What Is the Next Step After Finding an EOL Vulnerable Web App During Recon?
A penetration tester is conducting an engagement for a company and has identified a vulnerable web application. During the reconnaissance phase the tester discovers that the internal web application contains end-of-life components. Which of the following is the most appropriate next step?
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the phases of penetration testing: after reconnaissance, the tester must exploit discovered vulnerabilities; the common trap is confusing the tester's role with IT support or incident response.
In a penetration test, discovering an end-of-life vulnerable web application during reconnaissance should lead to the next step: exploiting the vulnerability to gain access. Discussion consensus strongly favors option D, because findings are documented and reported after the test, rather than patched or disclosed mid-engagement.
A is the most common wrong answer because testers may feel they should report immediately, but during an engagement you should complete exploitation and include fixes in the final report; also end-of-life components often cannot be patched.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Once a penetration tester identifies a vulnerable end-of-life component during reconnaissance, the standard process moves to the exploitation phase. Gaining access demonstrates the real impact of the vulnerability and supports a strong final report. Option D is the only answer that follows the penetration testing methodology.Why the Other Options Are Wrong
A is incorrect because a tester does not remediate or notify IT mid-test; findings are reported at the end, and EOL components are not supported for patching. B is unrelated to the identified vulnerability and could be out of scope. C is a denial-of-service action that is not a valid penetration test technique and can violate the rules of engagement.Community Comment Notes
Commenters clearly favor D, with one explaining that you would exploit the vulnerability and include it in your report at the end of your assessment. Another comment adds that you cannot patch end-of-life components, eliminating A. The comment about the reconnaissance phase reinforces that exploitation is the next logical phase, while another commenter expresses the same confusion many students have.Official Reference
Exam Strategy
Remember the penetration testing life cycle: plan/scoping, reconnaissance, scanning/enumeration, exploitation, post-exploitation, and reporting. When a vulnerability is discovered, your job is to exploit it and document the outcome; never perform DoS or patch systems during an assessment.