I'm confused, as always. I would say D, but perhaps for a company is not acceptable to has an end-of-life application running, so the team should tell immediately to them. What do you think?
  2. uselessscript 👍 4 Answered D
    You would exploit the vulnerability and include it in your report at the end of your assessment.
  3. Kmelaun 👍 2
    You can not patch end of life components, I don’t think it’s A. If you are a penetration tester you would exploit the vulnerability. You wouldn’t report it.
  4. a87d6a4 👍 1
    "Exploit the vulnerability to gam access"
  5. euca2023 👍 1 Answered A
    During the "reconnaissance" phase

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which Post-Report Activity Prevents CISO Disputing Finding Validity?

S-grade

How should penetration testers prioritize findings in a report?

S-grade

Which agreement did a pen tester breach by requesting a CVE without authorization?

S-grade

Which Tool Best Detects Vulnerabilities on a Database Server?

S-grade

← Back to PT0-002 Study Guide